USB tethering phones in 4.2.0rc5

User Support
1

I have a desktop running Qubes 4.2.0rc5 and I’m trying to figure out how to USB tether phones to it. The machine does not have wifi and I would not use it even if it did, I require a wired solution. I’ve seen discussions about OpenWRT and USB-C to RJ-45 ethernet, these are also not of interest.

I have both an Android and an iPhone that have tethering plans. On Ubuntu+VirtualBox I can simply plug them in, add the new ethernet device that appears as a bridged interface for the VM, and it will get an IP via DHCP when I start it.

I’ve looked at the older support requests but things have changed enough from 4.1 to 4.2 that I’m having a hard time sorting out where things are now located. What I have seen seems to indicate that sys-firewall would need access to USB devices. Is this really something that has to be decided at install time?

The two phones are not interchangeable - I need to make both of them work, each is for a different area of responsibility.

2

For this to work, you must have sys-usb installed on your system. Then all you have to do is connect the phone to sys-net with USB forwarding so that Network Manager can initiate the network connection.

1 Like
3

Is there anywhere guide for this, please? I tried on my own using common sense and what I already knew about Qubes (far from enough, of course and obviously), but eventually didn’t succeed. At the end, my sys-usb took the role of sys-net. I did it without problems with other kind of external USB network devices, though. For example, this.

Step by step guide would be immensely appreciated.

4

I found one here:

It’s a little bit complicated for nothing I think, but it shows the main things to do.
Earlier this year, I was able to tether via USB with an iPhone 14 by simply plugging it in and attaching to sys-net with sys-usb. A new network interface appeared in NetworkManager and I was able to connect like any other system.

5

It’s the same as my previous post? No device, or anything else from sys-usb is “forwarded” to any sys-net? On the contrary: sys-usb took the role of sys-net too.

6

The link I provided is a community guide, it’s not your previous link.

I’m not sure I understand what you mean. If you chose a unified setup at install (sys-net = sys-usb), then this is expected?

7

I pulled the SATA drive out of my Qubes machine so I could try a USB install, someone else asked about this in User Support.

And when I plugged the SATA drive back in … not a bootable system(!)

So I am reinstalling and I set it to include sys-usb in sys-net.

I’m U.S. west coast but I keep really irregular hours, this week I’m in vampire time zone. Sun’s coming up, about time for me to disappear for a few hours. The install will be done adding templates when I return.

1 Like
8

I was confused first. First you mentioned sys-usb. When we have this, phone is connected to sys-usb, right? Then you wrote to connect phone to “sys-net with USB forwarding”. I don’t know what this means when the phone is already connected to sys-usb.

9

I’d do this only if I don’t have ethernet controller too.

Regards from dusk till dawn. :slight_smile:

1 Like
10

What I mean here is that the phone is attached to sys-usb since it has the USB controllers, then you have to “forward” to sys-net using the device widget that Qubes provides. I say sys-net here, but it could be any other qube running with “network-manager” set in services.

1 Like
11

Great. That’s exactly how I understood it the first time I read it. And I tried that and I didn’t succeed it. As I learned so far, no phone can be attached to any other qube then to sys-usb. Knowing that much, I asked you how to achieve working sys-net to which phone is attached to from sys-usb.

1 Like
12

I just grabbed an iPhone to test it, just in case it stopped working.
I was able to tether using it with a separate sys-tether qube with “network-manager” set in services:

  • Create new template based on fedora-38
  • Install usbmuxd in template
  • Create new qube sys-tether, net qube set to none and network-manager set in services
  • Plug iPhone via USB (appear on sys-usb via notification)
  • Go to tether settings on iPhone and enable it
  • Start sys-tether
  • Attach phone from Qubes device widget to sys-tether
  • Trust computer on phone
  • NetworkManager recognize the network adapter and connect (driver: ipheth)

Might be different for Android, I don’t have one to test.

13
1 Like
14

Thanks! I have android and I’m asking myself if there’s an analog to this for android if needed at all, and if that’s the culprit…

15

Nope

16

usbmuxd is only for Apple’s devices.

This might be a good starting point for Android:
https://wiki.archlinux.org/title/Android_tethering
It mentions usb_modeswitch in the “USB Tethering” part.

It works ootb with iPhones then.

17

My systems are HP Z420 workstations, so one built in ethernet. I have a couple USB ethernet dongles for various purposes, a number of wifi USB devices, and I periodically try to get networking using bluetooth adapters working … for reasons.

The need to have a USB attached phone that a VM can pull an IP via DHCP and use the phone as its network is a specific use case. Part of what I do includes “ride along” duties. I get a burner phone, a Google Voice number, a Signal account for it, perhaps some social media accounts, then I embed with a group I’m advising. The carrier number only shows up in creating Signal and perhaps the social media registrations.

The burner never has any access to anything that can be attributed to me, it doesn’t get on wifi, its number is never shared with anyone, and the Signal number I known only to those who need it. This is a specific remedy for frivolous litigation and malicious prosecution, which are big problems in the U.S. This construct would not stand up to a full throttle national security FISA 702 warrant investigation, but I am aware of the rules and I avoid those situations.

When I started doing this I had an elderly Toshiba laptop, 2.5KG with a 1366x768 display, a really floppy hinge, and I’d physically swap small SATA drives. I recently spent some time creating VirtualBox VMs for this work. Now I want to shift my desktop to full time Qubes without losing that capability.

There is something to be said for sitting somewhere other than one’s desk using nothing but a single isolated operating environment, it’s a way to “get in character”. My use cases these days are limited to groups that knowingly lean on me for support, so this is much less of an issue. Once the workstation solution behaves, I’ll do the same with a Xeon laptop, then I can go on the road if that’s needed.

An Ubuntu VM with just Authy, Discord, Signal, Telegram, etc would quickly balloon to over 10GB. A Debian Qube when running is about 6GB and when idle they’re under 150 meg. There’s a strong capital incentive in addition to the security angle.

18

I need to know more about the UEFI shell, it’s another gap in my knowledge. In this case the machine wedged, black screen with a single blinking underscore at the upper left.

It’s not the end of the world. That setup was better than the one that came before it. I’m assuming the rest of this month will be me trying things, then maybe full time Qubes use come January.