From 593cdbd06001f3492423c1c590b4e5ac3d5ae92d Mon Sep 17 00:00:00 2001
From: m0duspwnens <josh.patterson@securityonionsolutions.com>
Date: Fri, 4 Aug 2023 08:50:06 -0400
Subject: [PATCH] add rules for idh to connect to managers, change idh from
 sensor to idh in so-firewall-minion

---
 salt/firewall/defaults.yaml                | 33 ++++++++++++++++++++++
 salt/manager/tools/sbin/so-firewall-minion |  4 +--
 2 files changed, 35 insertions(+), 2 deletions(-)

diff --git a/salt/firewall/defaults.yaml b/salt/firewall/defaults.yaml
index 3095c052e..48074b0be 100644
--- a/salt/firewall/defaults.yaml
+++ b/salt/firewall/defaults.yaml
@@ -383,6 +383,17 @@ firewall:
                 - elastic_agent_control
                 - elastic_agent_data
                 - elastic_agent_update
+            idh:
+              portgroups:
+                - docker_registry
+                - influxdb
+                - sensoroni
+                - yum
+                - beats_5044
+                - beats_5644
+                - elastic_agent_control
+                - elastic_agent_data
+                - elastic_agent_update
             sensor:
               portgroups:
                 - beats_5044
@@ -548,6 +559,17 @@ firewall:
                 - elastic_agent_control
                 - elastic_agent_data
                 - elastic_agent_update
+            idh:
+              portgroups:
+                - docker_registry
+                - influxdb
+                - sensoroni
+                - yum
+                - beats_5044
+                - beats_5644
+                - elastic_agent_control
+                - elastic_agent_data
+                - elastic_agent_update
             sensor:
               portgroups:
                 - beats_5044
@@ -723,6 +745,17 @@ firewall:
                 - elastic_agent_control
                 - elastic_agent_data
                 - elastic_agent_update
+            idh:
+              portgroups:
+                - docker_registry
+                - influxdb
+                - sensoroni
+                - yum
+                - beats_5044
+                - beats_5644
+                - elastic_agent_control
+                - elastic_agent_data
+                - elastic_agent_update
             sensor:
               portgroups:
                 - docker_registry
diff --git a/salt/manager/tools/sbin/so-firewall-minion b/salt/manager/tools/sbin/so-firewall-minion
index 4834f0e41..7b0ddab90 100755
--- a/salt/manager/tools/sbin/so-firewall-minion
+++ b/salt/manager/tools/sbin/so-firewall-minion
@@ -74,9 +74,9 @@ fi
 			so-firewall includehost heavynode "$IP" --apply
 			;;
 		'IDH')
-		    so-firewall includehost sensor "$IP" --apply
+		    so-firewall includehost idh "$IP" --apply
 			;;
 		'RECEIVER')
 			so-firewall includehost receiver "$IP" --apply
 			;;
-    esac
\ No newline at end of file
+    esac