QubesOS MirageOS firewall: dynamic ruleset, DNS
2019-03-01Activists, journalists, and others with specific threat models rely on a secure operating system; otherwise, communication could potentially put their lives at risk. When using Tor or VPN virtual machines in QubesOS, it is essential to ensure that no network packets bypass this secure connection. To prevent this, each VM requires its own firewall. The existing firewall in QubesOS consumes 350 MB of RAM. Consequently, when running multiple VMs in Qubes, available memory is often insufficient to also run the necessary firewalls. QubesOS is considered a highly secure operating system—it is even recommended by Edward Snowden. We therefore aim to develop a lightweight firewall for QubesOS. A firewall uses packet-filtering rules to block unauthorized access to network communication and is a crucial component of the security architecture. QubesOS runs each application in isolation within a separate virtual machine (VM). An attack—on a browser, for instance—remains confined to that specific VM. The existing Linux-based firewall for QubesOS consumes a significant amount of RAM, a resource that must be shared among all VMs and is therefore scarce. A firewall based on the minimal operating system MirageOS consumes less memory and offers a smaller attack surface.
In 2018 we received funding from German ministry for science and education via prototypefund to extend the MirageOS QubesOS firewall unikernel.
The funding amount was 48_500€. Involved were Stefanie Schirmer and Mindy Preston.
This project allowed us to develop a test suite for the unikernel, and extend the existing unikernel with dynamic firewall rules, amongst other features. It resulted in ocaml-pf, mirage-nat, and the main firewall.