Go back to topic: Prevent Qubes OS clearnet leaks
| The idea is to block all traffic generated by sys-usb, sys-firewall and sys-net, but still allow them to route traffic for Qubes so network still work. | The idea is to block all traffic generated by sys-usb, sys-firewall and sys-net, but still allow them to route traffic for Qubes so network still work. Although sys-usb should not have network, it is actually configure as a "providing network" qube for when you plug in an USB network adapter. |
| sudo nft add chain ip6 qubes output '{type filter hook output priority 0; policy drop; }' |
| Related to https://github.com/QubesOS/qubes-issues/issues/9338 |
| > :information_source: Disabling update check for these qubes may be enough. But an extra security is to block all traffic. |
| if [ "$( | if [ "$(qubesdb-read /name)" = "sys-firewall" ] || [ "$(qubesdb-read /name)" = "sys-net" ] || [ "$(qubesdb-read /name)" = "sys-usb" ] |