VPN VM fails with ipv6 disabled

[nil0x42]

Qubes OS version:

R4.0

Affected component(s):

---

Steps to reproduce the behavior:

1 - create a sys-vpn VPN qube, as described in documentation:

https://www.qubes-os.org/doc/vpn/#set-up-a-proxyvm-as-a-vpn-gateway-using-iptables-and-cli-scripts

(sys-firewall is used as NetVM)

2 - disable ipv6 on sys-vpn:

tested the following ways:

add net.ipv6.conf.all.disable_ipv6 = 1 in sys-vpn's /etc/sysctl.conf file
OR
disable ip6 feature explicitly in vm:
root@dom0 # qvm-features sys-vpn ipv6 '' (as described in https://www.qubes-os.org/doc/networking/#ipv6)

Expected behavior:

have VPN running normally, and ip addr returning no ipv6 address on sys-vpn qube.

Actual behavior:

VPN does not start

General notes:

After investigating a bit, VPN does not start because if is called exactly as explained here:
https://www.qubes-os.org/doc/vpn/#set-up-a-proxyvm-as-a-vpn-gateway-using-iptables-and-cli-scripts

so VPN is called on /rw/config/rc.local with /rw/config/vpn/qubes-vpn-handler.sh as up script.
And this script (qubes-vpn-handler.sh) have the following line in it:
iptables -t nat -F PR-QBS
so VPN start fails, because PR-QBS does not exist when ipv6 is disabled with one of the methods mentioned above.

also, after looking into /var/log/xen/console/guest-sys-spn.log
i found the following line, probably related to the issue:

[FAILED] Failed to start Qubes base firewall settings.
See 'systemctl status qubes-iptables.service' for details.

---

Related issues:

[tasket]

What template and version of qubes-core-agent?
I was unable to reproduce this using qubes-core-agent 4.0.28 (debian-9) or 4.0.30 (fedora-28) using the qubes-tunnel code which has a similar up script with identical iptables -F command. PR-QBS is present and the qubes-iptables.service status is active/success. I also tried both methods of disabling ipv6.

It sounds like @nil0x42 was hit by the #3939 bug by coincidence when disabling ipv6. If that's the case then updating qubes-core-agent to 4.0.30 might prevent qubes-iptables.service from failing and resolve the issue.

[tasket]

What template and version of qubes-core-agent?
I was unable to reproduce this using qubes-core-agent 4.0.28 (debian-9) or 4.0.30 (fedora-28) using the qubes-tunnel code which has a similar up script with identical iptables -F command. PR-QBS is present and the qubes-iptables.service status is active/success. I also tried both methods of disabling ipv6.

It sounds like @nil0x42 was hit by the #3939 bug by coincidence when disabling ipv6. If that's the case then updating qubes-core-agent to 4.0.30 might prevent qubes-iptables.service from failing and resolve the issue.