VPN NetVM: No Internet in Downstream Qubes (Amnezia VPN, WireGuard-based)

[red_alert]

I think these issues are related:

Why QubesOS need some control over OpenVPN set ups? while other VPNs can work from the box? what is the sense of it?

Hi, to my understanding, 10.139.1.* are used by Qubes to forward dns requests to the last netvm, and this VM use its own dns configuration (resolv.conf) to resolve the DNS request. It should work with mirage-fw as well as with sys-firewall (at least on my laptop), I’ve managed to get sys-net using a mirage-dns unikernel to resolve the request and forward back to the original AppVM. I never used openvpn, but I have the following configuration : sys-net ← mirage-fw ← sys-vpn ← AppVM with both op…

Last reply:

Instead of manually configuring the DNS in the qube, you should alter
the nftables rules in the netvm.
By default the rules are in the nat table in the PR-QBS chain:

	chain PR-QBS {
		meta l4proto udp ip daddr 10.139.1.1 udp dport 53 counter packets 0 bytes 0 dnat to 10.139.1.1
		meta l4proto tcp ip daddr 10.139.1.1 tcp dport 53 counter packets 0 bytes 0 dnat to 10.139.1.1
		meta l4proto udp ip daddr 10.139.1.2 udp dport 53 counter packets 0 bytes 0 dnat to 10.139.1.2
		meta l4proto tcp ip daddr 10.139.1.2 tcp dport 53 counter packets 0 bytes 0 dnat to 10.139.1.2
	}

But I don’t see the PR-QBS table in the output of the nft list ruleset command, only a similar table dnat-dns…

I will be glad of any help. In my country, amnezia vpn is the only way to bypass blocking.