Firewall Rules

• Overview
  • Properties
  • Subnet Placeholder
• Global
• Local
• Inbuilt
  • List

Overview

The firewall object allows you to define inbound and outbound rules on your Network Security Groups. You can define the rules in two ways: globally and locally.

In general the firewall object looks as follows, with inner inbound and outbound array objects:

"firewall": {
    "inbound": [
        {
            "name": "RDP",
            "priority": 4095,
            "source": "*:*",
            "destination": "@{subnet}:3389",
            "access": "Allow"
        }
    ],
    "outbound": [
        {
            "name": "HTTPS",
            "priority": 4094,
            "source": "@{subnet}:*",
            "destination": "*:443",
            "access": "Allow"
        }
    ]
}

The priority values must be between 100 and 4095. 3500-4000 are reserved for inbuilt Fogg rules, so try and avoid those priorities as well

Properties

Below are the properties that are used in defining the the inbound and outbound objects of the firewall object - both globally and locally

Name	Type	Required	Description
access	string	yes	Whether you want the rule to Allow or Deny
destination	string	yes	This is the IP/CIDR and port destination address for the rule
name	string	yes	The name the rule with have within the NSG. The name should be unique for the in/outbound type
priority	int	yes	The priority of the rule in the NSG. Must be between 100-4095. 3500-4000 are reserved for inbuilt rules, try and avoid those priority values
source	string	yes	This is the IP/CIDR and port source address for the rule

Subnet Placeholders

Above you will have also realised the @{subnet} placeholder tag. Using this placeholder within the source and destination values will cause it to be replaced with the CIDR of the current VM template. So if in your Foggfile you gave the VM template web a CIDR of 10.10.1.0/24, then @{subnet} will be replaced with 10.10.1.0/24.

Furthermore, you can also specify which subnet to use via @{subnet|file}. This will allow you to reference the file VM template CIDR within another VM template object.

Using the @{subnet} placeholder in the global firewall object will be replaced by whatever the current VM template that is being deployed

Global

The global firewall rules will apply to every VM within the template. So if you want HTTPS allowed outbound on all VMs, allow it here to save duplicated rule logic everywhere!

The global firewall rules are defined in the "firewall" object at the root of the JSON object - similar to the main template, provisioners and os objects:

{
    "template": [ ],
    "provisioners": { },
    "firewall": {
        "inbound": [ ],
        "outbound": [ ]
    }
}

Local

Local firewall rules are defined against a VM within the template. Defining firewall rules here will only apply to that VM - so if you Allow RDP inbound on a VM locally, it will not apply to the other VMs.

The local firewall block is within a VM template object:

{
    "template": [
        {
            "tag": "example",
            "type": "vm",
            "firewall": {
                "inbound": [ ],
                "outbound": [ ]
            }
        }
    ]
}

Inbuilt

Fogg comes with some inbuilt firewall rules for speed and smaller templates - because having to type out the above in/outbound rules each time can be a pain!

When using the inbuilt rules, the in/outbound addresses for source and destinations are as follows:

• inbound

  • source: The CIDR will be any (* / 0.0.0.0/0)
  • destination: The CIDR will be the current VM template subnet mask, ie @{subnet}

• outbound

  • source: The CIDR will be the current VM template subnet mask, ie @{subnet}
  • destination: The CIDR will be any (* / 0.0.0.0/0)

The inbuilt ports will use fixed priorities between 3500-4000; so try to avoid these values in normal rules.

Example

An example of using the inbuit rules is as follows:

"firewall": {
    "http": true,
    "https|in": true,
    "rdp|both": false,
    "smtp|out": true
}

Specifing true will Allow the rule, and false will Deny it. To define inbound rules you can either specify the |in clause, or just use the name of the port as inbound is default (like with http above). The |out clause is for outbound rules, and |both will define both inbound and outbound.

The List

And finally, here is the list of all inbuilt port rules:

Name	Port Range	Description
ftp	20-21	FTP port range
ssh	22	SSH port
smtp	25	SMTP port for email
http	80	HTTP port for web traffic
sftp	115	SFTP port
https	443	HTTPS port for SSL web traffic
smb	445	SMB port
ftps	989-990	FTPS port range
sql	1433-1434	SQL Server management port range
mysql	3306	MySQL port
rdp	3389	RDP port for Windows
svn	3690	SVN port
sql-mirror	5022-5023	SQL Server mirroring port range
postgresql	5432	PostgreSQL port
winrm	5985-5986	WinRM port range
redis	6379	REDIS port
puppet	8139-8140	Puppet port range
git	9418	Git port
octopus	10933	Octopus Tentacle port