Git-Mirrors/qusal
1
0
Fork 0
mirror of https://github.com/ben-grande/qusal.git synced 2024-09-20 17:25:41 +00:00
Code Issues Packages Projects Releases Wiki Activity
ec7f62f23b
qusal/salt/sys-firewall
History
Ben Grande f9ead06408 fix: remove extraneous package repository updates 
Updates happens multiple times, normally 2 to 3, even if we consider a
state without includes. On states with multiple includes, it could
easily get approximately 10 updates being ran. This behavior leads to
unnecessary network bandwidth being spent and more time to run the
installation state. When the connection is slow and not using the
cacher, such as torified connections on Whonix, the installation can
occurs much faster.

Adding external repositories has to be done prior to update to ensure it
is also fetched.

Fixes: https://github.com/ben-grande/qusal/issues/29
2024-03-18 17:51:36 +01:00
..
clone.sls refactor: initial commit 2023-11-13 14:33:28 +00:00
clone.top refactor: initial commit 2023-11-13 14:33:28 +00:00
create.sls fix: remove extraneous package repository updates 2024-03-18 17:51:36 +01:00
create.top refactor: initial commit 2023-11-13 14:33:28 +00:00
init.top refactor: initial commit 2023-11-13 14:33:28 +00:00
install.sls fix: remove extraneous package repository updates 2024-03-18 17:51:36 +01:00
install.top refactor: initial commit 2023-11-13 14:33:28 +00:00
prefs-disp.sls chore: copyright update 2024-01-29 16:49:54 +01:00
prefs-disp.top refactor: initial commit 2023-11-13 14:33:28 +00:00
prefs.sls chore: copyright update 2024-01-29 16:49:54 +01:00
prefs.top refactor: initial commit 2023-11-13 14:33:28 +00:00
README.md doc: prefix qubesctl with sudo 2024-02-23 16:55:11 +01:00

README.md

sys-firewall

Firewall in Qubes OS.

Table of Contents

Description

Creates firewall qube, an App qube "sys-firewall" and a Disposable qube "disp-sys-firewall". By default, "disp-sys-firewall" will be the "updatevm", the "clockvm" and the "default_netvm".

If you want an easy to configure firewall with ad blocking, checkout sys-pihole instead.

Installation

Before installation, rename your current sys-firewall to another name such as sys-firewall-old, the old qube will be used to install packages required for the minimal template. After successful installation and testing the new net qube capabilities, you can remove the old one. If you want the default net qube back, just set sys-firewall template to the full template you are using, such as Debian or Fedora. Before starting, turn on sys-firewall-old or yours default_netvm and check if DNS is working, after that, proceed with the installation.

  • Top:
sudo qubesctl top.enable sys-firewall
sudo qubesctl --targets=tpl-sys-firewall state.apply
sudo qubesctl top.disable sys-firewall
sudo qubesctl state.apply sys-firewall.prefs-disp
  • State:
sudo qubesctl state.apply sys-firewall.create
sudo qubesctl --skip-dom0 --targets=tpl-sys-firewall state.apply sys-firewall.install
sudo qubesctl state.apply sys-firewall.prefs-disp

Alternatively, if you prefer to have an app qube as the firewall:

sudo qubesctl state.apply sys-firewall.prefs

Usage

You should use this qube for handling updates and firewall downstream/client qubes, in other words, enforce network policy to qubes that have sys-firewall as its netvm. Read upstream firewall documentation.