Saltstack + firewall

User Support General
,
1

Hello,

I am trying to automate qube(s) creation and part of it is to set specific firewalls rules for each VM. I don’t see an option to do this with Saltstack, am I missing something? I am looking at qubes-mgmt-salt-dom0-qvm/README.rst at master · QubesOS/qubes-mgmt-salt-dom0-qvm · GitHub but if there is more complete guide, please let me know.

Regards

2

I don’t think it’s been implemented, there’s a feature request for that:

Your only option would be to run dom0 commands with salt using the qvm-firewall tool.

3

This works for me:

enable-firewall:
  cmd.run:
    - name: |
        printf "action=accept specialtarget=dns
        action=accept proto=icmp
        action=drop" | qubesd-query dom0 admin.vm.firewall.Set {{myqube}}

The firewall rules can be dumped from an existing qube via qvm-firewall --raw myqube list