I would like to experiment with NAT punching software such as pwnat on qubes. I am still learning how networking works in qubes, so I would like to know if there is a way to do this safely, without breaking qubes or engaging in bad security practices, or if I should do this with qemu on a non-qubes machine.
I am no good with NAT punching, but it shouldn’t. Firewall has no persistency, sys-net and sys-whonix have limited persistency by default. Even if you break stuff, there are snapshots for you to revert to and salt states to create new networking qubes just in case. You can make your sys-net disposable too if you want.
Qubes is pretty resilient: you can experiment and break stuff with no consequences (if you’re smart enough to not reboot a broken persistent domain multiple times in a row). And if you invest some effort into making salt formulas for your custom infrastructure, you can do whatever you want with it and redeploy it as many times as you need to. Backup your data.
I’m not sure what your security concerns are. If you’re simulating traversal, doesn’t it mean you are free to isolate the environment for it?
Thank you for your reply! Yes, I am trying to create an environment for it now, but to start I would like to only setup ip forwarding between the two appvms. I set up a proxy vm, and set ip forwarding rules for vif+, but I still cannot ping between the two windows VMs I am testing.