so-firewall not opening port.

[zaphode]

I am just trying to open a single port, I read the docs but may be doing something wrong.

so-firewall addhostgroup WAZUH_AGENT_DIST
so-firewall includehost WAZUH_AGENT_DIST 192.168.1.0/24
so-firewall addportgroup WAZUH_AGENT_DIST
so-firewall addport WAZUH_AGENT_DIST tcp 20000
salt securityonion_stanalone state.apply firewall

The host group is showing up in the '/opt/so/saltstack/local/salt/firewall/hostgroups.local.yaml' and the
portgoup is showing up in the '/opt/so/saltstack/local/salt/firewall/portgroups.local.yaml'

Am I missing something, nothing I do seems to work

[weslambert]

Have you tried the following in the local minion sls?

firewall:
  assigned_hostgroups:
    chain:
      DOCKER-USER:
        hostgroups:
          WAZUH_AGENT_DIST:
            portgroups:
              - portgroups.WAZUH_AGENT_DIST

Also, is there any reason you are trying to use this port in particular?

[zaphode]

Thanks for the tip! I forgot the 'portgroups.' before WAZUH_AGENT_DIST. Also I had to change the chain: to INPUT it did not work with DOCKER-USER for some reason.

This worked:

### Create the host group
so-firewall addhostgroup WAZUH_AGENT_DIST
### Add hosts to hostgroup
so-firewall includehost WAZUH_AGENT_DIST 192.168.1.0/24
### Add port group
so-firewall addportgroup WAZUH_AGENT_DIST
### Add port to port group
so-firewall addport WAZUH_AGENT_DIST tcp 20000

### Edit the .sls file
nano /opt/so/saltstack/local/pillar/minions/ securityonion_stanalone.sls

firewall:
  assigned_hostgroups:
    chain:
      DOCKER-USER:
        hostgroups:
          WAZUH_AGENT_DIST:
            portgroups:
              - portgroups.WAZUH_AGENT_DIST

### Apply rule
salt securityonion_stanalone state.apply firewall

[zaphode]

No reason for that specific port, just using it to distribute Wazuh agent installers in a test network.
sudo python3 -m http.server 20000