CSEC_PUBLIC/securityonion
1
0
Fork 0
mirror of https://github.com/Security-Onion-Solutions/securityonion.git synced 2025-12-09 18:52:52 +01:00
Code Issues Packages Projects Releases Wiki Activity

allow for binding ip and ports to different port number

Browse Source
This commit is contained in:
m0duspwnens
2023-01-12 16:42:45 -05:00
parent 80f65fcd62
commit d163d834d4
2 changed files with 98 additions and 61 deletions
Download Patch File Download Diff File Expand all files Collapse all files

95
salt/docker/defaults.yaml
View File

@@ -6,94 +6,103 @@ docker:
containers: containers:
'so-dockerregistry': 'so-dockerregistry':
final_octet: 20 final_octet: 20
ports: port_bindings:
5000: tcp - 0.0.0.0:5000:5000
'so-elastic-fleet': 'so-elastic-fleet':
final_octet: 21 final_octet: 21
ports: port_bindings:
8220: tcp - 0.0.0.0:8220:8220/tcp
'so-elasticsearch': 'so-elasticsearch':
final_octet: 22 final_octet: 22
ports: port_bindings:
9200: tcp - 0.0.0.0:9200:9200/tcp
9300: tcp - 0.0.0.0:9300:9300/tcp
'so-filebeat': 'so-filebeat':
final_octet: 23 final_octet: 23
ports: port_bindings:
514: udp - 0.0.0.0:514:514/udp
5066: tcp - 0.0.0.0:514:514/tcp
- 0.0.0.0:5066:5066/tcp
'so-grafana': 'so-grafana':
final_octet: 24 final_octet: 24
ports: port_bindings:
3000: tcp - 0.0.0.0:3000:3000
'so-idstools': 'so-idstools':
final_octet: 25 final_octet: 25
'so-influxdb': 'so-influxdb':
final_octet: 26 final_octet: 26
ports: port_bindings:
8086: tcp - 0.0.0.0:8086:8086
'so-kibana': 'so-kibana':
final_octet: 27 final_octet: 27
ports: port_bindings:
5601: tcp - 0.0.0.0:5601:5601
'so-kratos': 'so-kratos':
final_octet: 28 final_octet: 28
ports: port_bindings:
4433: tcp - 0.0.0.0:4433:4433
4434: tcp - 0.0.0.0:4434:4434
'so-logstash': 'so-logstash':
final_octet: 29 final_octet: 29
ports: port_bindings:
3765: tcp - 0.0.0.0:3765:3765
5044: tcp - 0.0.0.0:5044:5044
5055: tcp - 0.0.0.0:5055:5055
5644: tcp - 0.0.0.0:5644:5644
6050: tcp - 0.0.0.0:6050:6050
6051: tcp - 0.0.0.0:6051:6051
6052: tcp - 0.0.0.0:6052:6052
6053: tcp - 0.0.0.0:6053:6053
9600: tcp - 0.0.0.0:9600:9600
'so-mysql': 'so-mysql':
final_octet: 30 final_octet: 30
ports: port_bindings:
3306: tcp - 0.0.0.0:3306:3306
'so-nginx': 'so-nginx':
final_octet: 31 final_octet: 31
ports: port_bindings:
80: tcp - 80:80
443: tcp - 443:443
'so-playbook': 'so-playbook':
final_octet: 32 final_octet: 32
port_bindings:
- 0.0.0.0:3200:3000
'so-redis': 'so-redis':
final_octet: 33 final_octet: 33
ports: port_bindings:
6379: tcp - 0.0.0.0:6379:6379
9696: tcp - 0.0.0.0:9696:9696
'so-soc': 'so-soc':
final_octet: 34 final_octet: 34
ports: port_bindings:
9822: tcp - 0.0.0.0:9822:9822
'so-soctopus': 'so-soctopus':
final_octet: 35 final_octet: 35
ports: port_bindings:
7000: tcp - 0.0.0.0:7000:7000
'so-strelka-backend': 'so-strelka-backend':
final_octet: 36 final_octet: 36
'so-strelka-filestream': 'so-strelka-filestream':
final_octet: 37 final_octet: 37
'so-strelka-frontend': 'so-strelka-frontend':
final_octet: 38 final_octet: 38
port_bindings:
- 0.0.0.0:57314:57314
'so-strelka-manager': 'so-strelka-manager':
final_octet: 39 final_octet: 39
'so-strelka-gatekeeper': 'so-strelka-gatekeeper':
final_octet: 40 final_octet: 40
port_bindings:
- 0.0.0.0:6381:6379
'so-strelka-coordinator': 'so-strelka-coordinator':
final_octet: 41 final_octet: 41
port_bindings:
- 0.0.0.0:6380:6379
'so-elastalert': 'so-elastalert':
final_octet: 42 final_octet: 42
'so-curator': 'so-curator':
final_octet: 43 final_octet: 43
'so-elastic-fleet-package-registry': 'so-elastic-fleet-package-registry':
final_octet: 44 final_octet: 44
ports: port_bindings:
8080: tcp - 0.0.0.0:8080:8080/tcp

64
salt/firewall/iptables.jinja
View File

@@ -2,6 +2,46 @@
{% from 'firewall/containers.map.jinja' import NODE_CONTAINERS -%} {% from 'firewall/containers.map.jinja' import NODE_CONTAINERS -%}
{% from 'firewall/map.jinja' import hostgroups with context -%} {% from 'firewall/map.jinja' import hostgroups with context -%}
{% from 'firewall/map.jinja' import assigned_hostgroups with context -%} {% from 'firewall/map.jinja' import assigned_hostgroups with context -%}
{%- set PR = [] %}
{%- set D1 = [] %}
{%- set D2 = [] %}
{%- for container in NODE_CONTAINERS %}
{%- set IP = DOCKER.containers[container].ip %}
{%- if DOCKER.containers[container].port_bindings is defined %}
{%- for binding in DOCKER.containers[container].port_bindings %}
{#- cant split int so we convert to string #}
{%- set binding = binding|string %}
{#- split the port binding by /. if proto not specified, default is tcp #}
{%- set binding_split = binding.split('/') %}
{%- if binding_split | length > 1 %}
{%- set proto = binding_split[1] %}
{%- else %}
{%- set proto = 'tcp' %}
{%- endif %}
{%- set bsa = binding_split[0].split(':') %}
{%- set bindip = '' %}
{%- set hostPort = '' %}
{%- set containerPort = '' %}
{%- if bsa | length == 3 %}
{%- set bindip = bsa[0] %}
{%- set hostPort = bsa[1] %}
{%- set containerPort = bsa[2] %}
{%- endif %}
{%- if bsa | length == 2 %}
{%- set hostPort = bsa[0] %}
{%- set containerPort = bsa[1] %}
{%- endif %}
{%- do PR.append("-A POSTROUTING -s " ~ DOCKER.containers[container].ip ~ "/32 -d " ~ DOCKER.containers[container].ip ~ "/32 -p " ~ proto ~ " -m " ~ proto ~ " --dport " ~ containerPort ~ " -j MASQUERADE") %}
{%- if bindip | length and bindip != '0.0.0.0' %}
{%- do D1.append("-A DOCKER -d " ~ bindip ~ "/32 ! -i sosbridge -p " ~ proto ~ " -m " ~ proto ~ " --dport " ~ hostPort ~ " -j DNAT --to-destination " ~ DOCKER.containers[container].ip ~ ":" ~ containerPort) %}
{%- else %}
{%- do D1.append("-A DOCKER ! -i sosbridge -p " ~ proto ~ " -m " ~ proto ~ " --dport " ~ hostPort ~ " -j DNAT --to-destination " ~ DOCKER.containers[container].ip ~ ":" ~ containerPort) %}
{%- endif %}
{%- do D2.append("-A DOCKER -d " ~ DOCKER.containers[container].ip ~ "/32 ! -i sosbridge -o sosbridge -p " ~ proto ~ " -m " ~ proto ~ " --dport " ~ containerPort ~ " -j ACCEPT") %}
{%- endfor %}
{%- endif %}
{%- endfor %}
*nat *nat
:PREROUTING ACCEPT [0:0] :PREROUTING ACCEPT [0:0]
:INPUT ACCEPT [0:0] :INPUT ACCEPT [0:0]
@@ -11,20 +51,12 @@
-A PREROUTING -m addrtype --dst-type LOCAL -j DOCKER -A PREROUTING -m addrtype --dst-type LOCAL -j DOCKER
-A OUTPUT ! -d 127.0.0.0/8 -m addrtype --dst-type LOCAL -j DOCKER -A OUTPUT ! -d 127.0.0.0/8 -m addrtype --dst-type LOCAL -j DOCKER
-A POSTROUTING -s {{DOCKER.sosrange}} ! -o sosbridge -j MASQUERADE -A POSTROUTING -s {{DOCKER.sosrange}} ! -o sosbridge -j MASQUERADE
{%- for container in NODE_CONTAINERS %} {%- for rule in PR %}
{%- if DOCKER.containers[container].ports is defined %} {{ rule }}
{%- for port, proto in DOCKER.containers[container].ports.items() %}
-A POSTROUTING -s {{DOCKER.containers[container].ip}}/32 -d {{DOCKER.containers[container].ip}}/32 -p {{proto}} -m {{proto}} --dport {{port}} -j MASQUERADE
{%- endfor %}
{%- endif %}
{%- endfor %} {%- endfor %}
-A DOCKER -i sosbridge -j RETURN -A DOCKER -i sosbridge -j RETURN
{%- for container in NODE_CONTAINERS %} {%- for rule in D1 %}
{%- if DOCKER.containers[container].ports is defined %} {{ rule }}
{%- for port, proto in DOCKER.containers[container].ports.items() %}
-A DOCKER ! -i sosbridge -p {{proto}} -m {{proto}} --dport {{port}} -j DNAT --to-destination {{DOCKER.containers[container].ip}}:{{port}}
{%- endfor %}
{%- endif %}
{%- endfor %} {%- endfor %}
COMMIT COMMIT
@@ -71,12 +103,8 @@ COMMIT
-A FORWARD -m conntrack --ctstate RELATED,ESTABLISHED -j ACCEPT -A FORWARD -m conntrack --ctstate RELATED,ESTABLISHED -j ACCEPT
-A OUTPUT -p icmp -m icmp --icmp-type 14 -j DROP -A OUTPUT -p icmp -m icmp --icmp-type 14 -j DROP
{%- for container in NODE_CONTAINERS %} {%- for rule in D2 %}
{%- if DOCKER.containers[container].ports is defined %} {{ rule }}
{%- for port, proto in DOCKER.containers[container].ports.items() %}
-A DOCKER -d {{DOCKER.containers[container].ip}}/32 ! -i sosbridge -o sosbridge -p {{proto}} -m {{proto}} --dport {{port}} -j ACCEPT
{%- endfor %}
{%- endif %}
{%- endfor %} {%- endfor %}
-A DOCKER-ISOLATION-STAGE-1 -i sosbridge ! -o sosbridge -j DOCKER-ISOLATION-STAGE-2 -A DOCKER-ISOLATION-STAGE-1 -i sosbridge ! -o sosbridge -j DOCKER-ISOLATION-STAGE-2