Qubes/core-agent-linux
1
0
Fork 0
Code Issues Pull Requests Releases Wiki Activity
589c32b1e3
core-agent-linux/network/iptables

34 lines
1022 B
Plaintext
Raw Normal View History

Unify dom0 and netvm sysconfig/iptables Plus: - dedicated chain for DNAT to nameservers - prevent intervm networking. Can be conveniently overriden in necessary cases by inserting ACCEPT clauses (per VM, probably) at the top of FORWARD
2010-09-06 15:10:01 +02:00
# Generated by iptables-save v1.4.5 on Mon Sep 6 08:57:46 2010
*nat
:PREROUTING ACCEPT [85:5912]
:OUTPUT ACCEPT [0:0]
:POSTROUTING ACCEPT [0:0]
:PR-QBS - [0:0]
dom0+vm/iptables: add PR-QBS-SERVICES chain in PREROUTING nat table Additional chain for some qubes-related redirections. BTW PR-QBS should be renamed now to PR-QBS-DNS...
2012-05-31 02:07:01 +02:00
:PR-QBS-SERVICES - [0:0]
Unify dom0 and netvm sysconfig/iptables Plus: - dedicated chain for DNAT to nameservers - prevent intervm networking. Can be conveniently overriden in necessary cases by inserting ACCEPT clauses (per VM, probably) at the top of FORWARD
2010-09-06 15:10:01 +02:00
-A PREROUTING -j PR-QBS
dom0+vm/iptables: add PR-QBS-SERVICES chain in PREROUTING nat table Additional chain for some qubes-related redirections. BTW PR-QBS should be renamed now to PR-QBS-DNS...
2012-05-31 02:07:01 +02:00
-A PREROUTING -j PR-QBS-SERVICES
Unify dom0 and netvm sysconfig/iptables Plus: - dedicated chain for DNAT to nameservers - prevent intervm networking. Can be conveniently overriden in necessary cases by inserting ACCEPT clauses (per VM, probably) at the top of FORWARD
2010-09-06 15:10:01 +02:00
-A POSTROUTING -o vif+ -j ACCEPT
vm/iptables: do not MASQUERADE packets on lo (#416) Masquerading packets on lo actually drops them when there is no default route. This causes problems with commutication between ntpd processes (ntp main daemon and resolver). And perhaps many more...
2012-01-13 20:42:31 +01:00
-A POSTROUTING -o lo -j ACCEPT
Unify dom0 and netvm sysconfig/iptables Plus: - dedicated chain for DNAT to nameservers - prevent intervm networking. Can be conveniently overriden in necessary cases by inserting ACCEPT clauses (per VM, probably) at the top of FORWARD
2010-09-06 15:10:01 +02:00
-A POSTROUTING -j MASQUERADE
COMMIT
# Completed on Mon Sep 6 08:57:46 2010
# Generated by iptables-save v1.4.5 on Mon Sep 6 08:57:46 2010
*filter
:INPUT ACCEPT [168:11399]
:FORWARD ACCEPT [0:0]
:OUTPUT ACCEPT [128:12536]
network: rewrite qubes-firewall daemon This rewrite is mainly to adopt new interface for Qubes 4.x. Main changes: - change language from bash to python, introduce qubesagent python package - support both nftables (preferred) and iptables - new interface (https://qubes-os.org/doc/vm-interface/) - IPv6 support - unit tests included - nftables version support running along with other firewall loaded Fixes QubesOS/qubes-issues#1815 QubesOS/qubes-issues#718
2016-09-12 05:22:53 +02:00
:QBS-FORWARD - [0:0]
Unify dom0 and netvm sysconfig/iptables Plus: - dedicated chain for DNAT to nameservers - prevent intervm networking. Can be conveniently overriden in necessary cases by inserting ACCEPT clauses (per VM, probably) at the top of FORWARD
2010-09-06 15:10:01 +02:00
-A INPUT -i vif+ -p udp -m udp --dport 68 -j DROP
firewall: replace deprecated "state" iptables module with "conntrack"
2014-03-28 02:56:43 +01:00
-A INPUT -m conntrack --ctstate RELATED,ESTABLISHED -j ACCEPT
network: use more strict policy about incoming traffic Do not allow ICMP from uplink VM (or the outside world). Also do not send ICMP icmp-host-prohibited to the uplink. Fixes QubesOS/qubes-issues#1346
2015-12-30 02:09:23 +01:00
-A INPUT -i vif+ -p icmp -j ACCEPT
Unify dom0 and netvm sysconfig/iptables Plus: - dedicated chain for DNAT to nameservers - prevent intervm networking. Can be conveniently overriden in necessary cases by inserting ACCEPT clauses (per VM, probably) at the top of FORWARD
2010-09-06 15:10:01 +02:00
-A INPUT -i lo -j ACCEPT
network: use more strict policy about incoming traffic Do not allow ICMP from uplink VM (or the outside world). Also do not send ICMP icmp-host-prohibited to the uplink. Fixes QubesOS/qubes-issues#1346
2015-12-30 02:09:23 +01:00
-A INPUT -i vif+ -j REJECT --reject-with icmp-host-prohibited
-A INPUT -j DROP
firewall: replace deprecated "state" iptables module with "conntrack"
2014-03-28 02:56:43 +01:00
-A FORWARD -m conntrack --ctstate RELATED,ESTABLISHED -j ACCEPT
network: rewrite qubes-firewall daemon This rewrite is mainly to adopt new interface for Qubes 4.x. Main changes: - change language from bash to python, introduce qubesagent python package - support both nftables (preferred) and iptables - new interface (https://qubes-os.org/doc/vm-interface/) - IPv6 support - unit tests included - nftables version support running along with other firewall loaded Fixes QubesOS/qubes-issues#1815 QubesOS/qubes-issues#718
2016-09-12 05:22:53 +02:00
-A FORWARD -j QBS-FORWARD
Unify dom0 and netvm sysconfig/iptables Plus: - dedicated chain for DNAT to nameservers - prevent intervm networking. Can be conveniently overriden in necessary cases by inserting ACCEPT clauses (per VM, probably) at the top of FORWARD
2010-09-06 15:10:01 +02:00
-A FORWARD -i vif+ -o vif+ -j DROP
-A FORWARD -i vif+ -j ACCEPT
-A FORWARD -j DROP
COMMIT
# Completed on Mon Sep 6 08:57:46 2010
Reference in New Issue Copy Permalink