Pre-installed VPN qube

[DemiMarie]

How to file a helpful issue

The problem you're addressing (if any)

Setting up a VPN qube manually is error-prone, tedious, and often requires obscure command-line tools.

The solution you'd like

Provide a VPN qube that is correctly configured out of the box.

If one does not run non-VPN apps in the VPN qube, the following nftables rules should be sufficient to prevent any traffic from bypassing the VPN:

table ip qubes {
    chain vpn {
      type filter hook forward priority filter; policy accept;
      oifgroup 1 counter reject with icmp admin-prohibited
      iifgroup 1 counter reject with icmp admin-prohibited
   }
}
table ip qubes {
    chain vpn {
      type filter hook forward priority filter; policy accept;
      oifgroup 1 counter reject with icmpv6 admin-prohibited
      iifgroup 1 counter reject with icmpv6 admin-prohibited
   }
}

This blocks packets that enter or exit Xen netfront interfaces (eth*), since Qubes OS assigns them to interface group 1. Packets can only be forwarded if they enter and exit via interfaces that are not eth*, such as ones created by a VPN.

The value to a user, and who that user might be

Journalists and other users using VPNs will have an easier time setting up their systems.

Completion criteria checklist

(This section is for developer use only. Please do not modify it.)