Trying to understand how Qubes OS uses NAT (networking/netvm)?

User Support
1

Hi, I am currently learning about nft and trying to understand how it is used in combination with Qubes OS. Networking docs contain following sentence:

[…] routed networking is used instead of the default bridging of vif devices and NAT is applied at each network hop.

As I interpret it, Qubes uses Source NAT or IP masquerading in each netVM for security reasons.

More concrete: Some qube A wants to visit domain qubes-os.org. To do so, it first goes through netVM B, like sys-firewall: Then B replaces the packet’s source IP of qube A with its own IP and forwards it either to another netVM or lastly to NIC and inet (inverse for reply).

Now question is: Where is this NAT defined? I tried out by invoking e.g. in sys-firewall:

root@sys-firewall:~# nft list ruleset ip

table ip qubes {
    ...
	
    chain postrouting {
		type nat hook postrouting priority srcnat; policy accept;
		oifgroup 2 accept
		oif "lo" accept
		masquerade
	}
...
}

Does masquerade within postrouting hook provides said SNAT?

If so, I’d imagine basic flow looks like this:

  • Qube A uses its default gateway route to send its request/packet to netVM B.
  • This packet goes through B’s prerouting → forward → postrouting Netfilter kernel hooks.
  • In last postrouting hook, netVM finally performs actual SNAT, replacing the packet source IP.

Assuming above is correct I am also wondering, if NAT matters that much security-wise. If a qube gets corrupted, these firewall rules can’t be taken seriously anymore - incl. masquerade. Or does Qubes OS enforce SNAT in a stricter way - by Xen or some other layer above?

Corrections and answers are welcomed!

2

that’s why there is sys-firewall, it’s a disposable that should always be safe. Qubes are not directly exposed to sys-net.

In a VPN case, it is recommended to add a “sys-firewall-vpn” between the “sys-vpn” qube and qubes, for the same reason.

1 Like
3

Thanks @solene, that makes sense.
To be honest, understanding the general working of nft in combination with Qubes and hooks was even more important to me than optimizing security aspects. From reading your answer, above description seems not too off either - great!

4

Yes.

Yes.

1 Like