Qubes/core-agent-linux
1
0
Fork 0
Code Issues Pull Requests Releases Wiki Activity
master
core-agent-linux/network/iptables

44 lines
1.2 KiB
Plaintext
Raw Permalink Normal View History

Unify dom0 and netvm sysconfig/iptables Plus: - dedicated chain for DNAT to nameservers - prevent intervm networking. Can be conveniently overriden in necessary cases by inserting ACCEPT clauses (per VM, probably) at the top of FORWARD
2010-09-06 15:10:01 +02:00
# Generated by iptables-save v1.4.5 on Mon Sep 6 08:57:46 2010
*nat
network: have safe fallback in case of qubes-firewall crash/error When qubes-firewall service is started, modify firewall to have "DROP" policy, so if something goes wrong, no data got leaked. But keep default action "ACCEPT" in case of legitimate service stop, or not starting it at all - because one may choose to not use this service at all. Achieve this by adding "DROP" rule at the end of QBS-FIREWALL chain and keep it there while qubes-firewall service is running. Fixes QubesOS/qubes-issues#3269
2017-11-18 01:45:19 +01:00
:PREROUTING ACCEPT [0:0]
Unify dom0 and netvm sysconfig/iptables Plus: - dedicated chain for DNAT to nameservers - prevent intervm networking. Can be conveniently overriden in necessary cases by inserting ACCEPT clauses (per VM, probably) at the top of FORWARD
2010-09-06 15:10:01 +02:00
:OUTPUT ACCEPT [0:0]
:POSTROUTING ACCEPT [0:0]
:PR-QBS - [0:0]
dom0+vm/iptables: add PR-QBS-SERVICES chain in PREROUTING nat table Additional chain for some qubes-related redirections. BTW PR-QBS should be renamed now to PR-QBS-DNS...
2012-05-31 02:07:01 +02:00
:PR-QBS-SERVICES - [0:0]
Unify dom0 and netvm sysconfig/iptables Plus: - dedicated chain for DNAT to nameservers - prevent intervm networking. Can be conveniently overriden in necessary cases by inserting ACCEPT clauses (per VM, probably) at the top of FORWARD
2010-09-06 15:10:01 +02:00
-A PREROUTING -j PR-QBS
dom0+vm/iptables: add PR-QBS-SERVICES chain in PREROUTING nat table Additional chain for some qubes-related redirections. BTW PR-QBS should be renamed now to PR-QBS-DNS...
2012-05-31 02:07:01 +02:00
-A PREROUTING -j PR-QBS-SERVICES
Unify dom0 and netvm sysconfig/iptables Plus: - dedicated chain for DNAT to nameservers - prevent intervm networking. Can be conveniently overriden in necessary cases by inserting ACCEPT clauses (per VM, probably) at the top of FORWARD
2010-09-06 15:10:01 +02:00
-A POSTROUTING -o vif+ -j ACCEPT
vm/iptables: do not MASQUERADE packets on lo (#416) Masquerading packets on lo actually drops them when there is no default route. This causes problems with commutication between ntpd processes (ntp main daemon and resolver). And perhaps many more...
2012-01-13 20:42:31 +01:00
-A POSTROUTING -o lo -j ACCEPT
Unify dom0 and netvm sysconfig/iptables Plus: - dedicated chain for DNAT to nameservers - prevent intervm networking. Can be conveniently overriden in necessary cases by inserting ACCEPT clauses (per VM, probably) at the top of FORWARD
2010-09-06 15:10:01 +02:00
-A POSTROUTING -j MASQUERADE
COMMIT
Update rule priorities for anti-spoofing
2020-01-10 09:19:32 +01:00
*raw
qubes-firewall: add anti-spoofing rules for connected machines qubes-firewall will now blacklist IP addresses from all connected machines on non-vif* interfaces. This prevents spoofing source or target address on packets going over an upstream link, even if a VM in question is powered off at the moment. Depends on QubesOS/qubes-core-admin#303 which makes admin maintain the list of IPs in qubesdb. Fixes QubesOS/qubes-issues#5540.
2020-01-09 18:20:05 +01:00
:QBS-PREROUTING - [0:0]
-A PREROUTING -j QBS-PREROUTING
Update rule priorities for anti-spoofing
2020-01-10 09:19:32 +01:00
COMMIT
*mangle
:QBS-POSTROUTING - [0:0]
qubes-firewall: add anti-spoofing rules for connected machines qubes-firewall will now blacklist IP addresses from all connected machines on non-vif* interfaces. This prevents spoofing source or target address on packets going over an upstream link, even if a VM in question is powered off at the moment. Depends on QubesOS/qubes-core-admin#303 which makes admin maintain the list of IPs in qubesdb. Fixes QubesOS/qubes-issues#5540.
2020-01-09 18:20:05 +01:00
-A POSTROUTING -j QBS-POSTROUTING
COMMIT
Unify dom0 and netvm sysconfig/iptables Plus: - dedicated chain for DNAT to nameservers - prevent intervm networking. Can be conveniently overriden in necessary cases by inserting ACCEPT clauses (per VM, probably) at the top of FORWARD
2010-09-06 15:10:01 +02:00
# Completed on Mon Sep 6 08:57:46 2010
# Generated by iptables-save v1.4.5 on Mon Sep 6 08:57:46 2010
*filter
network: have safe fallback in case of qubes-firewall crash/error When qubes-firewall service is started, modify firewall to have "DROP" policy, so if something goes wrong, no data got leaked. But keep default action "ACCEPT" in case of legitimate service stop, or not starting it at all - because one may choose to not use this service at all. Achieve this by adding "DROP" rule at the end of QBS-FIREWALL chain and keep it there while qubes-firewall service is running. Fixes QubesOS/qubes-issues#3269
2017-11-18 01:45:19 +01:00
:INPUT DROP [0:0]
:FORWARD DROP [0:0]
:OUTPUT ACCEPT [0:0]
network: rewrite qubes-firewall daemon This rewrite is mainly to adopt new interface for Qubes 4.x. Main changes: - change language from bash to python, introduce qubesagent python package - support both nftables (preferred) and iptables - new interface (https://qubes-os.org/doc/vm-interface/) - IPv6 support - unit tests included - nftables version support running along with other firewall loaded Fixes QubesOS/qubes-issues#1815 QubesOS/qubes-issues#718
2016-09-12 05:22:53 +02:00
:QBS-FORWARD - [0:0]
firewall: drop INVALID state TCP packets Packets detected as INVALID are ignored by NAT, so if they are not dropped, packets with internal source IPs can leak to the outside network. See: https://bugzilla.netfilter.org/show_bug.cgi?id=693 http://www.smythies.com/~doug/network/iptables_notes/ Fixes QubesOS/qubes-issues#5596.
2020-01-24 10:02:28 +01:00
-A INPUT -m state --state INVALID -j DROP
Unify dom0 and netvm sysconfig/iptables Plus: - dedicated chain for DNAT to nameservers - prevent intervm networking. Can be conveniently overriden in necessary cases by inserting ACCEPT clauses (per VM, probably) at the top of FORWARD
2010-09-06 15:10:01 +02:00
-A INPUT -i vif+ -p udp -m udp --dport 68 -j DROP
firewall: replace deprecated "state" iptables module with "conntrack"
2014-03-28 02:56:43 +01:00
-A INPUT -m conntrack --ctstate RELATED,ESTABLISHED -j ACCEPT
network: use more strict policy about incoming traffic Do not allow ICMP from uplink VM (or the outside world). Also do not send ICMP icmp-host-prohibited to the uplink. Fixes QubesOS/qubes-issues#1346
2015-12-30 02:09:23 +01:00
-A INPUT -i vif+ -p icmp -j ACCEPT
Unify dom0 and netvm sysconfig/iptables Plus: - dedicated chain for DNAT to nameservers - prevent intervm networking. Can be conveniently overriden in necessary cases by inserting ACCEPT clauses (per VM, probably) at the top of FORWARD
2010-09-06 15:10:01 +02:00
-A INPUT -i lo -j ACCEPT
network: use more strict policy about incoming traffic Do not allow ICMP from uplink VM (or the outside world). Also do not send ICMP icmp-host-prohibited to the uplink. Fixes QubesOS/qubes-issues#1346
2015-12-30 02:09:23 +01:00
-A INPUT -i vif+ -j REJECT --reject-with icmp-host-prohibited
-A INPUT -j DROP
firewall: drop INVALID state TCP packets Packets detected as INVALID are ignored by NAT, so if they are not dropped, packets with internal source IPs can leak to the outside network. See: https://bugzilla.netfilter.org/show_bug.cgi?id=693 http://www.smythies.com/~doug/network/iptables_notes/ Fixes QubesOS/qubes-issues#5596.
2020-01-24 10:02:28 +01:00
-A FORWARD -m state --state INVALID -j DROP
firewall: replace deprecated "state" iptables module with "conntrack"
2014-03-28 02:56:43 +01:00
-A FORWARD -m conntrack --ctstate RELATED,ESTABLISHED -j ACCEPT
network: rewrite qubes-firewall daemon This rewrite is mainly to adopt new interface for Qubes 4.x. Main changes: - change language from bash to python, introduce qubesagent python package - support both nftables (preferred) and iptables - new interface (https://qubes-os.org/doc/vm-interface/) - IPv6 support - unit tests included - nftables version support running along with other firewall loaded Fixes QubesOS/qubes-issues#1815 QubesOS/qubes-issues#718
2016-09-12 05:22:53 +02:00
-A FORWARD -j QBS-FORWARD
Unify dom0 and netvm sysconfig/iptables Plus: - dedicated chain for DNAT to nameservers - prevent intervm networking. Can be conveniently overriden in necessary cases by inserting ACCEPT clauses (per VM, probably) at the top of FORWARD
2010-09-06 15:10:01 +02:00
-A FORWARD -i vif+ -o vif+ -j DROP
-A FORWARD -i vif+ -j ACCEPT
-A FORWARD -j DROP
COMMIT
# Completed on Mon Sep 6 08:57:46 2010
Reference in New Issue Copy Permalink