Changing firewall rules

Posted on February 28, 2014 Updated on February 28, 2014

By the original QRadar configuration, all the appliances comes with a pre-configured firewall rules in the OS. For testing purposes we can simple deactivate the firewall using the command “service iptables stop” (to stop the firewall) and “service iptables start” (to turn it back). But sometimes we need to update the firewall configuration aiming permanent changes.

In order to change firewall rules on your appliance you need to follow the below steps:

• Connect through SSH to the appliance that you want to make modifications;
• Login using ‘root’ account;
• Edit one of the following files:
  • /opt/qradar/conf/iptables.pre
  • /opt/qradar/conf/iptables.post
  • /opt/qradar/conf/iptables-nat.post
• Add your firewall rules in the file, for example:
  • -A INPUT -i eth0 -s x.x.x.x -j ACCEPT
• Save the file with the ‘ :wq ‘;
• Run /opt/qradar/bin/iptables_update.pl so your changes take effect;

With those steps your firewall configuration is now changed and will persist even in rebooting cases.