This is a unikernel that can run as a QubesOS ProxyVM, replacing sys-firewall. It may be useful if you want something smaller or faster-to-start than the Linux-based sys-firewall. It requires around 64MB of RAM when running and requires "0.0s" of CPU time to boot, according to "xl list". It does not need or use a hard-disk, and does not persist any state between reboots.
For installation instructions, see:
To upgrade from an earlier release, just overwrite /var/lib/qubes/vm-kernels/mirage-firewall/vmlinuz in dom0 with the new version and restart the firewall VM.
This version adapts qubes-mirage-firewall with
- dynamic rulesets via QubesDB (as defined in Qubes 4.0), and
- adds support for DNS hostnames in rules, using the pf-qubes library for parsing.
The DNS client is provided by DNS (>= 4.2.0) which uses a cache for name lookups. Not every packet will lead to a DNS
lookup if DNS rules are in place.
A test unikernel is available in the test subdirectory.
This project was done by @linse and @yomimono in summer 2019, see PR #96.
Additional changes and bugfixes:
Support Mirage 3.7 and mirage-nat 2.0.0 (@hannesm, #89).
The main improvement is fragmentation and reassembly support.
Use the smaller OCurrent images as the base for building the Docker images (@talex5, #80).
- Before: 1 GB (ocaml/opam2:debian-10-ocaml-4.08)
- Now: 309 MB (ocurrent/opam:alpine-3.10-ocaml-4.08)
Lwt.catch (@hannesm, #90).
Add note that AppVM used to build from source may need a private image larger than the default 2048MB (@marmot1791,
README: create the symlink-redirected docker dir (@xaki23, #75). Otherwise, installing the docker package removes t
he dangling symlink.
Note that mirage-firewall cannot be used as UpdateVM (@talex5, #68).
Fix ln(1) call in build instructions (@jaseg, #69). The arguments were backwards.
Keeping up with upstream changes:
Support mirage-3.7 via qubes-builder (@xaki23, #91).
Clock argument to
Uplink (@talex5, #90).
Rename things for newer mirage-xen versions (@xaki23, #80).
Adjust to ipaddr-4.0.0 renaming
_octets (@xaki23, #75).
Use OCaml 4.08.0 for qubes-builder builds (was 4.07.1) (@xaki23, #75).
Remove netchannel pin as 1.11.0 is now released (@talex5, #72).
Remove cmdliner pin as 1.0.4 is now released (@talex5, #71).