Configure port forwarding for auditbeat

fkie-cad · Jan 31, 2025 · 76c7513 · 76c7513
1 parent 5731755
commit 76c7513
Show file tree

Hide file tree

Showing 2 changed files with 6 additions and 0 deletions.
diff --git a/provisioning/ansible/companyrouter_playbook.yml b/provisioning/ansible/companyrouter_playbook.yml
@@ -8,3 +8,4 @@
     - rsyslog_install_ipfire
     - rsyslog_ISO8601
     - rsyslog_forwarding
+    - auditbeat_forwarding
diff --git a/provisioning/ansible/roles/auditbeat_forwarding/tasks/main.yml b/provisioning/ansible/roles/auditbeat_forwarding/tasks/main.yml
@@ -0,0 +1,5 @@
+- name: Configure firewall to allow auditbeat on the DMZ (ORANGE) to communicate with the logserver (GREEN)
+  lineinfile:
+    path: /var/ipfire/firewall/config
+    line: "8,ACCEPT,FORWARDFW,ON,std_net_src,ORANGE,std_net_tgt,GREEN,,TCP,,,ON,,,TGT_PORT,9200,Allow elasticsearch log TCP on port 9200 from ORANGE to GREEN,,,,,,,,,,00:00,00:00,,AUTO,,dnat,,,,,second"
+    state: present