# Barber

## network

```bash
# ip: 87.236.197.158, 87.236.197.157
```


## TODO

- firewall
- kvm

## KVM

```bash
egrep -c '(vmx|svm)' /proc/cpuinfo      # > 0 expected (Intel VT-x / AMD-V)

# qemu-kvm is a transitional metapackage on 26.04; qemu-system-x86 is the real binary.
apt update
apt install -y \
  qemu-system-x86 qemu-utils \
  libvirt-daemon-system libvirt-clients \
  virtinst cpu-checker ovmf

apt install virt-manager
# optional: libguestfs-tools (image surgery), virt-manager (GUI over X-fwd)


# Verify acceleration + service
kvm-ok                  # expect: "KVM acceleration can be used"
lsmod | grep kvm        # kvm + kvm_intel|kvm_amd loaded

sudo systemctl enable --now libvirtd
sudo systemctl is-active libvirtd

# non-root management
sudo usermod -aG libvirt,kvm $USER
newgrp libvirt          # apply to current shell; otherwise log out/in
virsh list --all        # should run without sudo


# default libvirt network configuration changed to: 192.168.124.*
```


## Firewall

```bash
ufw default deny incoming
ufw default allow outgoing
ufw limit 22/tcp        # SSH — limit, not allow (see below)
ufw enable              # answer 'y' — safe, the rule's already in
ufw status verbose

# Pin IP forwarding
echo 'net.ipv4.ip_forward=1' | sudo tee /etc/sysctl.d/99-ip-forward.conf
sudo sysctl --system

# Fix the FORWARD policy (mandatory for NAT guests)
sudo sed -i 's/^DEFAULT_FORWARD_POLICY=.*/DEFAULT_FORWARD_POLICY="ACCEPT"/' /etc/default/ufw
sudo ufw reload

# DHCP/DNS to guests (usually automatic)
sudo ufw allow in on virbr0 to any port 53 proto udp
sudo ufw allow in on virbr0 to any port 67 proto udp

# dns on utility-101
ufw route allow proto udp from any to 192.168.124.101 port 53
ufw route allow proto tcp from any to 192.168.124.101 port 53
```

```bash
# ufw fights with libvirtd about some iptables rules

# /etc/libvirt/hooks/network
cat > /etc/libvirt/hooks/network <<'EOF'
#!/bin/bash
# Re-inject inbound DNS ACCEPT into libvirt's LIBVIRT_FWI chain.
# libvirt flushes/rebuilds this chain on network start, so the rule
# must be re-applied each time the network comes up.

NET="$1"   # network name (arg 1)
OP="$2"    # operation   (arg 2)

TARGET_NET="default"      # <-- set to your `virsh net-list` name
VM_IP="192.168.124.101"
WAN_IF="enp5s0"
BR_IF="virbr0"

OSPROVIDER_NET="osprovider"
OSPROVIDER_BR="virbr2"
OSPROVIDER_SUBNET="10.10.50.0/24"

[ "$OP" = "started" ] || exit 0

if [ "$NET" = "$TARGET_NET" ]; then
    for proto in udp tcp; do
        iptables -C LIBVIRT_FWI -i "$WAN_IF" -o "$BR_IF" -d "$VM_IP" -p "$proto" --dport 53 -j ACCEPT 2>/dev/null \
          || iptables -I LIBVIRT_FWI 1 -i "$WAN_IF" -o "$BR_IF" -d "$VM_IP" -p "$proto" --dport 53 -j ACCEPT
    done
fi

if [ "$NET" = "$OSPROVIDER_NET" ]; then
    # libvirt's LIBVIRT_FWO chain REJECTs all forwarding from virbr2 because osprovider is
    # defined as an isolated network. Insert these rules at the top of FORWARD (before the
    # LIBVIRT_* chains run) so provider-network traffic can reach POSTROUTING/MASQUERADE.
    iptables -C FORWARD -i "$OSPROVIDER_BR" -s "$OSPROVIDER_SUBNET" -j ACCEPT 2>/dev/null \
      || iptables -I FORWARD 1 -i "$OSPROVIDER_BR" -s "$OSPROVIDER_SUBNET" -j ACCEPT
    iptables -C FORWARD -o "$OSPROVIDER_BR" -d "$OSPROVIDER_SUBNET" -m conntrack --ctstate RELATED,ESTABLISHED -j ACCEPT 2>/dev/null \
      || iptables -I FORWARD 1 -o "$OSPROVIDER_BR" -d "$OSPROVIDER_SUBNET" -m conntrack --ctstate RELATED,ESTABLISHED -j ACCEPT
fi
EOF
chmod +x /etc/libvirt/hooks/network 

```

## VNC remote desktop

```bash
apt install tigervnc-standalone-server xfce4 xfce4-goodies
apt install dbus-x11

# Fix the xstartup to launch Xfce explicitly inside a fresh dbus session:
cat > ~/.vnc/xstartup <<'EOF'
#!/bin/sh
unset SESSION_MANAGER
unset DBUS_SESSION_BUS_ADDRESS
export XDG_SESSION_TYPE=x11
export XDG_CURRENT_DESKTOP=XFCE
[ -r "$HOME/.Xresources" ] && xrdb "$HOME/.Xresources"
exec dbus-run-session -- startxfce4
EOF
chmod +x ~/.vnc/xstartup
```