networked qubes other than sys-net often without web connectivity after sys-net start

[UndeadDevel]

Qubes OS release

Qubes 4.2rc5

Brief summary (updated)

On some most (not all) boots of sys-net both WiFi and Ethernet (NV41 with AX201 WiFi and standard integrated ethernet port) does not work properly right away; it will find and connect to the network and sys-net will have full connectivity (doing a curl www.google.com gives normal return in a sys-net terminal), but no other qube, including sys-firewall, will have normal web access (e.g. sys-firewall then starts pushing notifications about not being able to resolve my firewall rules for some qubes); sys-firewall does still get pings through to 8.8.8.8, but doing curl www.google.com hangs. Both the AX201 Intel WiFi 6 card as well as the ethernet adapter is the same as what I used under Qubes 4.1.2, where there had been no issues; I tried with the debian template that sys-net was using in Qubes 4.1, but it seems worse, i.e. happens more often with it; currently both sys-net and sys-firewall are using a 4.2 debian-12-xfce template.

(Edit: not sure if relevant, as ethernet also affected and sys-net has full network access)`sudo dmesg` in `sys-net` reports:

[    3.464343] iwlwifi 0000:00:06.0: Detected crf-id 0x1300504, cnv-id 0x80400 wfpm id 0x80000030
[    3.491708] iwlwifi 0000:00:06.0: PCI dev 51f0/0074, rev=0x370, rfid=0x10a100
[    3.492052] iwlwifi 0000:00:06.0: Direct firmware load for iwlwifi-so-a0-hr-b0-83.ucode failed with error -2
[    3.492101] iwlwifi 0000:00:06.0: Direct firmware load for iwlwifi-so-a0-hr-b0-82.ucode failed with error -2
[    3.492129] iwlwifi 0000:00:06.0: Direct firmware load for iwlwifi-so-a0-hr-b0-81.ucode failed with error -2
[    3.492156] iwlwifi 0000:00:06.0: Direct firmware load for iwlwifi-so-a0-hr-b0-80.ucode failed with error -2
[    3.492185] iwlwifi 0000:00:06.0: Direct firmware load for iwlwifi-so-a0-hr-b0-79.ucode failed with error -2
[    3.492211] iwlwifi 0000:00:06.0: Direct firmware load for iwlwifi-so-a0-hr-b0-78.ucode failed with error -2
[    3.492238] iwlwifi 0000:00:06.0: Direct firmware load for iwlwifi-so-a0-hr-b0-77.ucode failed with error -2
[    3.492265] iwlwifi 0000:00:06.0: Direct firmware load for iwlwifi-so-a0-hr-b0-76.ucode failed with error -2
[    3.492292] iwlwifi 0000:00:06.0: Direct firmware load for iwlwifi-so-a0-hr-b0-75.ucode failed with error -2
[    3.492319] iwlwifi 0000:00:06.0: Direct firmware load for iwlwifi-so-a0-hr-b0-74.ucode failed with error -2
[    3.492346] iwlwifi 0000:00:06.0: Direct firmware load for iwlwifi-so-a0-hr-b0-73.ucode failed with error -2
[    3.501541] iwlwifi 0000:00:06.0: api flags index 2 larger than supported by driver
[    3.501563] iwlwifi 0000:00:06.0: TLV_FW_FSEQ_VERSION: FSEQ Version: 0.0.2.36
[    3.501805] iwlwifi 0000:00:06.0: loaded firmware version 72.daa05125.0 so-a0-hr-b0-72.ucode op_mode iwlmvm
[...]
[    3.818457] iwlwifi 0000:00:06.0: Detected Intel(R) Wi-Fi 6 AX201 160MHz, REV=0x370

So it fails at first but then manages to load the firmware.

Dom0 sudo dmesg says regarding that network controller:

43.856657] pciback 0000:00:14.3: xen-pciback: Driver tried to write to a read-only configuration space field at offset 0x48, size 2. This may be harmless, but if you have problems with your device:
               1) see permissive attribute in sysfs
               2) report problems to the xen-devel mailing list along with details of your device obtained from lspci.

So this seems like another firewall issue, which I suppose is to be expected given the significant changes to firewalling between 4.1.2 and 4.2.
What fixes it most of the time is reconnecting (i.e. cable out and in again for ethernet, or "flipping the switch" - software via nmcli - for WiFi).
Confirmed now that using a fresh, debian-12-xfce-based sys-net with standard configuration also produces this issue.

Steps to reproduce

1. NV41 with AX201 running Qubes 4.2rc5
2. boot up and try to use WiFi to connect to the web
(3. if that works without issue try restarting sys-net until issue appears)

1. NV41 with Qubes 4.2rc5
2. Boot up and try to access the web from any non-sys-net VM using either WiFi or ethernet
   (3. If there are no issues, restart sys-net until issue appears)

Expected behavior

No problems, as in Qubes 4.1.2

Actual behavior

Sometimes the WiFi will connect to the AP, but there's no internet access. Turning WiFi off and on again in the Network Manager usually fixes the problem.
No web connectivity for any qube except sys-net

[UndeadDevel]

Updated the OP, as this is actually not a WiFi issue (confirmed occurring with ethernet-only connection) and sys-net has full web access, so almost certainly it's another firewall issue. What may be contributing to this issue is the fact that I always start sys-net with disabled WiFi (via config) and disconnected ethernet...will test more with a different config and report back.

[UndeadDevel]

I've confirmed that even in a standard configuration with a fresh debian-12-xfce-based sys-net and WiFi always on from boot this problem persists, so it seems it's another firewall issue, as both WiFi and ethernet are affected, sys-net does have full web connectivity, but sys-firewall and other qubes connected to sys-firewall do not.

[DemiMarie]

I wonder if there are any tests for Debian-based sys-net. If not, that should probably be fixed.