Wazuh in DMZ

[Roman]

Hello!

By default Wazuh agent requires outbound connectivity to the Wazuh manager. 

Is it possible to reverse it to install wazuh-agent in DMZ?

Do you have workarounds for it, to connect wazuh agent in DMZ?

[Md. Nazmur Sakib]

Hi Roman, You can't reverse the direction. In Wazuh, the agent is always the client and the manager is always the listener: wazuh-agentd initiates the connection to wazuh-remoted, which listens on TCP 1514 (and wazuh-authd on 1515 for enrollment). There's no manager-initiated mode.

Worth knowing up front: you don't need any inbound rule toward the agent.

If the concern is the number of firewall rules from the DMZ, put a TCP proxy in the DMZ and give agents its address. NGINX in stream mode works well, and Wazuh documents the configuration here: https://documentation.wazuh.com/current/user-manual/wazuh-server-cluster/load-balancers.html. Agent-side configuration is on the  page: https://documentation.wazuh.com/current/user-manual/wazuh-server-cluster/agent-connections.html

This collapses many agents into a single source IP and one destination port, but it doesn't change the direction of travel. The proxy still connects outbound to the manager.

One thing to plan for: register agents with IP any (name-based), since they'll all appear to come from the proxy address, and proxy 1515 as well as 1514. Use <protocol>tcp</protocol> on the agents.

Let me know if you need any further information,