no network connectivity for newly started AppVM?

[marmarek]

Reported by joanna on 1 Jul 2011 22:21 UTC
Every time I start a new AppVM, I get a message from the firewall that iptables-restore failed, which results in no networking the the newly started AppVM. I the must open firewallVM prefs in qubes manager, click ok, which forces reload of firewall rules, and then it works fine.

This happens on one machine only (on the other works fine).

I'm using core v1.6.4 in both VMs and Dom0.

Migrated-From: https://wiki.qubes-os.org/ticket/257

[marmarek]

Comment by marmarek on 14 Jul 2011 00:26 UTC
If you are using domain names in firewall configuration, this can be caused by unconfigured /etc/resolv.conf.

Fixed here:
http://git.qubes-os.org/gitweb/?p=marmarek/core.git;a=commit;h=4fd6cf98d54b85c742fb4afa3e3245499fd2adc3

[marmarek]

Comment by marmarek on 14 Jul 2011 00:26 UTC
If you are using domain names in firewall configuration, this can be caused by unconfigured /etc/resolv.conf.

Fixed here:
http://git.qubes-os.org/gitweb/?p=marmarek/core.git;a=commit;h=4fd6cf98d54b85c742fb4afa3e3245499fd2adc3

[marmarek]

Comment by joanna on 14 Jul 2011 09:39 UTC
No, this problem occurs even for domains that have no rules at all (wide open to internet). This problem also seems to be a race condition -- it happens only sometimes (TM), more or less 50% of time I start a new AppVM.

[marmarek]

Comment by joanna on 14 Jul 2011 09:39 UTC
No, this problem occurs even for domains that have no rules at all (wide open to internet). This problem also seems to be a race condition -- it happens only sometimes (TM), more or less 50% of time I start a new AppVM.

[marmarek]

Comment by marmarek on 14 Jul 2011 17:33 UTC
The firewall rules are common, so it is enough that some (running) AppVM uses domain names in firewall rules to fail its loading.

But this can be also problem with setting DNAT to DNS servers (which cannot be set properly without /etc/resolv.conf) - also fixed by this commit.

[marmarek]

Comment by marmarek on 14 Jul 2011 17:33 UTC
The firewall rules are common, so it is enough that some (running) AppVM uses domain names in firewall rules to fail its loading.

But this can be also problem with setting DNAT to DNS servers (which cannot be set properly without /etc/resolv.conf) - also fixed by this commit.

[marmarek]

Modified by marmarek on 16 Jul 2011 23:38 UTC

[marmarek]

Modified by marmarek on 16 Jul 2011 23:38 UTC