Change listening port on management interface

[networklord]

Version

2.4.80

Installation Method

Security Onion ISO image

Description

configuration

Installation Type

Distributed

Location

on-prem with Internet access

Hardware Specs

Meets minimum requirements

CPU

4

RAM

16

Storage for /

200

Storage for /nsm

200

Network Traffic Collection

span port

Network Traffic Speeds

Less than 1Gbps

Status

Yes, all services on all nodes are running OK

Salt Status

No, there are no failures

Logs

No, there are no additional clues

Detail

Hi all,

I have done port forwarding on router from my public IP port 7823 to Manager LAN IP 192.168.10.100. changed URL base to match public IP of router and does not work. Manager redirect back to Public IP and changes port to 443.

I have tested port forward 443 to 443 it is working, but 7823 does not. I started dig in one of possible solutions is to forward 7823 to 7823 on manager, but also docker needs to listen on port 7823 and forward to container on 443, this at least does not touch nginx configuration.

Please advice easiest way to achieve this, I have other services which already use 443 and I am not in situation to use 443 for Manager.

Thanks in Advance

Surba

Guidelines

• I have read the discussion guidelines at Read before posting! #1720 and assert that I have followed the guidelines.

[InfosecGoon]

You're trying to access the SOC web interface from the Internet? Is that the ultimate goal here?

[networklord]

Yes it is

[TOoSmOotH]

Please do not expose your SOC to the internet. If you ignore this advice at least lock down the source addresses. I would recommend using vpn to access it.

[networklord]

It is going to be limited to one source public IP. But is it possible to enable additional ports on SO?

[TOoSmOotH]

This is not currently supported due to how the cookies are returned.

[networklord]

I have managed to expose it using NGINX reverse proxy, everything works. Only annoying thing is in middle of screen:

Attempting to connect to Manager and Disconnected from manager, I assume that is because there is reverse proxy in middle of season. From functionality perspective everything else works

Nginx conf

server {
server_name somedomain.com;
listen 443 ssl;
ssl_certificate somecert.crt;
ssl_certificate_key somekey.key;

location / {

    proxy_set_header   X-Real-IP              $remote_addr;
    proxy_set_header   Host                   $http_host;
    proxy_pass         https://10.1.0.100;
    proxy_set_header   X-Forwarded-Proto      $scheme;

     proxy_ssl_verify off;


}

}