Hi, Ive been troubleshooting alot with Taiscale support team and advised I try the forum.
I run I have 3 working standalones running Tailscale and able to ping each other and even route traffic trough as exit nodes.
My issue is using other services with it, trying SSH although looking at the network traffic it reaches the other Qube, it simply just fails and never prompts to insert the credentials. I have confirmed that both servers are running and listening on 0.0.0.0:22 and yes I did set credentials.
Another issue I’m encountering is with Rustdesk(their support doesn’t answer at all) and been troubleshooting with Taiscale team, again to no success. Rustdesk allows for Direct IP would should then enable a successful connection, but looking at the traffic it is still trying to connected with Rustdesk public relay. There are many false claims online and YT videos of people stating success, being they either don’t understand or review that it is working correctly. Another thing I am unsure of doing which might help is be binding tailscale0 to Rustdesk.
If anyone has advice or idea on how resolve the feedback would go a long way!
This I am much aware of, setting the forwarding and input rules for the virtual network did not work.
I have a second firewall vm for these two vms, Ive tried with sys-firewall as the firewall for the vms and still did not work either.
Am I correct to say that adding qubes-firewall service to my second firewall vm should enable it to act like sys-firewall?
Hi,
sudo nft add rule ip qubes custom-forward ip saddr ip daddr ct state new,established,related counter accept
sudo nft add rule qubes custom-input ip saddr ct state new,established,related counter accept
As per docs, even attempted to specify ports as an additional match and didnt work either.
For the forwarding rule added it to my second firewall that handles the two qubes running Tailscale, likewise added the input rule to the machine being connected to.
If you could let me know it “Am I correct to say that adding qubes-firewall service to my second firewall vm should enable it to act like sys-firewall?” this is correct as well.
if tailscale is directly running in the qube where the service is, you only need a custom-input rule with either the source address of the remote peer (with its tailscale address) or allow a port (like port 22/tcp). It’s possible to set both too, it depends what you want to allow.
Yes, this is what was done… I just did a quick list ruleset after adding the cmd and its not added, also looking at cmd provided from docs, it states to use a table that doesn’t exists, so just corrected if to ip qubes and it just doesnt add the rules either.
I prefer just editing the doc and doing that doesnt fix the issue either.
Both qubes are standalone, and all Im testing is a simple connection from the one to the other, no specifics besides the IP.
Can I ask why I would only need the input rule? Which I attempted at the time of my last reply.
As mentioned, the cmd did not add any rules.
Below are the rules I manually edited in /etc/qubes/qubes-ipv4.nft and yes I did use nft -f after editing the files(I replaced tailnet IPs with x for this example):
chain custom-forward {
ip saddr x.x.x.x ip daddr x.x.x.x ct state established,related,new counter packets 0 bytes 0 accept
}
chain custom-input {
ip saddr x.x.x.x ct state established,related,new counter packets 0 bytes 0 accept
}
Yea so Im not sure what the issue is. Each qube is running tailscale, just trying to connect one from the other, this should simply allow all need traffic through the tunnel, from the one qube to the other.(whether being ssh or using rustdesk)
forwarding rules are used when you forward traffic for another system, as your qubes are directly connected to the VPN, there is nothing to forward. If you had a qube “providing network” (being a netvm) to another qube, then you would need a forward rule to pass stuff from the VPN.
Can you ping your qubes through the VPN? First thing to check before going further.