EDR: How to Enable Firewalld Rejection Messages to Confirm Local Server Firewall is not Blocking Expected IP's

[#1]

Environment

• EDR: All Versions
• Linux: CentOS 7/8
• Linux: RHEL 7/8

Objective

How to enable deny messages in firewalld to confirm expected IP's are not being blocked at the local firewall level

Resolution

1. Enable the capture of all denied messages

   sudo firewall-cmd --set-log-denied=all

2. Confirm it's set

   sudo firewall-cmd --get-log-denied

3. Attempt the connection to the server
4. View the information to see if it is being rejected. 

   dmesg | egrep -i 'REJECT|DROP'

5. If the expected source ip is not seen in the rejections
   1. Confirm the IP is not being blocked at Nginx level filtering: EDR: How to Manually Check or Edit the NGINX IP Filter List
   2. The issue is in between the source and the EDR server. Most likely a firewall in between. Please reach out to your network administrator for troubleshooting

Additional Notes

• Example message of a Denied packet from firewalld

[87192.075367] FINAL_REJECT: IN=ens33 OUT= MAC=ff:ff:ff:ff:ff:ff:00:50:56:c0:00:08:08:00 SRC=192.168.222.1 DST=192.168.222.255 LEN=78 TOS=0x00 PREC=0x00 TTL=128 ID=30066 PROTO=UDP SPT=137 DPT=137 LEN=58

• This is used to confirm the ability to contact the server from sensor or webui. Often seen as rejects or timeouts by the source

To write these to a different log location for tracking

1. Create a new file called /etc/rsyslog.d/firewall-drop.conf
2. Add the following into the file

   :msg,contains,"_DROP" /var/log/firewalld-drop.log
   :msg,contains,"_REJECT" /var/log/firewalld-drop.log
   & stop

3. Restart the service to take affect

   sudo systemctl restart rsyslog

4. Drops will be written to /var/log/firewalld-drop.log

Related Content

https://www.redhat.com/sysadmin/beginners-guide-firewalld