Runbook: Regole Firewall

Controllo degli accessi al Data Gateway a livello di rete.

PowerShell (come Admin):

# Entrata: Permettere HTTPS
New-NetFirewallRule -DisplayName "Data Gateway HTTPS" `
    -Direction Inbound -Action Allow -Protocol TCP -LocalPort 443
 
# Entrata: Solo da IP specifici
New-NetFirewallRule -DisplayName "Data Gateway HTTPS Restricted" `
    -Direction Inbound -Action Allow -Protocol TCP -LocalPort 443 `
    -RemoteAddress "10.0.0.0/8","192.168.0.0/16"
 
# Uscita: Permettere SQL Server
New-NetFirewallRule -DisplayName "Data Gateway to SQL Server" `
    -Direction Outbound -Action Allow -Protocol TCP -RemotePort 1433
 
# Elencare regole
Get-NetFirewallRule -DisplayName "Data Gateway*" | Format-Table Name, Enabled, Direction, Action
 
# Rimuovere regola
Remove-NetFirewallRule -DisplayName "Data Gateway HTTPS"

# Aprire porta HTTPS
sudo firewall-cmd --permanent --add-port=443/tcp
 
# Solo da rete specifica
sudo firewall-cmd --permanent --add-rich-rule='
    rule family="ipv4"
    source address="10.0.0.0/8"
    port protocol="tcp" port="443"
    accept'
 
# Applicare modifiche
sudo firewall-cmd --reload
 
# Mostrare regole
sudo firewall-cmd --list-all
 
# Rimuovere regola
sudo firewall-cmd --permanent --remove-port=443/tcp
sudo firewall-cmd --reload

# Permettere HTTPS
sudo ufw allow 443/tcp
 
# Da rete specifica
sudo ufw allow from 10.0.0.0/8 to any port 443 proto tcp
 
# Mostrare stato
sudo ufw status verbose
 
# Rimuovere regola
sudo ufw delete allow 443/tcp

# Permettere HTTPS
sudo iptables -A INPUT -p tcp --dport 443 -j ACCEPT
 
# Solo da rete specifica
sudo iptables -A INPUT -p tcp --dport 443 -s 10.0.0.0/8 -j ACCEPT
sudo iptables -A INPUT -p tcp --dport 443 -j DROP
 
# Salvare regole
sudo iptables-save > /etc/iptables/rules.v4
 
# Mostrare regole
sudo iptables -L -n --line-numbers
 
# Rimuovere regola (per numero)
sudo iptables -D INPUT 3

# Creare Security Group
aws ec2 create-security-group \
    --group-name gateway-sg \
    --description "Data Gateway Security Group" \
    --vpc-id vpc-12345678
 
# HTTPS da ovunque
aws ec2 authorize-security-group-ingress \
    --group-id sg-12345678 \
    --protocol tcp \
    --port 443 \
    --cidr 0.0.0.0/0
 
# HTTPS solo da VPN
aws ec2 authorize-security-group-ingress \
    --group-id sg-12345678 \
    --protocol tcp \
    --port 443 \
    --cidr 10.0.0.0/8

# Creare NSG
az network nsg create \
    --resource-group rg-gateway \
    --name gateway-nsg
 
# Regola HTTPS
az network nsg rule create \
    --resource-group rg-gateway \
    --nsg-name gateway-nsg \
    --name AllowHTTPS \
    --priority 100 \
    --direction Inbound \
    --access Allow \
    --protocol Tcp \
    --destination-port-ranges 443 \
    --source-address-prefixes '10.0.0.0/8'

Alternativa al Firewall: Filtrare nell'applicazione.

appsettings.json:

{
  "Security": {
    "AllowedIPs": [
      "10.0.0.0/8",
      "192.168.0.0/16",
      "172.16.0.0/12"
    ]
  }
}

# Locale
curl https://localhost/health
 
# Dalla rete autorizzata
curl https://gateway.example.com/health
 
# Dall'esterno (dovrebbe essere bloccato)
curl --connect-timeout 5 https://gateway.example.com/health
# Atteso: Connection refused o Timeout

• Configurare TLS - Attivare HTTPS
• Kubernetes - NetworkPolicies
• Alerting - Monitoraggio connessioni

« <- Rinnovare certificato | -> Panoramica Operatore »

Wolfgang van der Stille @ EMSR DATA d.o.o. - Data Gateway Professional