Qubes/core-agent-linux
1
0
Fork 0
Code Issues Pull Requests Releases Wiki Activity
44f8cceb38
core-agent-linux/network/iptables

34 lines
1002 B
Plaintext
Raw Normal View History

Unify dom0 and netvm sysconfig/iptables Plus: - dedicated chain for DNAT to nameservers - prevent intervm networking. Can be conveniently overriden in necessary cases by inserting ACCEPT clauses (per VM, probably) at the top of FORWARD
2010-09-06 15:10:01 +02:00
# Generated by iptables-save v1.4.5 on Mon Sep 6 08:57:46 2010
*nat
network: have safe fallback in case of qubes-firewall crash/error When qubes-firewall service is started, modify firewall to have "DROP" policy, so if something goes wrong, no data got leaked. But keep default action "ACCEPT" in case of legitimate service stop, or not starting it at all - because one may choose to not use this service at all. Achieve this by adding "DROP" rule at the end of QBS-FIREWALL chain and keep it there while qubes-firewall service is running. Fixes QubesOS/qubes-issues#3269
2017-11-18 01:45:19 +01:00
:PREROUTING ACCEPT [0:0]
Unify dom0 and netvm sysconfig/iptables Plus: - dedicated chain for DNAT to nameservers - prevent intervm networking. Can be conveniently overriden in necessary cases by inserting ACCEPT clauses (per VM, probably) at the top of FORWARD
2010-09-06 15:10:01 +02:00
:OUTPUT ACCEPT [0:0]
:POSTROUTING ACCEPT [0:0]
:PR-QBS - [0:0]
dom0+vm/iptables: add PR-QBS-SERVICES chain in PREROUTING nat table Additional chain for some qubes-related redirections. BTW PR-QBS should be renamed now to PR-QBS-DNS...
2012-05-31 02:07:01 +02:00
:PR-QBS-SERVICES - [0:0]
Unify dom0 and netvm sysconfig/iptables Plus: - dedicated chain for DNAT to nameservers - prevent intervm networking. Can be conveniently overriden in necessary cases by inserting ACCEPT clauses (per VM, probably) at the top of FORWARD
2010-09-06 15:10:01 +02:00
-A PREROUTING -j PR-QBS
dom0+vm/iptables: add PR-QBS-SERVICES chain in PREROUTING nat table Additional chain for some qubes-related redirections. BTW PR-QBS should be renamed now to PR-QBS-DNS...
2012-05-31 02:07:01 +02:00
-A PREROUTING -j PR-QBS-SERVICES
Unify dom0 and netvm sysconfig/iptables Plus: - dedicated chain for DNAT to nameservers - prevent intervm networking. Can be conveniently overriden in necessary cases by inserting ACCEPT clauses (per VM, probably) at the top of FORWARD
2010-09-06 15:10:01 +02:00
-A POSTROUTING -o vif+ -j ACCEPT
vm/iptables: do not MASQUERADE packets on lo (#416) Masquerading packets on lo actually drops them when there is no default route. This causes problems with commutication between ntpd processes (ntp main daemon and resolver). And perhaps many more...
2012-01-13 20:42:31 +01:00
-A POSTROUTING -o lo -j ACCEPT
Unify dom0 and netvm sysconfig/iptables Plus: - dedicated chain for DNAT to nameservers - prevent intervm networking. Can be conveniently overriden in necessary cases by inserting ACCEPT clauses (per VM, probably) at the top of FORWARD
2010-09-06 15:10:01 +02:00
-A POSTROUTING -j MASQUERADE
COMMIT
# Completed on Mon Sep 6 08:57:46 2010
# Generated by iptables-save v1.4.5 on Mon Sep 6 08:57:46 2010
*filter
network: have safe fallback in case of qubes-firewall crash/error When qubes-firewall service is started, modify firewall to have "DROP" policy, so if something goes wrong, no data got leaked. But keep default action "ACCEPT" in case of legitimate service stop, or not starting it at all - because one may choose to not use this service at all. Achieve this by adding "DROP" rule at the end of QBS-FIREWALL chain and keep it there while qubes-firewall service is running. Fixes QubesOS/qubes-issues#3269
2017-11-18 01:45:19 +01:00
:INPUT DROP [0:0]
:FORWARD DROP [0:0]
:OUTPUT ACCEPT [0:0]
network: rewrite qubes-firewall daemon This rewrite is mainly to adopt new interface for Qubes 4.x. Main changes: - change language from bash to python, introduce qubesagent python package - support both nftables (preferred) and iptables - new interface (https://qubes-os.org/doc/vm-interface/) - IPv6 support - unit tests included - nftables version support running along with other firewall loaded Fixes QubesOS/qubes-issues#1815 QubesOS/qubes-issues#718
2016-09-12 05:22:53 +02:00
:QBS-FORWARD - [0:0]
Unify dom0 and netvm sysconfig/iptables Plus: - dedicated chain for DNAT to nameservers - prevent intervm networking. Can be conveniently overriden in necessary cases by inserting ACCEPT clauses (per VM, probably) at the top of FORWARD
2010-09-06 15:10:01 +02:00
-A INPUT -i vif+ -p udp -m udp --dport 68 -j DROP
firewall: replace deprecated "state" iptables module with "conntrack"
2014-03-28 02:56:43 +01:00
-A INPUT -m conntrack --ctstate RELATED,ESTABLISHED -j ACCEPT
network: use more strict policy about incoming traffic Do not allow ICMP from uplink VM (or the outside world). Also do not send ICMP icmp-host-prohibited to the uplink. Fixes QubesOS/qubes-issues#1346
2015-12-30 02:09:23 +01:00
-A INPUT -i vif+ -p icmp -j ACCEPT
Unify dom0 and netvm sysconfig/iptables Plus: - dedicated chain for DNAT to nameservers - prevent intervm networking. Can be conveniently overriden in necessary cases by inserting ACCEPT clauses (per VM, probably) at the top of FORWARD
2010-09-06 15:10:01 +02:00
-A INPUT -i lo -j ACCEPT
network: use more strict policy about incoming traffic Do not allow ICMP from uplink VM (or the outside world). Also do not send ICMP icmp-host-prohibited to the uplink. Fixes QubesOS/qubes-issues#1346
2015-12-30 02:09:23 +01:00
-A INPUT -i vif+ -j REJECT --reject-with icmp-host-prohibited
-A INPUT -j DROP
firewall: replace deprecated "state" iptables module with "conntrack"
2014-03-28 02:56:43 +01:00
-A FORWARD -m conntrack --ctstate RELATED,ESTABLISHED -j ACCEPT
network: rewrite qubes-firewall daemon This rewrite is mainly to adopt new interface for Qubes 4.x. Main changes: - change language from bash to python, introduce qubesagent python package - support both nftables (preferred) and iptables - new interface (https://qubes-os.org/doc/vm-interface/) - IPv6 support - unit tests included - nftables version support running along with other firewall loaded Fixes QubesOS/qubes-issues#1815 QubesOS/qubes-issues#718
2016-09-12 05:22:53 +02:00
-A FORWARD -j QBS-FORWARD
Unify dom0 and netvm sysconfig/iptables Plus: - dedicated chain for DNAT to nameservers - prevent intervm networking. Can be conveniently overriden in necessary cases by inserting ACCEPT clauses (per VM, probably) at the top of FORWARD
2010-09-06 15:10:01 +02:00
-A FORWARD -i vif+ -o vif+ -j DROP
-A FORWARD -i vif+ -j ACCEPT
-A FORWARD -j DROP
COMMIT
# Completed on Mon Sep 6 08:57:46 2010
Reference in New Issue Copy Permalink