Configuring AppVMs for multiple NICs?

[JW]

I have two physical NICs on my machine. I'd like most AppVMs to only connect to one of the networks, but other VMs to connect to both. Is this possible?

The NICs are attached to different networks (one 192.168.*, the other 10.*)

Thanks for any tips!

-J

[Grzesiek Chodzicki]

Create another sys-net VM (set it as NetVM not AppVM), attach the second NIC to it, then create another sys-firewall set it to use the sys-net2 as its NetVM and then set chosen appVMs to use sys-firewall2 as their NetVM.

[Unman]

That isn't what is wanted, because the wish is to have some qubes using
BOTH interfaces. This set-up simply has two separate routes through two
sys-nets.

There are many different ways to do this: the simplest way would be to have two
separate firewalls attached to one sys-net.
By default, all traffic going though a firewall uses Masquerade, so that
sys-net would only see traffic from 2 IP addresses.
Say the "restricted" firewall has IP address 10.137.100.10. Then you can
add a custom iptables rule on sys-net to restrict traffic from that
address.

There are simple mechanisms to do this:
www.qubes-os.org/doc/firewall is helpful.
On sys-net you can use an entry in /rw/config/rc.local to set up the new
firewall restriction: something like
iptables -I FORWARD -s 10.137.100.10 -j DROP
iptables -I FORWARD -s 10.137.100.10 -j 10.0.0.0/8 -j ACCEPT

The advantage of this method is it's trivial for you to switch qubes
between the permissive and restricted routes, just by changing
firewall.

Note that I've taken you at your word, that you want to connect to those
networks. If you actually want to be able to use gateways on those
networks then you would need to add a rule restricting the
"restricted" traffic to one interface on the sys-net.
That's also straight forward.

Hope this helps

unman

[Unman]

On Thu, Mar 09, 2017 at 03:18:53PM +0000, Unman wrote:
> On Thu, Mar 09, 2017 at 06:13:54AM -0800, Grzesiek Chodzicki wrote:
> > W dniu czwartek, 9 marca 2017 07:04:59 UTC+1 użytkownik JW napisał:
> > > I have two physical NICs on my machine. I'd like most AppVMs to only connect to one of the networks, but other VMs to connect to both. Is this possible?
> > >
> > > The NICs are attached to different networks (one 192.168.*, the other 10.*)
> > >
> > > Thanks for any tips!
> > >
> > > -J
> >
> > Create another sys-net VM (set it as NetVM not AppVM), attach the second NIC to it, then create another sys-firewall set it to use the sys-net2 as its NetVM and then set chosen appVMs to use sys-firewall2 as their NetVM.
> >
>
> That isn't what is wanted, because the wish is to have some qubes using
> BOTH interfaces. This set-up simply has two separate routes through two
> sys-nets.
>
> There are many different ways to do this: the simplest way would be to have two
> separate firewalls attached to one sys-net.
> By default, all traffic going though a firewall uses Masquerade, so that
> sys-net would only see traffic from 2 IP addresses.
> Say the "restricted" firewall has IP address 10.137.100.10. Then you can
> add a custom iptables rule on sys-net to restrict traffic from that
> address.
>
> There are simple mechanisms to do this:
> www.qubes-os.org/doc/firewall is helpful.
> On sys-net you can use an entry in /rw/config/rc.local to set up the new
> firewall restriction: something like
> iptables -I FORWARD -s 10.137.100.10 -j DROP
> iptables -I FORWARD -s 10.137.100.10 -j 10.0.0.0/8 -j ACCEPT

That's a typo:
iptables -I FORWARD -s 10.137.100.10 -d 10.0.0.0/8 -j ACCEPT

[JW]

Thanks unman, this was very helpful!! I'm new to iptables, so perhaps a basic question:

> > There are simple mechanisms to do this:
> > www.qubes-os.org/doc/firewall is helpful.
> > On sys-net you can use an entry in /rw/config/rc.local to set up the new
> > firewall restriction: something like
> > iptables -I FORWARD -s 10.137.100.10 -j DROP

> > iptables -I FORWARD -s 10.137.100.10 -d 10.0.0.0/8 -j ACCEPT

To recap, I'd like my "restricted" firewall (with IP 10.137.100.10) to grant access to a 192.168.1.* network, and not allow any traffic to the second interface on a 10.* network. The "unrestricted" firewall would allow access to both networks. So in my sys-net, why don't I just do the following?

iptables -I FORWARD -s 10.137.100.10 -d 10.0.0.0/8 -j DROP

I ask because the above worked as expected, but when I tried:

iptables -I FORWARD -s 10.137.100.10 -j DROP

iptables -I FORWARD -s 10.137.100.10 -d 192.0.0.0/8 -j ACCEPT

I could ping 192.168.1.1, but I could not browse the web on the restricted firewall.

Thank you,

-J

[Unman]

That's a "recap" that says a good deal more. ;-)
I thnk the specification here has changed.

If you read my first reply I specifically covered this case, where you
wanted to use a gateway on one of the networks, and sugegsted filtering
by interface.

The difference between the two sets of rules you have posted is that the
first only drops traffic to the 10 net, what happens next depends on
what other rules in tthe FORWARD chain may come in to play.

The second set allows traffic to 192 net and then the 1st rule (whioch
appears second because the next instruction INSERTS a rule above it )
drops everything else.
So the traffic to 192 net is explicitly allowed and anything else is
explicitly dropped. That's why you cant access the web.

You can see these rules using 'iptables -L -nv' - remember that the
rules apply in order until a match is found.