4 Commits

Author	SHA1	Message	Date
Pawel Marczewski	63d8065e4f	firewall: drop INVALID state TCP packets ... Packets detected as INVALID are ignored by NAT, so if they are not dropped, packets with internal source IPs can leak to the outside network. See: https://bugzilla.netfilter.org/show_bug.cgi?id=693 http://www.smythies.com/~doug/network/iptables_notes/ Fixes QubesOS/qubes-issues#5596.	2020-01-24 19:01:00 +01:00
Pawel Marczewski	cd19073d50	Update rule priorities for anti-spoofing	2020-01-10 09:19:32 +01:00
Pawel Marczewski	bfe31cfec8	qubes-firewall: add anti-spoofing rules for connected machines ... qubes-firewall will now blacklist IP addresses from all connected machines on non-vif* interfaces. This prevents spoofing source or target address on packets going over an upstream link, even if a VM in question is powered off at the moment. Depends on QubesOS/qubes-core-admin#303 which makes admin maintain the list of IPs in qubesdb. Fixes QubesOS/qubes-issues#5540.	2020-01-09 18:25:08 +01:00
Marek Marczykowski-Górecki	715693b93d	network: IPv6-enabled firewall ... If IPv6 is configured in the VM, and it is providing network to others, apply IPv6 firewall similar to the IPv4 one (including NAT for outgoing traffix), instead of blocking everything. Also, enable IP forwarding for IPv6 in such a case. Fixes QubesOS/qubes-issues#718	2017-12-07 01:41:55 +01:00