Can someone please help me troubleshoot a problem.
My thunderbird VM suddenly lost network connectivity, and i am unable to find the root cause.
When i ping the gateway, the packets get filtered. But i don’t understand why.
ping 10.0.0.1
PING 10.0.0.1 (10.0.0.1) 56(84) bytes of data.
From 10.138.1.65 icmp_seq=1 Packet filtered
The firewall settings on the VM are correct. Selecting Allow all temporarily makes no difference.
Where should i poke?
Could you execute qvm-firewall VMNAME in dom0and paste the output here? Also, what does the full VM network path look like from your thunderbird VM?
The full path is VM → firewall → sys-net
qvm-firewall thunderbird
NO ACTION HOST PROTOCOL PORT(S) SPECIAL TARGET ICMP TYPE EXPIRE COMMENT
0 accept - tcp 80 - - - -
1 accept host.come tcp 465 - - - -
2 accept host.come tcp 993 - - - -
3 accept host2.com tcp 465 - - - -
4 accept host2.com tcp 993 - - - -
5 accept host3.com tcp 465 - - - -
6 accept host3.com tcp 993 - - - -
7 accept - - - dns - - -
8 accept - icmp - - - - -
9 drop - - - - - - -
when i look at a dump of nft tables the IP of the VM is in both chain prerouting and chain postrouting. along with all the other VMs; i’m not pointing out an error, simply that it seems to be configured the same as any other VM.
Look at the content of the qubes-firewall table.
I never presume to speak for the Qubes team.
When I comment in the Forum I speak for myself.
Can you be a little bit more specific?
Did you change the qvm-firewall settings, at about the time that it lost network connection?
No, that is the most bizarre thing. Put the system to sleep when i went to bed, next morning no connectivity. Rebooted, removed the network from the VM and re-attached it, cloned the VM, nothing works. It just refuses to connect to the network. I don’t have any special firewalling going on, or any firewall specific configuration for the machine. Even if i did…when i turn the FW off, ie Allow all outgoing connections, ALL of the network packets are still dropped/filtered.
OK. It was only that the lines:
accept host.come tcp
look like they would not get resolved in DNS. I seem to remember it fails closed.
Maybe I’m wrong.
I have restored the VM from backup, and the restored VM works perfectly fine. I would really like to find out what broke and i would appreciate any help.