IP tables not updating on master

[wildlyunder]

Hi,

When I run:

sudo salt _ state.apply firewall

The command appends to the iptable rather than updateing. Which can cause issues..

Such as if I add an IP to portgroup:all then change IP portgroup to portgroup:syslog; it doesn't remove the allow all from the iptable. That means the IP still has access to all ports on the master.

How can I prevent this from happening and regenerate the iptable each time the command is ran.

[dougburks]

Have you reviewed our Firewall documentation?
https://docs.securityonion.net/en/2.3/firewall.html#removing-a-host-or-network

[wildlyunder]

Yes, that's what I've been using. When I remove the IP from a host group and run salt the IP is still in the iptable.

Does the remove excludehost work on custom hostgroups?

[dougburks]

Does the remove excludehost work on custom hostgroups?

Have you tried it?