How to use port forwarding with mirage?

[100111001]

Sorry to ask here a question as an issue, but I couldn't find another "place" to do so.

I started using mirage as my default firewall on qubes and I'm very thrilled about it and the tiny memory footprint.
The setup was quite convenient using this script

For portforwarding I've used this script which is based on iptables.

Unfortunately, this is not working with mirage out of the box and I have to use the heavy-weight linux firewall for some AppVMs.

Can you give me a hint how to create port forwarding for incoming connections with mirage in a qubes setup?

The messages I get, while running the port forwading script are:

Unknown command "QUBESRPC qubes.VMShell dom0" [while processing "QUBESRPC qubes.VMShell dom0"]
TIMESTAMP qrexec-client[19561]: process_io.c:36:handle_vchan_error: Error while vchan send(handle_input stdout), exiting

[palainp]

Hi @100111001 thanks for your report!

Indeed shell commands are not correctly taken into account (see https://github.com/mirage/qubes-mirage-firewall/blob/main/command.ml) and the provided port forwarding script will require a shell compatible with iptables and pipes invocations, which will induce a lot of complexity in the current qubes-mirage-fw.

It sounds plausible (although I didn't looked into it ;) ) to include some sort of command parsing to allow port forwarding from dom0 (this issue may be an enhancement request), but I unfortunately think it will be too complex to reuse the classic script properly :(

[100111001]

Is the summary that with mirage it's currently not possible to setup port forwarding?
If there's a way can, you point me in the right direction?

[palainp]

Yes unfortunately the script will not work with mirage because it runs the netvms chain from the target machine to sys-net and we will not be able to run shell commands when our turn comes.

It will takes a bit of coding work to add something that can handle port forwarding (here and in the port-forwarding script) and I currently don't have the time to do it, but if you want to, you are welcome to add it :)