Modifying Firewall rules to provide Internet Access to T0/T1 #2327

cptanalatriste · 2024-12-03T09:09:10Z

✅ Checklist

You have given your pull request a meaningful title (e.g. Enable foobar integration rather than 515 foobar).
You are targeting the appropriate branch. If you're not certain which one this is, it should be develop.
Your branch is up-to-date with the target branch (it probably was when you started, but it may have changed since then).

🚦 Depends on

⤴️ Summary

The proposed approach adds an extra field to the SRE config file (allow_workspace_internet ) and based on its value does the following: 1) If false , business as usual, 2) if true , we remove all the firewall's application rules, we add a network rule allowing connections to the internet, and remove user_rules DNS server configuration.

🌂 Related issues

Closes #2283

🔬 Tests

jemrobinson · 2024-12-03T09:15:12Z

data_safe_haven/infrastructure/programs/sre/firewall.py

-                    ],
-                ),
-            ],
+            application_rule_collections=self._get_application_rule_collections(props),


I'm not sure we gain much by moving these definitions into a function.

jemrobinson · 2024-12-03T09:24:28Z

tests/infrastructure/programs/sre/test_firewall.py

+class MyMocks(pulumi.runtime.Mocks):
+    def new_resource(self, args: pulumi.runtime.MockResourceArgs):
+        resources = [args.name + "_id", args.inputs]
+        return resources
+
+    def call(self, _: pulumi.runtime.MockCallArgs):
+        return {}
+
+
+# TODO: These breaks many other tests!
+pulumi.runtime.set_mocks(
+    MyMocks(),
+    preview=False,
+)


Luckily, you don't need these :). See the test_application_gateway.py for an example of Pulumi runtime tests without set_mocks.

jemrobinson · 2024-12-03T09:25:13Z

tests/infrastructure/programs/sre/test_firewall.py

+class InternetAccess(Enum):
+    ENABLED = True
+    DISABLED = False


If we need this enum, it's probably useful outside just testing. Should it live in types/enums.py?

craddm

I can deploy an SRE, but can't actually connect to anything. At the moment, literally only traffic from workspaces is allowed. None of the container services can connect to the internet, ~~so a user can't get to the remote desktop gateway, for example~~ I misdescribed that a bit. Guacamole can't talk to the microsoft Auth servers over the internet, so it can't properly log you in.

craddm · 2024-12-05T14:40:34Z

data_safe_haven/infrastructure/programs/sre/firewall.py

+        ] = []
+
+        if props.allow_workspace_internet:
+            application_rule_collections = []


Here you remove all the application rules. I think that the problem is, the way the network rules are subsequently defined, only traffic directly from workspaces is allowed out to the internet. This means the various containers (identity, remote desktop gateway etc) can't communicate with the internet, so you can't get to guacamole to be able to connect to the workspaces.

Not all of the containers actually need internet access, but some do.

craddm · 2024-12-05T14:54:43Z

data_safe_haven/infrastructure/programs/sre/firewall.py

+                            destination_addresses=["*"],
+                            destination_ports=["*"],
+                            name="allow-internet-access",
+                            protocols=[network.AzureFirewallNetworkRuleProtocol.ANY],
                            source_addresses=props.subnet_workspaces_prefixes,


This line defines which source addresses are allowed. At the moment it's just the subnet for workspaces (10.0.2.0/29), whereas the containers are all in 10.0.1.0/29.

I guess there are two options.

Keep most of the application rules (it's just the snapcraft ones we wanted to get rid of)

Modify this line to allow all source addresses

I've also tried fixing this locally (with option 2 from above) but still can't browse to anything from within the SRE.

Internet access is possible: I can ftp to ftp.ubuntu.com from a workspace.

So I think we need to also look at the DNS.
We have a local container that we use for DNS that (among other things) blocks most FQDNs from resolving.

Allowed DNS domains are defined in types.enums.PermittedDomains.

Hi @craddm , thanks for checking into this. Just to check my understanding, when you tested Option 2 did you have all the application rules enabled + the new network rule? Also, changing the DNS container means modifying data_safe_haven/resources/dns_server/AdGuardHome.mustache.yaml?

You might need to slightly change AdGuardHome.mustache.yaml. Currently it forbids everything then allows everything from a specified allowlist. We might need to make the first part configurable as otherwise the rules will be "deny everything" and "allow everything" and I have no idea what that will do!

craddm · 2024-12-11T11:36:57Z

Have tested a fresh deployment with internet access enabled, and can confirm it works!

github-actions · 2024-12-11T16:58:57Z

Coverage report

Click to see where and how coverage changed

File	Statements	Missing	Coverage	Coverage (new stmts)	Lines missing
data_safe_haven/config
config_sections.py
data_safe_haven/infrastructure/common
transformations.py
data_safe_haven/infrastructure/components/wrapped
log_analytics_workspace.py
data_safe_haven/infrastructure/programs/sre
dns_server.py					39, 75
firewall.py
monitoring.py
Project Total

_{This report was generated by python-coverage-comment-action}

cptanalatriste added 5 commits November 29, 2024 15:54

[WIP] Adding an extra flag to config-SRE

2daf019

[WIP] Setting up firewall tests

d0bd20c

[WIP] The component test does not work

7325672

Tests seem to be working

a5a1301

[WIP] My tests break other tests

4ba2d7e

cptanalatriste requested a review from a team as a code owner December 3, 2024 09:09

jemrobinson marked this pull request as draft December 3, 2024 09:12

jemrobinson reviewed Dec 3, 2024

View reviewed changes

cptanalatriste added 4 commits December 4, 2024 16:21

[WIP] Using network rules for allowing internet access

57e5fdc

[WIP] Enable Mocks globally, and fixing tests broken by this

3f469a8

Remove unnecessary white space

c49a227

Merge branch 'develop' into 2283-internet-access-tier0-tier1

4baa8bd

craddm requested changes Dec 5, 2024

View reviewed changes

cptanalatriste added 3 commits December 9, 2024 11:21

Fixing bug

a57a8bb

[WIP] Enabling al sources on the network rule

d1e4f23

Fixing tests, and relaxing DNS rules when internet is allowed

6a0c4d7

Fixing firewall tests

5e46b73

cptanalatriste marked this pull request as ready for review December 11, 2024 17:28

cptanalatriste changed the title ~~[WIP] Modifying Firewall rules to provide Internet Access to T0/T1~~ Modifying Firewall rules to provide Internet Access to T0/T1 Dec 11, 2024

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Modifying Firewall rules to provide Internet Access to T0/T1 #2327

Modifying Firewall rules to provide Internet Access to T0/T1 #2327

cptanalatriste commented Dec 3, 2024 •

edited

Loading

jemrobinson Dec 3, 2024

jemrobinson Dec 3, 2024

jemrobinson Dec 3, 2024

craddm left a comment •

edited

Loading

craddm Dec 5, 2024 •

edited

Loading

craddm Dec 5, 2024

craddm Dec 5, 2024

jemrobinson Dec 5, 2024

cptanalatriste Dec 6, 2024

jemrobinson Dec 6, 2024

craddm commented Dec 11, 2024

github-actions bot commented Dec 11, 2024

Modifying Firewall rules to provide Internet Access to T0/T1 #2327

Are you sure you want to change the base?

Modifying Firewall rules to provide Internet Access to T0/T1 #2327

Conversation

cptanalatriste commented Dec 3, 2024 • edited Loading

✅ Checklist

🚦 Depends on

⤴️ Summary

🌂 Related issues

🔬 Tests

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

craddm left a comment • edited Loading

Choose a reason for hiding this comment

craddm Dec 5, 2024 • edited Loading

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

craddm commented Dec 11, 2024

github-actions bot commented Dec 11, 2024

Coverage report

cptanalatriste commented Dec 3, 2024 •

edited

Loading

craddm left a comment •

edited

Loading

craddm Dec 5, 2024 •

edited

Loading