Qubes/core-agent-linux
1
0
Fork 0
Code Issues Pull Requests Releases Wiki Activity
188ea74993
core-agent-linux/network/ip6tables

19 lines
393 B
Plaintext
Raw Normal View History

vm/iptables: block IPv6 traffic This isn't properly handled by Qubes VMs yet, so block it in all the VMs. Also restrict access to firewall config.
2012-09-25 16:04:47 +02:00
# Generated by ip6tables-save v1.4.14 on Tue Sep 25 16:00:20 2012
Update rule priorities for anti-spoofing
2020-01-10 09:19:32 +01:00
*raw
qubes-firewall: add anti-spoofing rules for connected machines qubes-firewall will now blacklist IP addresses from all connected machines on non-vif* interfaces. This prevents spoofing source or target address on packets going over an upstream link, even if a VM in question is powered off at the moment. Depends on QubesOS/qubes-core-admin#303 which makes admin maintain the list of IPs in qubesdb. Fixes QubesOS/qubes-issues#5540.
2020-01-09 18:20:05 +01:00
:QBS-PREROUTING - [0:0]
-A PREROUTING -j QBS-PREROUTING
Update rule priorities for anti-spoofing
2020-01-10 09:19:32 +01:00
COMMIT
*mangle
:QBS-POSTROUTING - [0:0
qubes-firewall: add anti-spoofing rules for connected machines qubes-firewall will now blacklist IP addresses from all connected machines on non-vif* interfaces. This prevents spoofing source or target address on packets going over an upstream link, even if a VM in question is powered off at the moment. Depends on QubesOS/qubes-core-admin#303 which makes admin maintain the list of IPs in qubesdb. Fixes QubesOS/qubes-issues#5540.
2020-01-09 18:20:05 +01:00
-A POSTROUTING -j QBS-POSTROUTING
COMMIT
vm/iptables: block IPv6 traffic This isn't properly handled by Qubes VMs yet, so block it in all the VMs. Also restrict access to firewall config.
2012-09-25 16:04:47 +02:00
*filter
network: have safe fallback in case of qubes-firewall crash/error When qubes-firewall service is started, modify firewall to have "DROP" policy, so if something goes wrong, no data got leaked. But keep default action "ACCEPT" in case of legitimate service stop, or not starting it at all - because one may choose to not use this service at all. Achieve this by adding "DROP" rule at the end of QBS-FIREWALL chain and keep it there while qubes-firewall service is running. Fixes QubesOS/qubes-issues#3269
2017-11-18 01:45:19 +01:00
:INPUT DROP [0:0]
vm/iptables: block IPv6 traffic This isn't properly handled by Qubes VMs yet, so block it in all the VMs. Also restrict access to firewall config.
2012-09-25 16:04:47 +02:00
:FORWARD DROP [0:0]
:OUTPUT ACCEPT [0:0]
network: rewrite qubes-firewall daemon This rewrite is mainly to adopt new interface for Qubes 4.x. Main changes: - change language from bash to python, introduce qubesagent python package - support both nftables (preferred) and iptables - new interface (https://qubes-os.org/doc/vm-interface/) - IPv6 support - unit tests included - nftables version support running along with other firewall loaded Fixes QubesOS/qubes-issues#1815 QubesOS/qubes-issues#718
2016-09-12 05:22:53 +02:00
:QBS-FORWARD - [0:0]
vm/iptables: block IPv6 traffic This isn't properly handled by Qubes VMs yet, so block it in all the VMs. Also restrict access to firewall config.
2012-09-25 16:04:47 +02:00
-A INPUT -i lo -j ACCEPT
network: rewrite qubes-firewall daemon This rewrite is mainly to adopt new interface for Qubes 4.x. Main changes: - change language from bash to python, introduce qubesagent python package - support both nftables (preferred) and iptables - new interface (https://qubes-os.org/doc/vm-interface/) - IPv6 support - unit tests included - nftables version support running along with other firewall loaded Fixes QubesOS/qubes-issues#1815 QubesOS/qubes-issues#718
2016-09-12 05:22:53 +02:00
-A FORWARD -j QBS-FORWARD
vm/iptables: block IPv6 traffic This isn't properly handled by Qubes VMs yet, so block it in all the VMs. Also restrict access to firewall config.
2012-09-25 16:04:47 +02:00
COMMIT
# Completed on Tue Sep 25 16:00:20 2012
Reference in New Issue Copy Permalink