Project

General

Profile

Actions

Feature #7701

open

firewall: configurable default policies

Added by Victor Julien 11 months ago. Updated 10 days ago.

Status:
Feedback
Priority:
Normal
Assignee:
Target version:
Effort:
Difficulty:
Label:

Description

For discussion. There are 2 ideas here:
1. allow different actions than plain drop: e.g. reject.
2. allow default accept:hook hooks so we can insert new hooks w/o breaking existing rulesets

Also, so far it seems like the request_started/response_started hooks would most likely fit a default accept:hook as well.


Related issues 3 (1 open2 closed)

Related to Suricata - Story #7583: 9.0.0: usecase: improve firewall usecaseAssignedVictor JulienActions
Has duplicate Suricata - Feature #8203: firewall: add configuration option for a reject default action.RejectedVictor JulienActions
Has duplicate Suricata - Feature #8281: Add reject as a default action for firewall modeRejectedActions
Actions #1

Updated by Victor Julien 8 months ago

  • Related to Story #7583: 9.0.0: usecase: improve firewall usecase added
Actions #2

Updated by Victor Julien 2 months ago

  • Has duplicate Feature #8203: firewall: add configuration option for a reject default action. added
Actions #3

Updated by Victor Julien about 1 month ago

  • Has duplicate Feature #8281: Add reject as a default action for firewall mode added
Actions #4

Updated by Jamie Lavigne 10 days ago

It kind of combines 1 and 2, but allowing a default action of accept:hook combined with visibility into what the default action matches would be very valuable for testing new rulesets in a non-destructive way before enabling enforcement.

Inserting a firewall into an existing environment is a potentially dangerous operation if it ends up blocking traffic unintentionally. The two ideas above would allow a user to first configure the firewall in a way that evaluates rules and tells you what it would block but does not take any blocking action, so the user can validate the ruleset before switching the default action to blocking.

Actions

Also available in: Atom PDF