Question about Tinyproxy on sys-net listening on 0.0.0.0:8082

User Support
1

Hi,

I’m using Qubes with a Debian 13 sys-net. An external computer is connected directly to sys-net via Ethernet and provides Internet access.

My TemplateVM updates are configured to go through sys-whonix, so the path is essentially:

Template → sys-whonix → sys-firewall → sys-net → Ethernet/Internet

I noticed that ss -tulpn in sys-net shows:

0.0.0.0:8082 — /usr/bin/tinyproxy

I understand this is related to Qubes’ UpdatesProxy, but since my templates use sys-whonix as the UpdateVM, I’m confused about why Tinyproxy is listening on all IPv4 interfaces on sys-net.

Is the 0.0.0.0:8082 listener expected and safe to leave as-is in this setup? Should I leave Tinyproxy enabled, or is there a recommended way to restrict access to it from the physical Ethernet interface?

Thanks!

2

port 8082 is locked down to 127.0.0.1 and 10.137.0.0/16 (which is qubes’ internal subnet, take a look at /etc/tinyproxy/tinyproxy-updates.conf) and nft firewall should deny any unsolicited incoming traffic, there shouldn’t be need to restrict it further from a security stand point but you can disable it by running (note that if you do this in the template it will break updates until it is started again )

sudo systemctl disable --now tinyproxy.service
3

Well, in that case your sys-net is also providing the proxy service.
You should see the same behavior inside your sys-whonix.

If you don’t need it, disable the service in the settings.
qubes-updates-proxy