tcp/udp server on qubes

[idan...@gmail.com]

I'm trying to build a server that uses tcp protocol, and I'm having trouble figuring the firewall rules that I need to set in order to connect the server so it would be able to communicate with a specific client through the internet.

I'm aware that there is the guide for networking and firewall:
https://www.qubes-os.org/doc/firewall/

but unfortunately I cant infer it to my use case.

[idan...@gmail.com]

just to be clear I'm using Qubes R3.2

[awokd]

Not sure what you mean- Qubes doesn't need any special rules to
communicate out. If you want to restrict inbound communications to the
single source IP of your client, follow the guide and use that IP in the
rule. I think there's an example like that in there.

[idan...@gmail.com]

allow me to elaborate
i am trying to route all incoming traffic to a single vm
there is an example that supposedly does just that
however i have zero experience in "IP tables" and as such the example, as detailed as it is does not explain to me how to achieve the desired result
with a specific vm and its corresponding ip
for example i have no idea what "MY-HTTPS" is meant to reference

[awokd]

"MY-HTTPS" is a label/name- just type it as is.
Depending on how you are doing your inbound NATing, you may need to
restrict the source IP at your outside firewall/router or in this line of
the sys-net configuration: "iptables -A MY-HTTPS -s 192.168.x.0/24 -j
ACCEPT".

[idan...@gmail.com]

i see, thanks to you i think i understand
but i seem to be having at the very first step
after adding both rules in the sys-net terminal
i still dont see the connection attempt from an external pc
on the rule for the for the prerouting i used CIDR netmask to allow
all possible values for the third-forth part of the sys-net's ip

worth noting that i can connect from the appvm to the net
but not vice versa using the telnet commend

thank you in advance.

[awokd]

On Thu, March 15, 2018 1:19 pm, idan...@gmail.com wrote:

> i see, thanks to you i think i understand but i seem to be having at the
> very first step after adding both rules in the sys-net terminal i still
> dont see the connection attempt from an external pc on the rule for the
> for the prerouting i used CIDR netmask to allow all possible values for
> the third-forth part of the sys-net's ip

Test connecting to Qubes from another computer on the same network as your
host before trying to get the remote one working.