Updates proxy fails to set iptables rules in ProxyVM

[marmarek]

When updates proxy is started, it inserts two iptables rules:

1. In nat table (redirect traffic directed to 10.137.255.254:8082 to the local process)
2. In filter table to actually allow that traffic (INPUT chain)

The second one is overwritten by qubes-firewall service (running only in ProxyVM). qubes-firewall recreates all the filter table at each reload (basically when some VM is connected or disconnected from it). This means that updates proxy is pretty useless in ProxyVM.

Thanks @hdevalence for the report.

[rustybird]

There's a workaround for this in https://github.com/rustybird/qubes-updates-cache/blob/master/usr/lib/qubes/updates-cache-iptables that is kind of weird, but maybe good enough until the 4.0 firewall stuff is ready.

The file (with lines 11 and 22 changed) could be copied over to https://github.com/QubesOS/qubes-core-agent-linux/blob/master/network/iptables-updates-proxy because both commands use the same iptables rules and take the same "start"/"stop" arguments.

[rustybird]

There's a workaround for this in https://github.com/rustybird/qubes-updates-cache/blob/master/usr/lib/qubes/updates-cache-iptables that is kind of weird, but maybe good enough until the 4.0 firewall stuff is ready.

The file (with lines 11 and 22 changed) could be copied over to https://github.com/QubesOS/qubes-core-agent-linux/blob/master/network/iptables-updates-proxy because both commands use the same iptables rules and take the same "start"/"stop" arguments.

[tasket]

Referencing the updates doc, the proxyVM I created to handle updates in front of my VPN VM doesn't work. Its as if the proxy service only works correctly in netVMs.

So I guess a fix didn't make it into the release and that section of the doc isn't valid?

[tasket]

Referencing the updates doc, the proxyVM I created to handle updates in front of my VPN VM doesn't work. Its as if the proxy service only works correctly in netVMs.

So I guess a fix didn't make it into the release and that section of the doc isn't valid?