Firewall question: DNS queries not working

[Eva Star]

At the AppVM firewall settings set to "allow DNS queries" and ICMP
traffic as well. (other network access set to deny)

I trying to get IP addresses of github.com with "ping" or "getent hosts
github.com", or "dig +short github.com", but it does not resolve IP
addresses of github at VM.

Why? Thanks.

--
Regards

[Unman]

What is the AppVM connected to and are you using Tor upstream?

[Eva Star]

On 04/15/2017 05:13 PM, Unman wrote:
>
>> I trying to get IP addresses of github.com with "ping" or "getent hosts
>> github.com", or "dig +short github.com", but it does not resolve IP
>> addresses of github at VM.
>>
>> Why? Thanks.
>
>

> What is the AppVM connected to and are you using Tor upstream?
>

Connected to ProxyVM with VPN on it. The problem with setup of VPN? When
all access allowed, then all works fine at problemVM.

--
Regards

[Unman]

I'd suggest examining the iptables tables for filter and nat using -L
-nv options and see what's happening. Do this on the ProxyVM and you
should be able to see what's blocking DNS.

Did you set up the proxy by hand, or use Network Manager?

[Chris Laprise]

There is an assumption in the Qubes firewall that DNS will be forwarded
to the same address as the gateway; It doesn't add ACCEPTs in the
forward chain for the DNS addresses in PR-QBS. I believe this is the
related issue:

https://github.com/QubesOS/qubes-issues/issues/1183

A workaround is to add an entry in the firewall dialog such as:
Address: * (or DNS server)
Service: 53
Protocol: UDP

Another can be added for TCP as well.

A more automated workaround would be to use `iptables-save | sed` as in
the issue comments (seems like this could be done from the vpn-handler
script).

--

Chris Laprise, tas...@openmailbox.org
https://twitter.com/ttaskett
PGP: BEE2 20C5 356E 764A 73EB 4AB3 1DC4 D106 F07F 1886