[Question] Using opensnitch with dnsmasq

[Techtonictools]

I'm looking to use virt-manager on a debian system with opensnitch and block all requests from the VM except for hosts in an exception list. To do that, I created two rules. One rule named name 001-dnsmasq deny all to deny all requests from the binary and another rule named 000-dnsmasq allow with priority checked from the same exe and a list of domains in a file referenced in the rule.

What I'm finding is the VM won't get an IP address through the DHCP service unless I switch the 001-dnsmasq deny rule to allow or stop opensnitch. I've put the client IP that is given to the VM into the exception list. When I set the rule 001-dnsmasq to allow then I allow all websites to load in the vm. Is it a supported scenario to filter traffic and get an IP using opensnitch and dnsmasq?

versions:

• OS: debian 10.9
• Window Manager: gnome 3.30
• OpenSnitch 1.4.0rc2
• Virt-Manager 1:2.0.0.3

[gustavo-iniguez-goya]

Hey @Techtonictools ,

I've put the client IP that is given to the VM into the exception list

The exception lists are only for domains. You have to create a new priority rule, allowing explicitly that IP.

Is it a supported scenario to filter traffic and get an IP using opensnitch and dnsmasq?

As far as I can tell yes. I have this scenario working, but with virtualbox.

By the way, are you using the binary I posted on the other issue? I think that this problem and #429 are related.
And according to the malfunction behaviour you described on #429, it could be due to the bugs I fixed. They'll be included in the next rc 1.4.0rc3.

[Techtonictools]

I'm using 1.4.0rc2. I added the new priority rule that includes the IP that had been leased to the VM and now the VM gets that IP. Thank you. To be more clear for anyone else that may want this the rules are:

000-dnsmasq allow
001-dnsmasq allow [192.168.122.229]
999-dnsmasq-deny

Each rule has the binary path for dnsmasq. The first two rules have the priority option checked. The first rule uses a list of domains and the second rule uses just the one IP address,