UNPKG

@richkang/cdk-construct-network-firewall-textfile-rules

Version:

A simple AWS VPC Firewall with one stateless rule and one stateful rule to meet the AWS Config Network Firewall Conformance.

github.com/kangks/cdk-constructs/tree/main

kangks/cdk-constructs

16 lines (14 loc) • 1.56 kB
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
##################################################################################################################### # List of Suricata compatible Intrusion prevention system (IPS) rules. # # Suricata is an open source network IPS that includes a standard rule-based language for traffic inspection. # # Please refer for https://suricata.readthedocs.io/en/suricata-6.0.2/rules/intro.html Suricata rule syntax. # # Invalid rule syntax will cause LZA pipeline failure, please review rule syntax of each line before using. # # This file can have one rule definition per line. # A line starts with suricata supported action types (alert, pass, drop, reject, rejectsrc, rejectdst, rejectboth) # # are considered to be rule entry. # ##################################################################################################################### pass ip 10.1.0.0/16 any -> 10.0.0.0/16 any (sid:100;) drop ip any any <> any any (sid:101;) alert tcp any any -> 1.1.1.1/32 80 (sid:102;msg:"example message";) drop tls $HOME_NET any -> $EXTERNAL_NET any (tls.sni; content:"example.com"; startswith; nocase; endswith; msg:"matching TLS denylisted FQDNs"; priority:1; flow:to_server, established; sid:103; rev:1;) drop http $HOME_NET any -> $EXTERNAL_NET any (http.host; content:"example.com"; startswith; endswith; msg:"matching HTTP denylisted FQDNs"; priority:1; flow:to_server, established; sid:104; rev:1;)