Skip to content

Commit ab079dc

Browse files
MichaelGrafnetterMichaelGrafnetter
committed
Semperis custom rules
1 parent 985612e commit ab079dc

File tree

1 file changed

+132
-0
lines changed

1 file changed

+132
-0
lines changed

‎ADDS/DCFWTool/CustomRules.Semperis.ps1‎

Lines changed: 132 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,132 @@
1+
<#
2+
.SYNOPSIS
3+
Sample script that adds Semperis Active Directory Forest Recovery (ADFR)
4+
and Semperis Directory Services Protector (DSP) domain controller agent firewall rules to a pre-existing GPO session.
5+
6+
.DESCRIPTION
7+
This is a sample script. Always perform review and testing before applying any firewall rules in a production environment.
8+
9+
Also keep in mind that this script only targets DCs, so management server and distribution point-specific rules are not included.
10+
11+
This script is not intended to be run directly. Instead, its relative path should be specified in the Set-ADDSFirewallPolicy.json configuration file.
12+
It is then executed by the main Set-ADDSFirewallPolicy.ps1 script.
13+
14+
.PARAMETER GPOSession
15+
Specifies the network GPO session in which the rules are to be created.
16+
To load a GPO Session, use the Open-NetGPO cmdlet.
17+
To save a GPO Session, use the Save-NetGPO cmdlet.
18+
19+
.PARAMETER DomainControllerAddresses
20+
List of domain controller IP addresses, between which replication traffic should be allowed.
21+
22+
.PARAMETER RemoteManagementAddresses
23+
List of IP addresses from which inbound management traffic should be allowed.
24+
25+
IP addresses of Semperis Semperis DSP and ADFR management servers and distribution points
26+
must be added to this list using the JSON configuration file.
27+
28+
.PARAMETER AllAddresses
29+
List of client IP adresses from which inbound traffic should be allowed.
30+
This list should automatically include the IP addresses of Semperis Semperis DSP and ADFR management servers and distribution points.
31+
32+
.NOTES
33+
Author: Michael Grafnetter
34+
Version: 1.0
35+
36+
#>
37+
38+
#Requires -Modules NetSecurity
39+
#Requires -Version 5
40+
41+
[CmdletBinding()]
42+
param(
43+
[Parameter(Mandatory = $true)]
44+
[string] $GPOSession,
45+
46+
[ValidateNotNullOrEmpty()]
47+
[string[]] $DomainControllerAddresses = @('Any'),
48+
49+
[ValidateNotNullOrEmpty()]
50+
[string[]] $RemoteManagementAddresses = @('Any'),
51+
52+
[ValidateNotNullOrEmpty()]
53+
[string[]] $AllAddresses = @('Any')
54+
)
55+
56+
# Not all cmdlets inherit the -Verbose parameter, so we need to explicitly override it.
57+
[bool] $isVerbose = $VerbosePreference -eq [System.Management.Automation.ActionPreference]::Continue
58+
59+
#region Semperis ADFR
60+
61+
# Create Inbound rule "Semperis ADFR Agent (TCP-In)"
62+
# Purpose: AD forest backup and recovery orchestration
63+
New-NetFirewallRule -GPOSession $GPOSession `
64+
-Name 'Semperis-ADFR-Agent-TCP-In' `
65+
-Group 'Semperis Agents' `
66+
-DisplayName 'Semperis ADFR Agent (TCP-In)' `
67+
-Description 'Inbound rule for Semperis ADFR Agent [TCP 8753]' `
68+
-Enabled True `
69+
-Profile Any `
70+
-Direction Inbound `
71+
-Action Allow `
72+
-Protocol TCP `
73+
-LocalPort 8753 `
74+
-RemoteAddress $RemoteManagementAddresses `
75+
-Program '%ProgramFiles%\Semperis\ADFR\Semperis.ForestRecoveryAgentSvcHost.exe' `
76+
-Verbose:$isVerbose > $null
77+
78+
# Create Inbound rule "Semperis ADFR Agent File Transfer (TCP-In)"
79+
# Purpose: ADFR backup file transfer
80+
New-NetFirewallRule -GPOSession $GPOSession `
81+
-Name 'Semperis-ADFR-Agent-Transfer-TCP-In' `
82+
-Group 'Semperis Agents' `
83+
-DisplayName 'Semperis ADFR Agent File Transfer (TCP-In)' `
84+
-Description 'Inbound rule for Semperis ADFR Agent File Transfer [TCP 8770]' `
85+
-Enabled True `
86+
-Profile Any `
87+
-Direction Inbound `
88+
-Action Allow `
89+
-Protocol TCP `
90+
-LocalPort 8770 `
91+
-RemoteAddress $RemoteManagementAddresses `
92+
-Program '%ProgramFiles%\Semperis\ADFR\Semperis.ForestRecoveryAgentSvcHost.exe' `
93+
-Verbose:$isVerbose > $null
94+
95+
#endregion Semperis ADFR
96+
#region Semperis DSP
97+
98+
# Create Inbound rule "Semperis ADSM Agent (TCP-In)"
99+
# Purpose: AD change monitoring and restore
100+
New-NetFirewallRule -GPOSession $GPOSession `
101+
-Name 'Semperis-ADSM-Agent-TCP-In' `
102+
-Group 'Semperis Agents' `
103+
-DisplayName 'Semperis ADSM Agent (TCP-In)' `
104+
-Description 'Inbound rule for Semperis ADSM Agent [TCP 8750]' `
105+
-Enabled True `
106+
-Profile Any `
107+
-Direction Inbound `
108+
-Action Allow `
109+
-Protocol TCP `
110+
-LocalPort 8750 `
111+
-RemoteAddress $RemoteManagementAddresses `
112+
-Program '%ProgramFiles%\Semperis\ADSM\Semperis.ExecuterSvcHost.exe' `
113+
-Verbose:$isVerbose > $null
114+
115+
# Create Inbound rule "Semperis ADSM Agent File Transfer (TCP-In)"
116+
# Purpose: File transfer for GPO backup and restore
117+
New-NetFirewallRule -GPOSession $GPOSession `
118+
-Name 'Semperis-ADSM-Agent-Transfer-TCP-In' `
119+
-Group 'Semperis Agents' `
120+
-DisplayName 'Semperis ADSM Agent File Transfer (TCP-In)' `
121+
-Description 'Inbound rule for Semperis ADSM Agent File Transfer [TCP 8772]' `
122+
-Enabled True `
123+
-Profile Any `
124+
-Direction Inbound `
125+
-Action Allow `
126+
-Protocol TCP `
127+
-LocalPort 8772 `
128+
-RemoteAddress $RemoteManagementAddresses `
129+
-Program '%ProgramFiles%\Semperis\ADSM\Semperis.ExecuterSvcHost.exe' `
130+
-Verbose:$isVerbose > $null
131+
132+
#endregion Semperis DSP

0 commit comments

Comments
 (0)