Sys-whonix (whonix gateway) as netvm for FirewallVM won't provide internet connection

User Support
1

My firewallvm which has sys-whonix (whonix gateway) as its netvm, any appvm that connect to firewallvm will not get internet connection but sys-whonix to appvm works.

My setup is like this;

A. Appvm won’t get internet connection with this arrangement
netvm (sys-net) -> firewallvm1 (sys-fw) -> sys-whonix -> firewallvm2 (sys-fw) -> appvm (whonix)

B. Appvm gets internet with this connection
netvm (sys-net) -> firewallvm1 (sys-fw) -> sys-whonix -> appvm (whonix)

So my problem is with A.
Is it possible to get internet with A or not?
If A is possible, please recommend a firewall rule to strictly enforce all traffic through the firewallvm1 & 2 to destination appvm.

NB: I haven’t setup any firewall rule. Just with default settings after creating firewallvm base on minimal template.

2

Does the problem persist if firewallvm2 is based on a standard template (not minimal)? If so, you might need to install qubes-core-agent-networking in the minimal template used by firewallvm2.

3

By default a whonix-ws based qube requires netvm to be an instance of whonix-gw. I understand the main reason is stream isolation, but I am not sure. Your question was asked and answered in multiple forms already in the Whonix forums I’d recommend discussing it there.

1 Like
4

I installed everything needed for a firewallvm from here here.
Not a minimal template issues but whonix_gw related.

5

Thank you.
Conclusion: it’s very difficult to setup or not possible at the moment.