Seconion so-allow not opening ports in firewall

[chris izatt]

I have a new fully updated server.
I ran so-allow and set it to a then used 0.0.0.0

That does not open the ports in the ufw checked with nmap.

If i run

sudo ufw allow 443/tcp

then 443 is opened correctly.

[Wes Lambert]

Chris,

Could you please clarify exactly the steps you took?

Are you trying to allow just port 443 from anywhere to your machine?

Thanks,

Wes

--
Follow Security Onion on Twitter!
https://twitter.com/securityonion
---
You received this message because you are subscribed to the Google Groups "security-onion" group.
To unsubscribe from this group and stop receiving emails from it, send an email to security-onion+unsubscribe@googlegroups.com.
To post to this group, send email to security-onion@googlegroups.com.
Visit this group at https://groups.google.com/group/security-onion.
For more options, visit https://groups.google.com/d/optout.

[chris izatt]

I tried 0.0.0.0 and 10.0.0.0 neither worked with the so-allow script using -a.

On Wednesday, September 6, 2017 at 10:18:07 AM UTC-5, Wes wrote:
> Chris,
>
>
> Could you please clarify exactly the steps you took?
>
>
> Are you trying to allow just port 443 from anywhere to your machine?
>
>
> Thanks,
> Wes
>
>
> On Wed, Sep 6, 2017 at 10:40 AM, chris izatt <cw.i...@gmail.com> wrote:
> I have a new fully updated server.
>
> I ran so-allow and set it to a then used 0.0.0.0
>
>
>
> That does not open the ports in the ufw checked with nmap.
>
>
>
> If i run
>
>
>
> sudo ufw allow 443/tcp
>
>
>
> then 443 is opened correctly.
>
>
>
> --
>
> Follow Security Onion on Twitter!
>
> https://twitter.com/securityonion
>
> ---
>
> You received this message because you are subscribed to the Google Groups "security-onion" group.
>

> To unsubscribe from this group and stop receiving emails from it, send an email to security-onio...@googlegroups.com.
>
> To post to this group, send email to securit...@googlegroups.com.

[Wes Lambert]

Chris,

so-allow does not currently support CIDR notation or allowing network ranges, however, invoking ufw directly does:

Ex. sudo ufw allow from 10.0.0.0/24 to any port 443

Is there any reason you want to open this port up to so many addresses?

Thanks,

Wes

To unsubscribe from this group and stop receiving emails from it, send an email to security-onion+unsubscribe@googlegroups.com.
To post to this group, send email to security-onion@googlegroups.com.

[chris izatt]

ahh no cidr gotcha. We are just in the building phase i will reduce it back down.