Route ALL Qubes traffic through VPN

User Support General
1

I have a VPN qube set up with all the proper firewall rules and such.

Now, since I am a new Qubes user, my greatest concern is that traffic will still leak through at some point in my system, for example through Dom0 updates (fixed that already)

What generally has to be done so that nothing leaks through?

1 Like
2

Use killswitch with qvm-firewall

qvm-firewall <qube> reset
qvm-firewall <qube> add accept <vpn_ip> dstports=<vpn_port> proto=tcp
qvm-firewall <qube> del --rule-no 0

After executing script above the result of qvm-firewall <qube> command should looks like:

NO  ACTION  HOST            PROTOCOL  PORT(S)  SPECIAL TARGET  ICMP TYPE  EXPIRE  COMMENT
0   accept  10.137.0.33/32  tcp       4500     -               -          -       -

This method guarantees no leaks for you setup

1 Like
3

Traffic from netvm before the VPN (= closer to sys-net in the chain) won’t be covered by the VPN, and they do some network operations for themselves like checking for updates for the linux distribution it’s running + checking updates on Qubes OS repository.

In addition, you need to configure updates to be done through the vpn qube, otherwise it’s using sys-firewall or sys-net.

2 Likes
4

So, simply do this:

and afterwards this

qubes-prefs updatevm <my-vpn-qube>
qubes-prefs clockvm <my-vpn-qube>

correct?

1 Like
5

If you want to be 100% sure that no traffic bypasses the VPN… run the VPN tunnel upstream, outside Qubes. Maybe use a Raspberry Pi and run PiHole there too, for good measure. Then you use the Pi as a router and protect your whole network.
Just saying.

4 Likes
6

I would like to log this as Option B:
Preferably for stationary use. Secure, simple but you have to setup and carry a PI (and power supply) with you.

Back to option A: five-liner in dom0

qvm-firewall <vpn-qube> reset
qvm-firewall <vpn-qube> add accept <vpn_ip> dstports=<vpn_port> proto=tcp
qvm-firewall <vpn-qube> del --rule-no 0
qubes-prefs updatevm <vpn-qube>
qubes-prefs clockvm <vpn-qube>

Anything missing?

2 Likes
7

If you are concerned about update checks (all qubes check for updates by default), run the following on the qubes running outside the VPN chain:

qvm-service <qube> qubes-update-check off
4 Likes
8

opnsense or pfsense firewall on a cheap PC between your router and PC, it is near impossible to prevent qubes from leaking

2 Likes
9

A number of routers permit the installation of VPN(s), so some to all of the attached devices can be directed through those desired.

1 Like
10

Can someone illuminate using, Tor “pluggable transport” in this context.

1 Like
11

which context?

“pluggable transport” are protocols to get into Tor when you are blocked. It is not recommended to use pluggable transports when you do not need to.

4 Likes
12

Tor pluggable transports are used for circumventing censorship to access the Tor network, so they are not relevant regarding network traffic leaks in this topic.

3 Likes