You can use Qubes manager under VM, hit create NEW VM. name it sys-net, make it red color, make it a netvm, and select fedora as the template (or debian if you prefer).
Then you have to add your network controller to it. you can use the lspci command in dom0 to identify your network controller. Then add that device to the sys-net in vm settings, devices section. Then reboot the vm and check network manager.
To make a sys-firewall create another new vm, but instead of netvm, set that one as proxy vm and make sys-firewall its netvm. then done.
Then when you create an appvm you make sys-firewall its default netvm.