Unable to access SO web console

[nicholaswkc34]

Version

2.4.20

Installation Method

Security Onion ISO image

Description

configuration

Installation Type

Standalone

Location

on-prem with Internet access

Hardware Specs

Meets minimum requirements

CPU

Quad Cores

RAM

24GB

Storage for /

200GB

Storage for /nsm

300GB

Network Traffic Collection

span port

Network Traffic Speeds

Less than 1Gbps

Status

Yes, all services on all nodes are running OK

Salt Status

Yes, there are salt failures (please provide detail below)

Logs

No, there are no additional clues

Detail

Dear forumers, I tried to access the SO web console but the IP is not ping able. It shows destination unreachable. Previosuly, it can be access but after reformat it cannot be acess anymore.

The SO host can be ping at initial setup and after completed all so-setup it cannot be ping anymore.
The management interface is set already and its up . Verified using command ifconfig | more

I tried with so-firewall apply --includehost 192.168.1.0/24 or so-firewall apply --includehost 192.168.1.100 but it still failed to ping the SO within LAN network.
The command so-allow ask me to use so-firewall command.

Anyone can help. Thanks.

Guidelines

• I have read the above statement and can confirm my post is relevant to Security Onion 2.4.

[Mav1814]

Hi,
try sudo so-firewall includehost analyst 192.169.1.100 or 192.168.1.0/24
And try access de web interface.

[kvkamin]

You should use the Administration, Configuration, Firewall menu to make firewall changes. The salt engine will apply them. Command line changes have been deprecated.

https://docs.securityonion.net/en/2.4/firewall.html?highlight=Firewall#advanced-firewall-config

~K

[Mav1814]

But if he cant access the web interface .. the command line needs to be an option.

[kvkamin]

True. Might be easier to just drop firewall temporarily to get control.

[Mav1814]

yes, you are also right :)

[nicholaswkc34]

I tried the command so-frewall includehos analyst 192.168.1.0/24 but still not able to ping. How to drop firewall temporalily to get access to Web Interface? I have opnsense firewall in front of the LAN network.

This is my network architecture

Modem -> OPNSense Router -> TP-Link Switches

[nicholaswkc34]

Dear all forumers, please help. Thanks.

[nicholaswkc34]

How to disable firewall temporalily?

[kvkamin]

have you tried :
sudo so-firewall --apply includehost analyst IP

IP could be CIDR ie 10.0.0.0/24

[nicholaswkc34]

Yes, I did tried the command but still not able to ping the SO.

[kvkamin]

did you try the web interface? Ping might not work.

[kvkamin]

sudo iptables -nL
is your network showing up under DOCKER-USER chain?

[nicholaswkc34]

Yes I able to access the web interface now.

[kvkamin]

nice..