aboutsummaryrefslogtreecommitdiffstats
path: root/qubes-firewall.d/95-qubes-vpn-exclude
diff options
context:
space:
mode:
authorJimmy Axenhus <github att axenhus doot com>2021-03-01 12:59:19 +0100
committerGitHub <noreply att github doot com>2021-03-01 12:59:19 +0100
commit50d6777c992fb4f687ae1374b59073fe9af853ac (patch)
tree80eabecc7eb0deea42a17dacaac27b265a0c6708 /qubes-firewall.d/95-qubes-vpn-exclude
parent464f93f65373dec01a44e00df6c0e5a5c462570c (diff)
downloadqubes-vpn-exclude-50d6777c992fb4f687ae1374b59073fe9af853ac.tar.bz2
qubes-vpn-exclude-50d6777c992fb4f687ae1374b59073fe9af853ac.tar.zst
qubes-vpn-exclude-50d6777c992fb4f687ae1374b59073fe9af853ac.zip
Improve comments for the firewall script
Diffstat (limited to '')
-rw-r--r--qubes-firewall.d/95-qubes-vpn-exclude6
1 files changed, 4 insertions, 2 deletions
diff --git a/qubes-firewall.d/95-qubes-vpn-exclude b/qubes-firewall.d/95-qubes-vpn-exclude
index d1ee58a..b37751b 100644
--- a/qubes-firewall.d/95-qubes-vpn-exclude
+++ b/qubes-firewall.d/95-qubes-vpn-exclude
@@ -13,10 +13,13 @@ ip6tables -I FORWARD -m conntrack --ctstate RELATED,ESTABLISHED -j ACCEPT
# Open to external DNS server for this VM
iptables -I OUTPUT -o eth0 -m tcp -p tcp --dport 53 -j ACCEPT
iptables -I OUTPUT -o eth0 -m udp -p udp --dport 53 -j ACCEPT
+
+# Open to VPN DNS server for this VM
iptables -I OUTPUT -o tun0 -m tcp -p tcp --dport 53 -j ACCEPT
iptables -I OUTPUT -o tun0 -m udp -p udp --dport 53 -j ACCEPT
+iptables -I INPUT -i tun0 -p udp --dport 53 -d 127.0.0.1 -j ACCEPT
-# Force proxied VMs to query local dnsmasq
+# Force proxied VMs to query local DNS server
iptables -t nat -I PREROUTING -i vif+ -p tcp --dport 53 -j DNAT --to-destination 127.0.0.1
iptables -t nat -I PREROUTING -i vif+ -p udp --dport 53 -j DNAT --to-destination 127.0.0.1
@@ -24,7 +27,6 @@ iptables -t nat -I PREROUTING -i vif+ -p udp --dport 53 -j DNAT --to-destination
iptables -I INPUT -i vif+ -p tcp --dport 53 -d 127.0.0.1 -j ACCEPT
iptables -I INPUT -i vif+ -p udp --dport 53 -d 127.0.0.1 -j ACCEPT
iptables -I OUTPUT -o vif+ -p udp --sport 53 -s 127.0.0.1 -j ACCEPT
-iptables -I INPUT -i tun0 -p udp --dport 53 -d 127.0.0.1 -j ACCEPT
# This script is executed before dnsmasq goes up so we need to create ipsets here.
# If they exists it's fine.

Code dump for some of my projects as well as a mirror for other random or interesting projects. You can find my site at jimmy.axenhus.com