Can't add firewall rule

[ryantxu1]

Version

2.4.60

Installation Method

Other (please provide detail below)

Description

configuration

Installation Type

Standalone

Location

cloud

Hardware Specs

Meets minimum requirements

CPU

8

RAM

32

Storage for /

256

Storage for /nsm

idk

Network Traffic Collection

other (please provide detail below)

Network Traffic Speeds

Less than 1Gbps

Status

Yes, all services on all nodes are running OK

Salt Status

No, there are no failures

Logs

No, there are no additional clues

Detail

Hi! I'm running SO as an ec2 instance connected to a Load Balancer. When I try to access the console I get a 504 gateway time-out error and in the logs I encounter the following:

May 17 16:40:33 securityonion kernel: IPTables-dropped: IN=eth0 OUT=sobridge MAC={} SRC={} DST={} LEN=60 TOS=0x00 PREC=0x00 TTL=254 ID=60058 DF PROTO=TCP SPT=58082 DPT=443 WINDOW=26883 RES=0x00 SYN URGP=0

To fix this, I'd like to add the following firewall rule:

iptables -I DOCKER-USER -i eth0 -p tcp --dport 443 -j ACCEPT

but I can't figure it out in the configuration console, can someone point me in the right direction?

Guidelines

• I have read the discussion guidelines at Read before posting! #1720 and assert that I have followed the guidelines.

[cm-ops]

Have you looked at this? https://docs.securityonion.net/en/2.4/firewall.html#host-firewall You would make changes to the host firewall via SOC.

[petiepooo]

This reminds me of the decades-old cartoon: "Error: cannot connect. See our online forum for help." :p

As OP demonstrates, the firewall is something Linux sysadmins are already familiar with and may prefer to manage themselves. Everything Security Onion adds on top of iptables is yet another thing we have to learn just to effectively manage it. Please do not assume it is easier to use than whatever we're already familiar with and using on our other docker hosts. It would be nice if there were an option where Security Onion does not touch the firewall at all.

I can appreciate the drive to make Security Onion more accessible to beginners. Yet editing a configuration file is often easier, quicker, and scales better. The industry as a whole is moving more towards infrastructure-as-code. Yet it feels like Security Onion, especially v2.4 now, is moving in the opposite direction by forcing everything to be configured by GUI.

Perhaps, a compromise whereby on each page describing a config setting, you could also link to the underlying file that advanced users can edit directly? I've done it; I know it's possible. It's just difficult to find the format and file into which a given setting needs to be written.

[ryantxu1]

Yeah as a follow up @cm-ops , is there a way to turn off SO's firewall completely/permanently? I'm hosting it in an AWS environment that already has a pretty restrictive firewall.

[TOoSmOotH]

Yeah as a follow up @cm-ops , is there a way to turn off SO's firewall completely/permanently? I'm hosting it in an AWS environment that already has a pretty restrictive firewall.

@ryantxu1 There is no way to disable the firewall to manage it directly. There is a bunch of things going on behind the scenes. If you can't get to the GUI you can run the following:

so-firewall includehost analyst <IP ADDRESS>