Architecture
Networking
Network devices, routing, and firewall rules.
sys-net owns the physical network devices. sys-firewall uses that connection
and applies firewall rules for the VMs behind it. Personal applications can
therefore reach the internet without owning the network hardware.
Qubes calls the VM providing another VM's network connection its NetVM.
In this configuration, sys-firewall is the NetVM for usr-home,
usr-assistant, and sys-ctrl. Dom0 has no default network route, and sys-gui
has no NetVM.