5 ms·

Is there any "integrated firewall" in QEMU (and/or any linux container solutions e.g. "bubblewrap")? For example, I run a closed source software (with both lin

by qqtac 5y ago

Is there any "integrated firewall" in QEMU (and/or any linux container solutions e.g. "bubblewrap")? For example, I run a closed source software (with both linux and windows versions) made by company A, which I use for doing business with company B. I'm happy for it to connect to company B's servers but I don't like it to phone home to company A (or any other 3rd parties) Is it possible to run it in QEMU (or "bubblewrap"), allowing access to the public internet for a number of whitelisted websites (e.g. company B), and no access to my local lan? It would be nice if it can be done with something like these For the app I mentioned above: qemu -net whitelist=www.companyB.com,blacklist=127.0.0.0/8 -drive file=app1.img (or bubblewrap -net whitelist=www.companyB.com,blacklist=127.0.0.0/8 /usr/bin/app1) For some other similar apps I could run: qemu -net whitelist=www.companyX.com;www.companyY.com,blacklist=127.0.0.0/8 -drive file=app2.img I'm not keen to manage a bunch of iptables or vnet rules/configs on my host because the configs seem to be all over the places and not easy to get right. Also it takes too much time/work if I just want to spin up some random softeware and test quickly. Any insight and good ideas?

yrro 5y ago
Can you run qemu in bubblewrap? libvirt has per-domain firewalling but probably not with automatic DNS resolution.
- qqtac 5y ago
  What would running qemu in bubblewrap achieve?
vetinari 5y ago
It can be done, but... if you have a router with VLAN support (Mikrotik, Ubiquiti, OpenWrt, many others), use VLANs. Isolate your VMs in their own subnet and configure your router what is allowed or not allowed for hosts in that subnet.
- qqtac 5y ago
  Yep, it's not convenient to manage though.
  - vetinari 5y ago
    Depends, what you consider convenient. If you happen to have homelab cluster and you want your rules to survive a VM migration from one host to another, it is not convenient to have them defined per-node. Alternatively, you can have a look how Proxmox does it. Proxmox uses qemu for VMs, iptables for firewall and their own cluster solution (corosync) to distribute the config (if you happen to have cluster) to all nodes. They are capable of isolating VMs connected to the same bridge.
    - qqtac 5y ago
      > Depends, what you consider convenient. If you happen to have homelab cluster and you want your rules to survive a VM migration from one host to another, it is not convenient to have them defined per-node. Yep true. I don't have a homelab, only a signle computer. I run random applications and games from time to time, so to me convenience is something I can quickly set up and discard.
lanstin 5y ago
Just set up a transparent proxy as the default route for the VM. Any non subnet-local traffic will then be filtered. Incrementally adding in sites to the allowlist as you need them is very interesting exercise in relearning your network dependencies. I say relearning because in the past you would just keep a tcpdump running on your boxes while you were working on the and that was enough to understand the normal networking. Now a fully connected host has all kinds of crap traffic all the time. I don’t really need Ubuntu to know when my hosts are up or not. Etc. etc.

by qqtac 5y ago

yrro 5y ago

Can you run qemu in bubblewrap? libvirt has per-domain firewalling but probably not with automatic DNS resolution.

qqtac 5y ago
What would running qemu in bubblewrap achieve?

vetinari 5y ago

It can be done, but... if you have a router with VLAN support (Mikrotik, Ubiquiti, OpenWrt, many others), use VLANs. Isolate your VMs in their own subnet and configure your router what is allowed or not allowed for hosts in that subnet.

qqtac 5y ago
Yep, it's not convenient to manage though.
- vetinari 5y ago
  Depends, what you consider convenient. If you happen to have homelab cluster and you want your rules to survive a VM migration from one host to another, it is not convenient to have them defined per-node. Alternatively, you can have a look how Proxmox does it. Proxmox uses qemu for VMs, iptables for firewall and their own cluster solution (corosync) to distribute the config (if you happen to have cluster) to all nodes. They are capable of isolating VMs connected to the same bridge.
  - qqtac 5y ago
    > Depends, what you consider convenient. If you happen to have homelab cluster and you want your rules to survive a VM migration from one host to another, it is not convenient to have them defined per-node. Yep true. I don't have a homelab, only a signle computer. I run random applications and games from time to time, so to me convenience is something I can quickly set up and discard.

lanstin 5y ago

Just set up a transparent proxy as the default route for the VM. Any non subnet-local traffic will then be filtered. Incrementally adding in sites to the allowlist as you need them is very interesting exercise in relearning your network dependencies. I say relearning because in the past you would just keep a tcpdump running on your boxes while you were working on the and that was enough to understand the normal networking. Now a fully connected host has all kinds of crap traffic all the time. I don’t really need Ubuntu to know when my hosts are up or not. Etc. etc.