Update firewall.md documentation #605
Conversation
address issues related to the combined use of iptables and nftables as well as fix various typos and unclear parts.
security/firewall.md
Outdated
|
|
||
| > Note: On Qubes R4, nftables is also used which imply that nft rules also need to be set. Qubes OS has defined a `qubes-firewall` table with a forward chain. | ||
|
|
||
| `nft add rule ip qubes-firewall forward meta iifname eth0 ip daddr 10.137.0.x tcp dport 443 ct state new counter accept` |
There was a problem hiding this comment.
Hmm, qubes-firewall service (by design) should only take care about traffic outgoing from a VM, not incoming. So, I'd consider the need for this line a bug. Let me fix it right now. And then replace this line with reference for appropriate package version.
There was a problem hiding this comment.
@marmarek, I suspect you're very busy. This line is to document this exact use case (expose service in AppVM and open flow inbound through sys-net then sys-firewall) The sub-section title is something like expose a service to the outside world. I took care to lock it as much as possible at every stage.
There was a problem hiding this comment.
The line as it is looks ok until the bug is resolved. Please add this ticket reference: QubesOS/qubes-issues#3644
|
@marmarek (mentioning you so you get an event in your queue)... also I’m not sure I still learn github workflow.... |
address issues related to the combined use of iptables and nftables as well as fix various typos and unclear parts.