3.1: qubes-iptables can not be disabled with qvm-service

[qjoo]

Unlike in 3.0/qubes-firewall, 3.1 qubes-iptables does not provide that possibility.

Maybe add the following?

ConditionPathExists=/var/run/qubes-service/qubes-iptables

[marmarek]

This is different than qubes-firewall. qubes-iptables in R3.1 is equivalent to iptables in R3.0. Disabling it will break pretty much every other network-related Qubes functionality (DNAT for DNS, updates proxy, MASQUERADE for normal traffic etc). This is why no qvm-service for that exists.

If you want to disable it anyway and you know what you're doing, you can create systemd dropin /etc/systemd/system/qubes-iptables.service.d/50_disable.conf.

[marmarek]

This is different than qubes-firewall. qubes-iptables in R3.1 is equivalent to iptables in R3.0. Disabling it will break pretty much every other network-related Qubes functionality (DNAT for DNS, updates proxy, MASQUERADE for normal traffic etc). This is why no qvm-service for that exists.

If you want to disable it anyway and you know what you're doing, you can create systemd dropin /etc/systemd/system/qubes-iptables.service.d/50_disable.conf.