Question about configuring SO,

[killmasta93]

Hi
I was wondering if someone could shed some light on the issue im having, I have been trying to configure SO, in my proxmox environment, but i read many guides and im a bit confused,
as currently i have proxmox, and virtualized 2 vms, one SO, and another pfsense,
while this guide does not use OVS https://www.kimobu.space/posts/Security-Onion-Proxmox/ and uses linux bridges then on pfsense uses the the port mirroring while other guides
https://bilk0h.com/posts/security-onion-proxmox-endpoints
uses OVS and does not have in mind of pfsense,
I was wondering if someone could point me to the right direction cant seem to get the traffic into SO

Thank you

[reyesj2]

https://docs.securityonion.net/en/2.3/proxmox.html

What is your current network setup? Did you setup a span port on the pfsense host to mirror traffic from the interface you want to monitor? You'll also need to make sure that the span port is virtually connected to your SO

[killmasta93]

thanks for the reply, finally got it working with this perl script

#!/usr/bin/perl

use strict;
use warnings;

my $vmid = shift;
my $phase = shift;

print "GUEST BRIDGE MIRROR HOOK: " . join(' ', @ARGV). "\n";

sub MirrorSourceToDestination
{
  my $src = $_[0];
  my $des = $_[1];
  my $uid = $_[2];

  # ingress
  print "Creating INGRESS qdisc for $src \n";
  system("tc", "qdisc", "add", "dev", "$src", "ingress");

  print "Creating INGRESS filter for $src to $des \n";
  system("tc", "filter", "add", "dev", "$src", "parent", "ffff:0",
               "protocol", "all",
               "u32", "match", "u8", "0", "0",
               "action", "mirred", "egress", "mirror", "dev", "$des");

  # egress
  print "Creating EGRESS qdisc for $src \n";
  system("tc", "qdisc", "add", "dev", "$src", "handle", "$uid:0", "root", "prio" );

  print "Creating EGRESS filter for $src to $des \n";
  system("tc", "filter", "add", "dev", "$src", "parent", "$uid:0",
               "protocol", "all",
               "u32", "match", "u8", "0", "0",
               "action", "mirred", "egress", "mirror", "dev", "$des");

  print "Turning on $src promiscuous mode \n";
  system("ip", "link", "set", "$src", "promisc", "on");
}

sub RemoveMirror
{
  my $target = $_[0];

  print "Removing INGRESS mapping from $target \n";
  system("tc", "qdisc", "del", "dev", "$target", "ingress" );

  print "Removing EGRESS mapping from $target \n";
  system("tc", "qdisc", "del", "dev", "$target", "root" );

  print "Turning off $target promiscuous mode \n";
  system("ip", "link", "set", "$target", "promisc", "on");
}


if ($phase eq 'pre-start') {
  # Create mirrors from a valid/used bridge to a dummy bridge Security Onion
  MirrorSourceToDestination("vmbr2", "vmbr5", "10");
  MirrorSourceToDestination("vmbr3", "vmbr6", "20");
} elsif ($phase eq 'pre-stop') {
  # Remove bridge mirrors on stop so it can be restarted without script errors
  RemoveMirror("vmbr2");
  RemoveMirror("vmbr3");
}

exit(0);