os_network: external

security_groups:
  - domain_controller
  - file_server
  - wsus_server
  - chocolatey_server
  - user_vms
  - domain_member
  - proxy

remote_group_rules:
# Domain Controllers
  - { direction: "ingress", protocol: "udp", port_min: 53, port_max: 53, group: "domain_controller", remote_group: "domain_member", comment: "DNS UDP"}
  - { direction: "ingress", protocol: "tcp", port_min: 53, port_max: 53, group: "domain_controller", remote_group: "domain_member", comment: "DNS TCP"}
  - { direction: "ingress", protocol: "udp", port_min: 88, port_max: 88, group: "domain_controller", remote_group: "domain_member", comment: "Kerberos authentication UDP"}
  - { direction: "ingress", protocol: "tcp", port_min: 88, port_max: 88, group: "domain_controller", remote_group: "domain_member", comment: "Kerberos authentication TCP"}
  - { direction: "ingress", protocol: "udp", port_min: 389, port_max: 389, group: "domain_controller", remote_group: "domain_member", comment: "LDAP UDP"}
  - { direction: "ingress", protocol: "tcp", port_min: 389, port_max: 389, group: "domain_controller", remote_group: "domain_member", comment: "LDAP TCP"}
  - { direction: "ingress", protocol: "udp", port_min: 464, port_max: 464, group: "domain_controller", remote_group: "domain_member", comment: "Kerberos password change UDP"}
  - { direction: "ingress", protocol: "tcp", port_min: 464, port_max: 464, group: "domain_controller", remote_group: "domain_member", comment: "Kerberos password change TCP"}
  - { direction: "ingress", protocol: "tcp", port_min: 135, port_max: 135,  group: "domain_controller", remote_group: "domain_member", comment: "RPC"}
  - { direction: "ingress", protocol: "udp", port_min: 137, port_max: 138,  group: "domain_controller", remote_group: "domain_member", comment: "NetBIOS"}
  - { direction: "ingress", protocol: "tcp", port_min: 445, port_max: 445, group: "domain_controller", remote_group: "domain_member", comment: "SMB"}
  - { direction: "ingress", protocol: "tcp", port_min: 636, port_max: 636, group: "domain_controller", remote_group: "domain_member", comment: "LDAPS"}
  - { direction: "ingress", protocol: "tcp", port_min: 3268, port_max: 3269, group: "domain_controller", remote_group: "domain_member", comment: "Global catalog"}
  - { direction: "ingress", protocol: "udp", port_min: 123, port_max: 123, group: "domain_controller", remote_group: "domain_member", comment: "W32Time"}
  - { direction: "ingress", protocol: "tcp", port_min: 49152, port_max: 65535, group: "domain_controller", remote_group: "domain_member", comment: "FRS RPC"}
# File servers
  - { direction: "ingress", protocol: "tcp", port_min: 445, port_max: 445, group: "file_server", remote_group: "domain_member", comment: "SMB"} # could be restricted
  - { direction: "ingress", protocol: "tcp", port_min: 135, port_max: 135, group: "file_server", remote_group: "file_server", comment: "RPC for DFS"}
  - { direction: "ingress", protocol: "tcp", port_min: 49152, port_max: 65535, group: "file_server", remote_group: "file_server", comment: "RPC client ports"} 
# WSUS servers
  - { direction: "ingress", protocol: "tcp", port_min: 8530, port_max: 8531, group: "wsus_server", remote_group: "domain_member", comment: "WSUS"}
# Chocolatey servers
  - { direction: "ingress", protocol: "tcp", port_min: 80, port_max: 80, group: "chocolatey_server", remote_group: "domain_member", comment: "Chocolatey HTTP"}
  - { direction: "ingress", protocol: "tcp", port_min: 443, port_max: 443, group: "chocolatey_server", remote_group: "domain_member", comment: "Chocolatey HTTPS"}
  - { direction: "ingress", protocol: "tcp", port_min: 80, port_max: 80, group: "chocolatey_server", remote_group: "proxy", comment: "HTTP from proxy"}

# File servers egress
  - { direction: "egress", protocol: "tcp", port_min: 135, port_max: 135,  group: "file_server", remote_group: "file_server", comment: "RPC"}

# Client egress
  - { direction: "egress", protocol: "udp", port_min: 53, port_max: 53, group: "domain_member", remote_group: "domain_controller", comment: "DNS UDP"}
  - { direction: "egress", protocol: "tcp", port_min: 53, port_max: 53, group: "domain_member", remote_group: "domain_controller", comment: "DNS TCP"}
  - { direction: "egress", protocol: "udp", port_min: 88, port_max: 88, group: "domain_member", remote_group: "domain_controller", comment: "Kerberos authentication UDP"}
  - { direction: "egress", protocol: "tcp", port_min: 88, port_max: 88, group: "domain_member", remote_group: "domain_controller", comment: "Kerberos authentication TCP"}
  - { direction: "egress", protocol: "udp", port_min: 389, port_max: 389, group: "domain_member", remote_group: "domain_controller", comment: "LDAP UDP"}
  - { direction: "egress", protocol: "tcp", port_min: 389, port_max: 389, group: "domain_member", remote_group: "domain_controller", comment: "LDAP TCP"}
  - { direction: "egress", protocol: "udp", port_min: 464, port_max: 464, group: "domain_member", remote_group: "domain_controller", comment: "Kerberos password change UDP"}
  - { direction: "egress", protocol: "tcp", port_min: 464, port_max: 464, group: "domain_member", remote_group: "domain_controller", comment: "Kerberos password change TCP"}
  - { direction: "egress", protocol: "tcp", port_min: 135, port_max: 135,  group: "domain_member", remote_group: "domain_controller", comment: "RPC"}
  - { direction: "egress", protocol: "udp", port_min: 137, port_max: 138,  group: "domain_member", remote_group: "domain_controller", comment: "NetBIOS"}
  - { direction: "egress", protocol: "tcp", port_min: 445, port_max: 445, group: "domain_member", remote_group: "domain_controller", comment: "SMB -> DC"}
  - { direction: "egress", protocol: "tcp", port_min: 445, port_max: 445, group: "domain_member", remote_group: "file_server", comment: "SMB -> FS"}
  - { direction: "egress", protocol: "tcp", port_min: 636, port_max: 636, group: "domain_member", remote_group: "domain_controller", comment: "LDAPS"}
  - { direction: "egress", protocol: "tcp", port_min: 3268, port_max: 3269, group: "domain_member", remote_group: "domain_controller", comment: "Global catalog"}
  - { direction: "egress", protocol: "udp", port_min: 123, port_max: 123, group: "domain_member", remote_group: "domain_controller", comment: "W32Time"}
  - { direction: "egress", protocol: "tcp", port_min: 49152, port_max: 65535, group: "domain_member", remote_group: "domain_controller", comment: "FRS RPC"}
  - { direction: "egress", protocol: "tcp", port_min: 80, port_max: 80, group: "domain_member", remote_group: "chocolatey_server", comment: "Chocolatey HTTP"}
  - { direction: "egress", protocol: "tcp", port_min: 443, port_max: 443, group: "domain_member", remote_group: "chocolatey_server", comment: "Chocolatey HTTPS"}
  - { direction: "egress", protocol: "tcp", port_min: 3128, port_max: 3128, group: "user_vms", remote_group: "proxy", comment: "HTTP proxy"}

  - { direction: "ingress", protocol: "tcp", port_min: 3128, port_max: 3128, group: "proxy", remote_group: "user_vms", comment: "HTTP proxy"}


remote_ip_rules:
# User VMs
  - { direction: "ingress", protocol: "tcp", port_min: 3389, port_max: 3389, group: "user_vms", remote_ip: "0.0.0.0/0", comment: "RDP"}
# File servers
  - { direction: "ingress", protocol: "tcp", port_min: 445, port_max: 445, group: "file_server", remote_ip: "10.24.1.220/32", comment: "SMB os-transfer"}
  - { direction: "ingress", protocol: "tcp", port_min: 445, port_max: 445, group: "file_server", remote_ip: "10.24.2.72/32", comment: "SMB os-transfer01"}

# All Winwdows VMs
  - { direction: "ingress", protocol: "icmp", port_min: -1, port_max: -1, group: "domain_member", remote_ip: "0.0.0.0/0", comment: "Allow ICMP"}
  - { direction: "ingress", protocol: "tcp", port_min: 5985, port_max: 5986, group: "domain_member", remote_ip: "10.24.3.242/32", comment: "WinRM rundeck 3"}
  - { direction: "ingress", protocol: "tcp", port_min: 6556, port_max: 6556, group: "domain_member", remote_ip: "10.24.2.152/32", comment: "CheckMK Agent"}
  - { direction: "egress", protocol: "tcp", port_min: 8000, port_max: 8010, group: "domain_member", remote_ip: "10.24.2.152/32", comment: "CheckMK Agent TLS Registration"}
  - { direction: "egress", protocol: "tcp", port_min: 80, port_max: 80, group: "domain_member", remote_ip: "169.254.169.254", comment: "Openstack metadata"}
  - { direction: "egress", protocol: "udp", port_min: 67, port_max: 67, group: "domain_member", remote_ip: "0.0.0.0/0", comment: "DHCP"}
  - { direction: "egress", protocol: "tcp", port_min: 1688, port_max: 1688, group: "domain_member", remote_ip: "172.16.26.19/32", comment: "Windows Activation"}
  - { direction: "egress", protocol: "tcp", port_min: 1514, port_max: 1515, group: "domain_member", remote_ip: "10.22.10.200/32", comment: "Wawzuh Agent"}
  - { direction: "egress", protocol: "tcp", port_min: 80, port_max: 80, group: "domain_member", remote_ip: "10.24.2.152/32", comment: "Wawzuh Agent"}
# Proxy
  - { direction: "ingress", protocol: "tcp", port_min: 22, port_max: 22, group: "proxy", remote_ip: "10.24.4.71/32", comment: "SSH rundeck 1"}
  - { direction: "ingress", protocol: "tcp", port_min: 22, port_max: 22, group: "proxy", remote_ip: "10.24.3.172/32", comment: "SSH rundeck 2"}
  - { direction: "ingress", protocol: "tcp", port_min: 22, port_max: 22, group: "proxy", remote_ip: "10.24.3.242/32", comment: "SSH rundeck 3"}
  - { direction: "ingress", protocol: "tcp", port_min: 6556, port_max: 6556, group: "proxy", remote_ip: "10.24.2.152/32", comment: "Allow CheckMK"}
  - { direction: "ingress", protocol: "icmp", port_min: -1, port_max: -1, group: "proxy", remote_ip: "10.24.2.152/32", comment: "Allow CheckMK ICMP"}
  - { direction: "ingress", protocol: "icmp", port_min: -1, port_max: -1, group: "domain_member", remote_ip: "10.24.2.152/32", comment: "Allow CheckMK ICMP"}