The /etc/xen/vif-route-qubes script is not utilising systemd, which means the script can potentially run before the antispoof nftables chains have been configured, which would result in the script exiting prematurely. Not ordering around systemd also means these interfaces might be set up before network-pre which makes it impossible for a firewall to be configured prior. Would the Qubes project accept a PR that moves this script to a systemd service? Maybe @marmarek might know? Thanks.| Qubes OS Forum