Understanding Iptables and Docker

[brandenwagner]

I am up and running on SO with moderate success (all of my issues are me...). One thing I would like to add to my sensor node is a container with Nessus network monitor running. i have this running in my test vm with iptables off... and it works of course.

But Im looking at the iptables for my prod sensor node.. and I dont really understand what im looking at. If I try to curl from my desktop the connection is refused. If i curl from the sensor node (localhost) it does return what i expect. So im back to Ip I thought adding this would allow communication on port 8835
iptables -A INPUT -p tcp --dport 8835 -j ACCEPT

So why wouldnt that allow communication on that port?

[macleodit]

Read here: https://docs.securityonion.net/en/2.3/so-allow.html?highlight=so-allow#so-allow

And here: https://docs.securityonion.net/en/2.3/firewall.html?highlight=firewall#firewall

See if this helps

[brandenwagner]

So-allow wont help since im trying to use a port outside of the SO ecosystem. Unless I still dont understand how so-allow works

as for so-firewall thanks! i somehow missed that when looking through the docs, but it didnt help.

so-firewall addportgroup nnm
so-firewall addport nnm tcp 8835
so-firewall addport nnm udp 8835

Then I edit the minions/_sensor.sls file:

firewall:
  assigned_hostgroups:
    chain:
      DOCKER-USER:
        hostgroups:
          sensor:
            portgroups:
              - portgroups.nnm

and then run salt-call state.apply firewall
logged into the sensor, i can see the new rules have been applied
but then from my workstation running curl, the connection is refused, and from the /var/log/kern.log file on the sensor I see iptables still dropped the connection.