CSEC_PUBLIC/securityonion
1
0
Fork 0
mirror of https://github.com/Security-Onion-Solutions/securityonion.git synced 2025-12-08 18:22:47 +01:00
Code Issues Packages Projects Releases Wiki Activity

Firewall Module - Its Working

Browse Source
This commit is contained in:
Mike Reeves
2018-07-11 15:31:30 -04:00
parent 22d8319b0c
commit 973ae8a187
2 changed files with 57 additions and 16 deletions
Download Patch File Download Diff File Expand all files Collapse all files

69
salt/firewall/init.sls
View File

@@ -1,4 +1,4 @@
# Default Rules for everyone # Firewall Magic
# Keep localhost in the game # Keep localhost in the game
iptables_allow_localhost: iptables_allow_localhost:
@@ -38,28 +38,59 @@ iptables_allow_pings:
- proto: icmp - proto: icmp
- save: True - save: True
# Set the policy to deny everything unless defined # Create the chain for logging
enable_reject_policy: iptables_LOGGING_limit:
iptables.set_policy: iptables.append:
- table: filter
- chain: LOGGING
- match: limit
- jump: LOG
- limit: 2/min
- log-level: 4
- log-prefix: "IPTables-dropped: "
# Make the input policy send stuff that doesn't match to be logged and dropped
iptables_log_input_drops:
iptables.append:
- table: filter - table: filter
- chain: INPUT - chain: INPUT
- policy: DROP - jump: LOGGING
- require: - save: True
- iptables: iptables_allow_localhost
- iptables: iptables_allow_established # Set the policy to deny everything unless defined
- iptables: iptables_allow_ssh #enable_reject_policy:
- iptables: iptables_allow_pings # iptables.set_policy:
# - table: filter
# - chain: INPUT
# - policy: DROP
# - require:
# - iptables: iptables_allow_localhost
# - iptables: iptables_allow_established
# - iptables: iptables_allow_ssh
# - iptables: iptables_allow_pings
# Enable global DOCKER-USER block rule # Enable global DOCKER-USER block rule
enable_docker_user_fw_policy: enable_docker_user_fw_policy:
iptables.insert: iptables.insert:
- table: filter - table: filter
- chain: DOCKER-USER - chain: DOCKER-USER
- jump: DROP - jump: LOGGING
- in-interface: '!docker0' - in-interface: '!docker0'
- out-interface: docker0 - out-interface: docker0
- position: 1 - position: 1
- save: true - save: True
enable_docker_user_established:
iptables.insert:
- table: filter
- chain: DOCKER-USER
- jump: ACCEPT
- in-interface: '!docker0'
- out-interface: docker0
- position: 1
- save: True
- match: conntrack
- ctstate: 'RELATED,ESTABLISHED'
# Rules if you are a Master # Rules if you are a Master
{% if grains['role'] == 'so-master' %} {% if grains['role'] == 'so-master' %}
@@ -68,23 +99,25 @@ enable_docker_user_fw_policy:
{% for ip in pillar.get('minions') %} {% for ip in pillar.get('minions') %}
enable_salt_minions_4505_{{ip}}: enable_salt_minions_4505_{{ip}}:
iptables.append: iptables.insert:
- table: filter - table: filter
- chain: INPUT - chain: INPUT
- jump: ACCEPT - jump: ACCEPT
- proto: tcp - proto: tcp
- source: {{ ip }} - source: {{ ip }}
- dport: 4505 - dport: 4505
- position: 1
- save: True - save: True
enable_salt_minions_4506_{{ip}}: enable_salt_minions_4506_{{ip}}:
iptables.append: iptables.insert:
- table: filter - table: filter
- chain: INPUT - chain: INPUT
- jump: ACCEPT - jump: ACCEPT
- proto: tcp - proto: tcp
- source: {{ ip }} - source: {{ ip }}
- dport: 4506 - dport: 4506
- position: 1
- save: True - save: True
enable_salt_minions_5000_{{ip}}: enable_salt_minions_5000_{{ip}}:
@@ -160,3 +193,11 @@ enable_standard_beats_5044_{{ip}}:
# Rules if you are a Warm Node # Rules if you are a Warm Node
# Some Fixer upper type rules # Some Fixer upper type rules
# Drop it like it's hot
# Make the input policy send stuff that doesn't match to be logged and dropped
iptables_drop_all_the_things:
iptables.append:
- table: filter
- chain: LOGGING
- jump: DROP
- save: True