Wireguard VPN setup

[etaz]

@Isolator

Works fine with debian-12-minimal based disposable.

This was the last thing I was missing in the guide - gonna try it out later. Thanks @Isolator!

[deeplow]

@Mirai

BTW what are the advantages / disadvantages with a manual setup like this and tasket-vpn-qube?

I do not recommend this one. It is much more cumbersome to setup. Then if you forget to install it again when doing template upgrades, the killswitch won’t be enforced without any warning…

Overall, the setup in this guide is the best of all guides I have tried.

[DVM]

@deeplow

Then if you forget to install it again when doing template upgrades, the killswitch won’t be enforced without any warning…

The correct way to install qubes-vpn-support is inside an AppVM. If the configuration is set up correctly with the appropriate qube service, it will not be possible to reach the outside, even if qubes-vpn-handler ends up in a failed state, because the nftables/iptables rules are set up and only the group 9 interface can forward packets upstream (which doesn’t exist unless the VPN is working).

I agree that this guide is simpler, but I prefer the hardening with interface groups provided by qubes-vpn-support and the fact that I don’t have multiple network managers in my widget bar for all my different vpn qubes.

[etaz]

To configure killswitch + (DNS) leak protection + ICMP/ping blocking + protection in case of sys-vpn compromise, you can alternatively execute a three-liner in dom0, no nft/iptables needed:

qvm-firewall sys-vpn reset # (1)
qvm-firewall sys-vpn add accept dsthost=1.2.3.4 # (2)
qvm-firewall sys-vpn del --rule-no 0 # (3)

(1) resets firewall to one single rule accepting everything
(2) whitelists specific VPN gateway IP
(3) removes rule (1), so there is just one whitelisted IP from (2) left

Everything else is blocked safely outside sys-vpn.

[solene]

this is already explained in the guide by using the firewall GUI

Wireguard VPN setup

Good news, with fedora-38 the network manager supports Wireguard out of the box! The only thing required are extra firewall rules in the VPN qube, as explained in the community documentation about VPN. What you’ll need This guide assumes you are using a VPN service that has wireguard support, most of them do, but you can also add your own if you have a server. ProtonVPN has a free plan, it has limits but gives you a fully working VPN and they support WireGuard. This pro…

[etaz]

Not quite I think . Using the firewall GUI as described in your guide, Qubes still allows any ICMP or DNS requests outside VPN. If you don’t do further hardening via iptables/nft, this might end up with DNS or ping leaks. The only way to block DNS/ICMP with Qubes’ firewall is to use qvm-firewall CLI and remove wildcard rule for everything (accept) and dns special target + icmp, if exists. Above is a reproducible way to catch all cases consistently by first resetting firewall and then applying whitelist rules.

You can recheck with qvm-firewall sys-vpn list. End result should look similar to

NO  ACTION  HOST              PROTOCOL  PORT(S)  SPECIAL TARGET  ICMP TYPE  EXPIRE  COMMENT
0   accept  1.2.3.4/32        -         -        -               -          -       -

[solene]

indeed! I’ll add this to the guide

[whoami]

Now, the guide looks a bit unclear to me. Maybe it is better to explicitly mark it as a ‘VPN hardening’ chapter with two subchapters

A1: ‘3-liner quick hardening’ and
A2: ‘Hardening with nft’

If not, it is not clear (for newbies) that one harding is enough.

[solene]

That’s indeed confusing…

But they do different things I’ll think about how to rework this part.

[solene]

I added a snippet of code to pick a random VPN at the qube start

Direct link Wireguard VPN setup

[Clodius]

this seems kind of ridiculous, I would change to another vpn provider, where its quick and easey, don’t need taskets setup , starts with a M

[deeplow]

@Clodius you above comment is a bit enigmatic. What is ridiculous. With an M? What’s quick an easy in other providers? I don’t get it…

[Clodius]

WireGuard on Qubes OS

in the past I used the tasket way, it was fine, but seems things have changed for a basic setup, just works

[greenweb]

Hi! I have successfully used wg cube customized according to the guide in cube 4.1. Now I have upgraded to os 4.2 and faced a problem.
My setup:
internet<sys-net<sys-firewall<vpn1-vless<vpn1-firewall<vpn2-wg<vpn2-firewall
In the sys-firewall/vpn1-vless cubes, ping service/dns works fine.

vpn2-wg is powered by fedora 38. From settings only imported wg configuration, dns/firewall unchanged.
In vpn2-wg inside the cube ping/dns work. I can open the site.
Next I try to add firewall cube, but inside this cube ping and dns are not working.
What could be the problem?

Screen qubes network

[whoami]

This is most probably due to the change of iptables to nftables (in Qubes OS 4.2). Follow the link(s) here for more info:

Qubes OS 4.2.0 release notes

In the guide above you see the vpn nftable configuration or my preferred solution without nftables just use the Qubes firewall settings in the terminal: Wireguard VPN setup

Wireguard VPN setup

Not quite I think . Using the firewall GUI as described in your guide, Qubes still allows any ICMP or DNS requests outside VPN. If you don’t do further hardening via iptables/nft, this might end up with DNS or ping leaks. The only way to block DNS/ICMP with Qubes’ firewall is to use qvm-firewall CLI and remove wildcard rule for everything (accept) and dns special target + icmp, if exists. Above is a reproducible way to catch all cases consistently by first resetting firewall and then appl…

[solene]

@greenweb

I have upgraded to os 4.2

did you upgrade all your templates?

[greenweb]

I did a clean install of the OS. After that I updated all templates to the actual version.
All cubes are created from scratch.

[jagnopurka]

Just curious, in Qubes case, what are the advantages of using Wireguard instead of OpenVPN?

[jagnopurka]

@solene

Make sure no VPN are configured for automatic connection at startup, there is a check box in the first tab of the VPN settings for that, it defaults to automatic connection.

You can automate this with this one-liner:

for con in $(nmcli -g name,type con | grep :wireguard$ | cut -d: -f1); do nmcli con modify "$con" connection.autoconnect no; done

[solene]

WireGuard is faster (more efficient and can sustain higher speed) than OpenVPN and is stateless.

The stateless feature is important for some users, this implies there are no “connected” tunnel state, data pass through the VPN but if you switch from wifi to 4G for instance, there is no need to stop / restart the service because the remote endpoint doesn’t keep track of the previous session with the previous IP. In case of suspend / resume, there is no such thing as reconnecting too.