# Firewall Configuration Rules

Updated: 2026-06-10

## Overview

Firewall rules for monitoring stack with Wazuh, Dozzle, Beszel, and VPN infrastructure.

---

## monitoring-uber (185.103.167.138)

### Inbound Rules (INPUT)

| Port | Protocol | Source | Purpose | Status |
|------|----------|--------|---------|--------|
| 22 | TCP | Admin IPs | SSH administration | ALLOW |
| 22 | TCP | 185.103.166.119 (prod) | SSH — BLOCKED | **DROP** |
| 22 | TCP | 185.103.166.112 (pre-prod) | SSH — BLOCKED | **DROP** |
| 22 | TCP | 80.96.58.164 (s3) | SSH — BLOCKED | **DROP** |
| 1514 | TCP | 185.103.166.119 | Wazuh agents (prod) | ALLOW |
| 1514 | TCP | 185.103.166.112 | Wazuh agents (pre-prod) | ALLOW |
| 51820 | UDP | Any | WireGuard VPN | ALLOW |
| 443 | TCP | 10.0.0.0/24 | Wazuh Dashboard (VPN) | ALLOW |
| 8080 | TCP | 10.0.0.0/24 | Dozzle logs (VPN) | ALLOW |
| 8090 | TCP | 10.0.0.0/24 | Beszel monitoring (VPN) | ALLOW |
| 9000-9001 | TCP | 10.0.0.0/24 | S3/RustFS (VPN) | ALLOW |

### Outbound Rules (OUTPUT)
- **Default:** ACCEPT (all traffic allowed)
- Allows DNS, updates, internet access

### Forward Rules (FORWARD)
- **Default:** DROP (no transit traffic)

### Persistence
- Rules saved to `/etc/iptables/rules.v4`
- Auto-loaded on boot via `iptables-persistent`

---

## vpn-uber (45.150.111.158)

### Inbound Rules (INPUT)

| Port | Protocol | Source | Purpose | Status |
|------|----------|--------|---------|--------|
| 22 | TCP | Any | SSH administration | ALLOW |
| 51820 | UDP | Any | WireGuard VPN | ALLOW |
| 10001 | TCP | 10.0.0.0/24 | Beszel agent (from VPN only) | ALLOW |

### Outbound Rules (OUTPUT)
- **Default:** ACCEPT (all traffic allowed)

### Forward Rules (FORWARD)
- **Default:** ACCEPT
- Enables routing: wg0 ↔ eth0 (VPN ↔ Internet)
- ESTABLISHED/RELATED always allowed

### Network Features
- NAT masquerade: `eth0` (POSTROUTING)
- IP forwarding: enabled (`net.ipv4.ip_forward=1`)
- Allows VPN clients to reach internet through VPN server

### Persistence
- Rules saved to `/etc/iptables/rules.v4`
- IP forwarding saved to `/etc/sysctl.conf`

---

## Security Hardening

### Principle: Least Privilege
1. **SSH restrictions**: Production servers (prod, pre-prod, s3) **cannot** SSH into monitoring-uber
   - Prevents lateral movement if a prod server is compromised
   - Admins must SSH directly to monitoring-uber or via VPN

2. **Service isolation**: All user-facing services (Wazuh, Dozzle, Beszel) accessible **only via VPN**
   - Not exposed to public internet
   - Network: 10.0.0.0/24 (private VPN)

3. **Port whitelist**: Only required ports open
   - Wazuh agent ingest: 1514/tcp (prod/pre-prod only)
   - VPN: 51820/udp (all)
   - SSH: 22/tcp (admin access, blocked from prod servers)
   - Monitoring agents: 10001/tcp (VPN only)

### Attack Surface Reduction
- Production agents cannot access monitoring infrastructure
- Monitoring dashboard only accessible via VPN
- No exposed dashboards or logs to public internet
- SSH brute-force: limited by rate (ESTABLISHED/RELATED state tracking)

---

## Updating Rules

### monitoring-uber
```bash
ssh root@185.103.167.138
./firewall-monitoring-uber.sh
```

### vpn-uber
```bash
ssh root@45.150.111.158
./firewall-vpn-server.sh
```

### Verify Rules Applied
```bash
# Check current rules
iptables -L INPUT -n
iptables -L FORWARD -n

# Check saved rules
cat /etc/iptables/rules.v4
```

### Restore Rules on Boot
Rules are automatically restored via `/etc/iptables/rules.v4` if `iptables-persistent` is installed:
```bash
apt-get install iptables-persistent
```

---

## Beszel Agent Configuration

Beszel agents installed on all infrastructure servers:

| Server | Type | Port | Access |
|--------|------|------|--------|
| prod-uber | Docker | 10001 | Public IP (185.103.166.119:10001) |
| pre-prod-uber | Docker | 10001 | Public IP (185.103.166.112:10001) |
| s3-uber | Docker | 10001 | Public IP (80.96.58.164:10001) |
| vpn-uber | Binarie (systemd) | 10001 | VPN IP (10.0.0.1:10001) |

**Note:** vpn-uber agent is accessible **only from VPN** due to firewall rules.

---

## Troubleshooting

### Service not reachable
```bash
# Check if service is listening
ss -tlnp | grep <port>

# Check firewall allows traffic
iptables -L INPUT -n | grep <port>

# Test connectivity
nc -zv <ip> <port>
```

### SSH access denied from prod
- Expected behavior (security hardening)
- Use admin SSH keys or SSH via VPN instead

### Beszel agent shows offline
- Check agent is listening: `ss -tlnp | grep 10001`
- Check firewall allows Beszel dashboard to reach agent
- Verify network routing between monitoring-uber and agent server