Qvm-firewall wildcard for dsthost

[whoami]

Is there any wildcard (or easy workaround) for qvm-firewall?

qvm-firewall disp123 add --before 0 action=accept dsthost=*.com

qvm-firewall disp123 add --before 0 action=drop dsthost=*.ru

Like Restricting a qube to selected websites

^example\.net$
\.example\.net$

but without tinyproxy.

[renehoj]

I don’t think this is possible with iptables, you can use hostnames because they can be translated to IP addresses, but there is no way to get all addresses that match a subdomain wildcard.

[szz9pza]

I didn’t try, but it should works with iptables.

@szz9pza

You could try with iptables and pattern matching (aka regular expression aka regex).
Also note, from https://www.qubes-os.org/doc/firewall/#network-service-qubes :

In particular, if you want to ensure proper functioning of the Qubes firewall, you should not tinker with iptables or nftables rules in such qubes (a qube that is used to run the Qubes firewall service (usually sys-firewall))

Some starting point.
https://www.startpage.com/do/search?q=iptables+regex
https://www.startpage.com/do/search?q=iptables+pattern+match
spoiler: the algo seems to not be regex.
https://askubuntu.com/questions/1001847/how-to-use-regular-expression-with-iptables