Wireguard VPN setup (4.2 and 4.3)

[solene]

@Mirai

I tried to set this rule in vpn-qube-2:

This looks good but are you sure you need both udp and tcp? This doesn’t matter much for your issue though.

@Mirai

But I though this should not even be necessary and just be tunneled via the normal udp port

It is required because the default rules are to block all incoming traffic on all interfaces, this also applies to “new” interfaces created by VPN and not just eth0 and vifX.Y interfaces managed by Qubes OS.

@Mirai

I want to run a service in vpn-qube-2 that should be reachable by the public VPN address and the port. (Like mullvad port forwarding)

When trying to connect, are you doing it from the remote VPN peer or the public IP address? You need to setup a port redirection on the VPN server to redirect traffic from the public IP address / port to the qube on its VPN IP.

[Mirai]

@solene

This looks good but are you sure you need both udp and tcp? This doesn’t matter much for your issue though.

Are you sure that those rules are enough, just took them from you nat script.

@solene

When trying to connect, are you doing it from the remote VPN peer or the public IP address? You need to setup a port redirection on the VPN server to redirect traffic from the public IP address / port to the qube on its VPN IP.

I don’t have cli access to the remote peer, I am using a VPN provider.

I am trying to access the port from a completely different VPN server

[solene]

@Mirai

I don’t have cli access to the remote peer, I am using a VPN provider.

VPN providers do not offer port forwarding in most cases, and when they do like Proton VPN, they only redirect a single random port using a slightly complicated method.

@Mirai

Are you sure that those rules are enough, just took them from you nat script.

Yes, you just need to open the port locally.

Could you share a bit more information, in private if needed?

[ryrona]

@urxvtw

I would like to ask you, (since there is no DM option), how did you achieve such mastery?

The mindset: Monitor your own system and do forensic investigation into your own system before someone else does

In my opinion, everyone serious about security and privacy should at least learn how to use Wireshark, and how to recover deleted files.

(sorry for off-topic response)

[Sabine]

Yes, I’ve also been trying for a very long time to set up my Mullvad WireGuard on Fedora 44 Xfce. However, I haven’t been able to do it yet. I don’t know where I’m going wrong either.

It surprises me that there isn’t any ready-made software out there that you just have to install and then enter a few settings into.

If something like that doesn’t exist, a photo tutorial would be exactly what I need—a step-by-step guide specifically for newbies using Qubes for the first time.

[unman]

Yes, I’ve also been trying for a very long time to set up my Mullvad WireGuard on Fedora 44 Xfce. However, I haven’t been able to do it yet. I don’t know where I’m going wrong either.
It surprises me that there isn’t any ready-made software out there that you just have to install and then enter a few settings into.
If something like that doesn???t exist, a photo tutorial would be exactly what I need???a step-by-step guide specifically for newbies using Qubes for the first time.

You know that Mullvad provide packages for Fedora to install their tool?

Mullvad VPN for Linux

If that seems complicated, I have a single package to install in dom0 to
create a Mullvad template based on Debian minimal template, and a
sys-mullvad qube.
You can get that from https://qubes.3isec.org/tasks.html

I never presume to speak for the Qubes team.
When I comment in the Forum I speak for myself.

[Sabine]

Thanks. I’ll try to make some progress with your approach.

[Sabine]

@unman

Erstelle eine Mullvad-Vorlage basierend auf der minimalen Debian-Vorlage und eine
sys-mole qube.
Sie können das unter https://qubes.3isec.org/tasks.html abrufen.

Do you have any new information for me?

Because I can’t find what I was looking for on this page.

https://github.com/unman/notes/blob/master/apt-cacher-ng