Running OpenBSD as a net qube

unman

2026-10-15 12:30

Install OpenBSD as HVM Template

Follow the normal process for creating a template that is not cloned from an existing template. You will want to use the settings to set virt_mode HVM, and then boot the new template from an OpenBSD iso, and run a standard install. Alternatively, there are pre-built OpenBSD templates available from 3isec

Configure the OpenBSD net qube

Create net qube "openFW" using OpenBSD as the template.
Set openFW virt_mode to HVM
Attach a network device to openFW.
Create a net qube - fw
Make sure that fw does not have netvm set:
```
qvm-prefs fw netvm none
```
Set fw as netvm for openFW:
```
qvm-prefs openFW netvm fw
```
Note IP address of openFW from qvm-ls -n openFW

Here address is 10.137.0.6
Start fw and openFW.

On fw net qube:

Identify which vif interface is used by openFW
```
ip route
```
Here the output is "10.137.0.6 dev vif33.0....."
Add a route which uses that IP as the default gw
```
ip route add default via 10.137.0.6
```
Configure forwarding on fw
```
nftables insert rule qubes custom-forward iifname "vif*" oifname "vif*" accept
```
(This allows all qubes connected to fw to interact with each other - you may wish to be more restrictive.)

Override the normal restrictions set by Qubes:

nftables insert rule qubes antispoof iifname vif33.0 accept

Forward DNS traffic to external DNS server:

nftables flush chain qubes dnat-dns
nftables insert rule qubes dnat-dns udp dport 53 dnat to 9.9.9.9
nftables insert rule qubes dnat-dns tcp dport 53 dnat to 9.9.9.9

(Put these commands in /rw/config/qubes-firewall-user-script and run chmod +x /config/qubes-firewall-user-script )

On openFW the configuration is more straightforward:

Run firewall script. There is a basic script that you can adapt in the OpenBSD Handbook
Bring up em0 - dhclient em0
Set the vif interface:
```
10.137.0.6 up
```

To use the OpenBSD gateway set qubes to use fw as netvm using qvm-prefs. Traffic from those qubes will be routed to the OpenBSD gateway, although they have fw as netvm.