DNS does not work if used as Qubes OS ProxyVM

[TommyTran732]

Describe the bug
DNS does not work if I attempt to run Lokinet as a ProxyVM. It does work if I run it as in AppVM with the network-manager service.

To Reproduce

1. Install Lokinet in a Debian based template.
2. Make a VM based on said template named sys-lokinet. Set it to use sys-firewall for networking. Tick the box Provides network in the advanced settings tab and give it the network-manager service in the service settings tab.
3. Run Lokinet in sys-lokinet with loki.exit as the exit node.
4. Make a new AppVM on a template without Lokinet installed. Set it to use sys-lokinet for networking.
5. Observe that DNS does not work in the AppVM.

Related Discussion
https://forum.qubes-os.org/t/lokinet-net-qube/2679

Device and Operating system (please complete the following information):

• OS: Qubes OS host. KickSecure 16 ProxyVM. KickSecure 16 and Fedora 36 AppVMs.
• Lokinet Version number or Git commit hash:

lokinet-bin/stable,now 0.9.9-2~deb11 amd64 [installed,automatic]
lokinet-gui/stable,now 0.3.6-1~deb11 amd64 [installed]
lokinet/stable,now 0.9.9-2~deb11 all [installed,automatic]

[majestrate]

i will take a shot out in the dark and say it is the usage of 127.3.2.1 that is causing this. the ietf are resizing loopback from 127.0.0.0/8 to something MUCH smaller, thus systemd-resolved will not respect 127.3.2.1 as loopback, try using 127.0.0.1 with a high port. related issue: #1887

[majestrate]

also

Run Lokinet in sys-lokinet with loki.exit as the exit node.

you want exit.loki, we do not use the .exit gtld, we use the .loki gtld

[TommyTran732]

also

Run Lokinet in sys-lokinet with loki.exit as the exit node.

you want exit.loki, we do not use the .exit gtld, we use the .loki gtld

My bad, i was tired. I meant to write exit.loki.

Nothing changes though, the DNS issue is still there.

[TommyTran732]

i will take a shot out in the dark and say it is the usage of 127.3.2.1 that is causing this. the ietf are resizing loopback from 127.0.0.0/8 to something MUCH smaller, thus systemd-resolved will not respect 127.3.2.1 as loopback, try using 127.0.0.1 with a high port. related issue: #1887

I have already tested this, it does bot solve the issue.

[majestrate]

i will take a shot out in the dark and say it is the usage of 127.3.2.1 that is causing this. the ietf are resizing loopback from 127.0.0.0/8 to something MUCH smaller, thus systemd-resolved will not respect 127.3.2.1 as loopback, try using 127.0.0.1 with a high port. related issue: #1887

I have already tested this, it does bot solve the issue.

Fair, it was worth a shot.

Is there a way to test Qubes VM templates without using a baremetal qubes install as the host? If i can run qubes host with in a VM with nested virtualization I would love to try the VM templates and prevent regressions going forward.

[ce62d]

Is there a way to test Qubes VM templates without using a baremetal qubes install as the host? If i can run qubes host with in a VM with nested virtualization I would love to try the VM templates and prevent regressions going forward.

For testing, it is recommended to installation it on a (fast) USB drive but it should also work on vbox, vmware and qemu*. You should expect some performance and screen resolution issues. Needless to say, ensure that you provide enough RAM (16 should be enough for your lokinet testing). Keep it as simple as possible (sys-usb, no disc encryption ...) and use the default setup.

To get started:
https://www.qubes-os.org/doc/firewall/
https://github.com/tasket/Qubes-vpn-support
https://lokilocker.com/whoami/QubesOS-lokinet-setup/wiki/Qubes-OS-lokinet-setup
https://forum.qubes-os.org/t/cannot-update-template-through-vpn-proxy/11523

Useful commands:
dom0: qvm-run --user root < qvm-name > xterm
... see https://dev.qubes-os.org/projects/core-admin-client/en/latest/index.html

*https://forum.qubes-os.org/t/qubes-os-under-virtualbox-for-tests/8187/5

PS: Please share your results, questions, thoughts with the Qubes Community https://forum.qubes-os.org/ I am pretty sure the community and the Qubes devs will appreciate your effort and support you with Qubes specific stuff.

[majestrate]

good to know, i will step into this after the 0.9.10 tag is put out.

[majestrate]

it seems you need to bind the lokinet dns socket to use an ip that is accessible from the app vm and also make sure the ip range provided by lokinet is routable via the lokinet vm