qubes_firewall_user_script is not executed at boot

[lorenzog]

Qubes OS version (e.g., R3.1):

3.1

Affected TemplateVMs (e.g., fedora-23, if applicable):

fedora-23
debian-8

---

Expected behavior:

IPTABLES rules in /rw/config/qubes_firewall_user_script should persist across reboots

Actual behavior:

IPTABLES rules are not loaded from /rw/config/qubes_firewall_user_script

Steps to reproduce the behavior:

Place rules in /rw/config/qubes_firewall_user_script, e.g.:

iptables -I INPUT 2 -p icmp -j ACCEPT

Make the script executable (chmod +x ....)

Reboot the VM.

Verify the rules are not loaded.

General notes:

A solution consists in adding this line to /rw/config/rc.local so that rc.local executes the firewall script automatically (don't forget to make rc.local executable)

/rw/config/qubes-firewall-user-script

---

Related issues:

Relevant labels:

[marmarek]

This script is called only in ProxyVM (https://www.qubes-os.org/doc/config-files/). Is it the case?

[marmarek]

This script is called only in ProxyVM (https://www.qubes-os.org/doc/config-files/). Is it the case?

[lorenzog]

Ah, fair enough. I was expecting it to be executed in AppVMs too; I needed a NFS share to be mounted between a HVM and an AppVM so I needed to open a few ports on the AppVM's own firewall.

I was following this: https://www.qubes-os.org/doc/qubes-firewall/ and I thought I could apply the same reasoning to all VMs. To be hones I just found this https://www.qubes-os.org/doc/config-files/ which does mention proxy VMs, so never mind :)

[lorenzog]

Ah, fair enough. I was expecting it to be executed in AppVMs too; I needed a NFS share to be mounted between a HVM and an AppVM so I needed to open a few ports on the AppVM's own firewall.

I was following this: https://www.qubes-os.org/doc/qubes-firewall/ and I thought I could apply the same reasoning to all VMs. To be hones I just found this https://www.qubes-os.org/doc/config-files/ which does mention proxy VMs, so never mind :)