Updating the Firewall docs page

[petehalatsis]

The Firewall docs page needs updates to be more clear. Terms such as all nodes, cluster nodes, fleet nodes, etc should be clearly defined and it could be presented in an easier way. I suggest a table format.

https://docs.securityonion.net/en/2.4/firewall.html#node-communication

This may be incorrect but here is an example:

Source (SRC)	Destination (DST)	Service/Port	Description
All SecOnion Nodes	Manager	443, 5000, 8086, 4505, 4506, 8220, 8443, 5055	Management, Registry, Salt, Updates
All Elastic Agents	Manager	8220, 8443, 5055	Elastic Agent management, binary updates, data
All SecOnion Nodes	Fleet	8220, 5055	Elastic Agent Management
All SecOnion Nodes	Receiver	5055	Elastic Agent Data Ingest
Fleet	Receiver	5056	Logstash-to-Logstash (Data)
Fleet	Manager	5056, 9200	Elasticsearch Node-to-Node
Manager	IDH	2222	SSH for management

[dougburks]

Hi @petehalatsis

I've updated the page in the dev branch:
https://docs.securityonion.net/en/dev/firewall.html#node-communication

Please take a look and let us know whether or not that addresses your concerns.

[petehalatsis]

Much clearer! Thank you