From 0ed39e6a190831ba3c7d5357ceeb2fbf664c0fe7 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Marek=20Marczykowski-G=C3=B3recki?=
 <marmarek@invisiblethingslab.com>
Date: Sat, 30 May 2026 22:51:52 +0200
Subject: [PATCH] Restart qubes-firewall on failure

Sometimes, on a small sys-net, qubes-firewall gets killed by OOM killer,
if it happens to start and reload rules at the time when many other
services are starting. This results in no network access to downstream
VMs.
Restart it on failure automatically, but with 5s delay.

QubesOS/qubes-issues#10886
---
 vm-systemd/qubes-firewall.service | 2 ++
 1 file changed, 2 insertions(+)

diff --git a/vm-systemd/qubes-firewall.service b/vm-systemd/qubes-firewall.service
index e49d1d69..218defa8 100644
--- a/vm-systemd/qubes-firewall.service
+++ b/vm-systemd/qubes-firewall.service
@@ -7,6 +7,8 @@ Before=qubes-network.service
 [Service]
 Type=notify-reload
 ExecStart=/usr/bin/qubes-firewall
+Restart=on-failure
+RestartSec=5s
 
 [Install]
 WantedBy=multi-user.target