CSEC_PUBLIC/securityonion
1
0
Fork 0
mirror of https://github.com/Security-Onion-Solutions/securityonion.git synced 2025-12-07 17:52:46 +01:00
Code Issues Packages Projects Releases Wiki Activity

Firewall Module - Allow SSH block all the things

Browse Source
This commit is contained in:
Mike Reeves
2018-06-18 11:21:00 -04:00
parent fee437de4e
commit 4b09802991
1 changed files with 49 additions and 1 deletions
Download Patch File Download Diff File Expand all files Collapse all files

50
salt/firewall/init.sls
View File

@@ -1 +1,49 @@
#Init.sls for the firewall module
# Keep localhost in the game
iptables_allow_localhost:
iptables.append:
- table: filter
- chain: INPUT
- jump: ACCEPT
- source: 127.0.0.1
- save: True
# Allow related/established sessions
iptables_allow_established:
iptables.append:
- table: filter
- chain: INPUT
- jump: ACCEPT
- match: conntrack
- ctstate: 'RELATED,ESTABLISHED'
- save: True
# Always allow SSH so we can like log in
iptables_allow_ssh:
iptables.append:
- table: filter
- chain: INPUT
- jump: ACCEPT
- dport: 22
- proto: tcp
- save: True
# I like pings
iptables_allow_pings:
iptables.append:
- table: filter
- chain: INPUT
- jump: ACCEPT
- proto: icmp
- save: True
# Set the policy to deny everything unless defined
enable_reject_policy:
iptables.set_policy:
- table: filter
- chain: INPUT
- policy: DROP
- require:
- firewall: iptables_allow_localhost
- firewall: iptables_allow_established
- firewall: iptables_allow_ssh
- firewall: iptables_allow_pings