Restricting access to home-network be default - Guestnetwork setting

General Discussion
,
1

Hi,
I would like to generally restrict access to my home network (like a guest network setting). So that my default qubes are isolated from other devices in the network but have internet access.
I already set up a qube who is the opposite and only have access to devices on the network but not to the internet (for access to home cloud, printer etc.)

I would like your opinions and experiences on that matter.
Is that whole idea necessary? If you do something similar how do you do it?
Do you use the firewall rules or a VPN qube or something else?

Thanks in advance!

2

There’s a feature request about this:

2 Likes
3

The cleanest and easiest way that scales well is to avoid setting firewall rules inside each individual qube (that gets messy fast once you have more than a few).

Instead, create two separate network-providing VMs (NetVMs) and control everything from dom0 with qvm-firewall.

One is “sys-internet” and connects via sys-firewall and sys-net to the internet but can’t access your local LAN because firewall settings disallow it.

The other one is “sys-LAN” which does the exact opposite.

Advantage: just connect AppVMs to the desired NetVM and it’s done.

2 Likes
4

@kcosmus

Complete isolation would require VLAN setup. The subject is not simple and off-topic to Qubes. You should better ask on some networking forum.

Is that whole idea necessary?

Depends on your actual goal.

1 Like