Security Onion web interface giving me gray hairs!!!!! Spent the last 2 weeks trying to install Security Onion. Can't access web interface.

[ProtonmailLA]

Version

2.4.30

Installation Method

Security Onion ISO image

Description

configuration

Installation Type

Eval

Location

on-prem with Internet access

Hardware Specs

Meets minimum requirements

CPU

6

RAM

12

Storage for /

100

Storage for /nsm

100

Network Traffic Collection

other (please provide detail below)

Network Traffic Speeds

1Gbps to 10Gbps

Status

Yes, all services on all nodes are running OK

Salt Status

No, there are no failures

Logs

No, there are no additional clues

Detail

I can't access Security Onion web interface on 192.168.160.130 from a browser, which is what I set as the IP of the management network of the Security Onion. I can ping hosts on other networks from the terminal of the security onion though. I'm also able to ping 192.168.160.130 from outside the network too. Using 2 NICs. 1st is NAT, second is bridged. IP settings for Security Onion are all correct. ufw firewall is enabled, and web interface is allowed on both port 80 and 443. All containers are running. Still can't access web interface

Guidelines

• I have read the discussion guidelines at Read before posting! #1720 and assert that I have followed the guidelines.

[dougburks]

It sounds like you need to allow the IP address of your browser through the host-based firewall.

From https://docs.securityonion.net/en/2.4/firewall.html#configuring-host-firewall:

If for some reason you can’t access Security Onion Console (SOC), you can use the so-firewall command to allow your IP address to connect (replacing IPADDRESS with your actual IP address):

so-firewall includehost analyst IPADDRESS

[ProtonmailLA]

I'm still not able to connect to the web interface. To be sure, the management interface IP I set to 192.168.12.130 is also the allowed IP, right?

[dougburks]

I'm still not able to connect to the web interface. To be sure, the management interface IP I set to 192.168.12.130 is also the allowed IP, right?

No, as I mentioned in my last reply you need to allow the IP address of your browser.

[ProtonmailLA]

Well, if you mean my computer's IP address, or the IP address of the VM, then I did that. I've allowed everything possible. Otherwise, I don't know what you mean by the IP address of my browser.

[dougburks]

If you're running Security Onion as a VM, are you trying to connect from a web browser running on the host machine, or another VM, or a separate physical machine?

What virtualization software are you using?

What is the output of the following on the Security Onion VM?

sudo iptables -nvL |grep "dpt:443" |grep -v "sobridge"

When you ran setup, which option did you choose on this screen?