FW blocks after fresh install

[toddehb]

Version

2.4.30

Installation Method

Security Onion ISO image

Description

installation

Installation Type

Standalone

Location

on-prem with Internet access

Hardware Specs

Meets minimum requirements

CPU

8

RAM

16

Storage for /

250

Storage for /nsm

250

Network Traffic Collection

tap

Network Traffic Speeds

1Gbps to 10Gbps

Status

Yes, all services on all nodes are running OK

Salt Status

No, there are no failures

Logs

No, there are no additional clues

Detail

Hi all,

Just freshly started with SO and installed from ISO. During installation I had to define management network. I inserted as requested in CIDR format. After installation I try to reach GUI, but on console it shows me firewall drop messages from IP of my workstation.

Did I miss something?

Guidelines

• I have read the above statement and can confirm my post is relevant to Security Onion 2.4.

[KhorZL]

Have you tried adding it to the firewall allow-list?
https://docs.securityonion.net/en/2.4/firewall.html?highlight=so-firewall#configuration

You could try something like so-firewall includehost analyst <IP ADDRESS>

[toddehb]

Does not change the behavior

[toddehb]

Looking at the current iptables with option -L the added manager IP is not shown. Shouldn't it? Looking at the docker chain source anywhere is allowed to docker IP 172.17.1.28. Don't get it

[dougburks]

Setup prompts you to specify the IP address of the management interface:

What did you specify here?

Later, Setup asks if you would like to allow access to the management interface:

What did you specify here?

What is the output of the following?

sudo cat /opt/so/saltstack/local/pillar/firewall/soc_firewall.sls

If you run the following command, are there any errors at the end of the output?

sudo so-checkin

[toddehb]

Sorry for the late reply. Xmas hassle ;-)

so-checkin is presenting this at the end

[dougburks]

Looking at your so-checkin screenshot, have you made any config changes to the system related to anything in that screenshot (elasticsearch, elastalert, authentication, etc.)?

Since this is a new installation, it may be quicker and easier to wipe and reinstall to make sure everything is in a good state.

[toddehb]

Did a fresh install. Works as expected. Previous issue might be related due to Snort interfering on Router.