Security Onion web portal getting timed out by accessing using Elastic public ip address in AWS

[slelanchezian]

Installed Security Onion on the CentOS VM instance running in AWS cloud.

The web portal ip is running fine if we try to reach via VM's running on the same subnet.

But if we try to reach the same system via Elastic public IP address from our desktop or laptop, the request is getting timed out.

Kindly help to resolve the same.

Note: The same security onion VM is accessible via RDP / SSH using the public IP address. Only https is not working. All ports are allowed in network security group settings.

[InfosecGoon]

If you're accessing the interface by IP address (as opposed to hostname or FQDN), that's the problem. What comes back when you run this command?

sudo salt-call pillar.get global:url_base

[slelanchezian]

Below was the output.

[centos@ip-10-0-1-99 ~]$ sudo salt-call pillar.get global:url_base
local:
10.0.1.99

[InfosecGoon]

This means that the web console is expecting everyone to access it via https://10.0.1.99, which I assume is reachable from the local subnet but not from the outside world. You can change that option (url_base in /opt/so/saltstack/local/pillar/global.sls) to an FQDN and then update your DNS records or host files accordingly.

More information here:

• https://docs.securityonion.net/en/2.3/url-base.html

[slelanchezian]

Thanks it worked!