Unable to Access Security Onion Web Interface via VPN

[SankaGamage]

Issue Description:
I installed Security Onion (network installation) on an Oracle Linux VM. The installation completed successfully, and I can connect to the VM using OpenVPN. However, I cannot access the web interface (https://192.168.1.xxx) from my browser.

Environment Details:

• Wi-Fi IP: 192.168.1.xxx
• VPN IP: 172.27.xx.xx
• Web Interface IP: 192.168.1.xxx
• Allowed Range (Configured): 172.27.xx.xx/xx

Steps Taken:

• Allowed VPN range for web access during installation (172.27.xx.xx/xx).
• Verified Security Onion services are running (so-status).
• Checked network interfaces and ensured IP addresses are correct (ip a).
• Used so-allow to confirm allowed IP ranges.

Expected Behavior:

• Web interface (https://192.168.1.xxx) should be accessible via VPN.

Request for Help:

1. Are additional post-installation steps required for web access?
2. How to troubleshoot this connectivity issue?

[dougburks]

Do you need to change the web access URL?
https://docs.securityonion.net/en/2.4/url-base.html

[SankaGamage]

Do you need to change the web access URL? https://docs.securityonion.net/en/2.4/url-base.html

No, I couldn't access the web interface. I set up Security Onion using the network installation method in standalone mode correctly, but I didn't get the web interface. Do we need to follow any specific methods ?

[dougburks]

Are you able to access the web interface from a machine that is on the same local network as the Security Onion machine (not using VPN)?

[SankaGamage]

Are you able to access the web interface from a machine that is on the same local network as the Security Onion machine (not using VPN)?

No, I am using a cloud machine for the setup.

[dougburks]

When you are connected to the VPN, can you ping the IP address of the Security Onion instance?

[SankaGamage]

When you are connected to the VPN, can you ping the IP address of the Security Onion instance?

Yes, I can ping the IP address of the Security Onion instance. I also checked so-status, and all services are running well. Additionally, the necessary ports are open.

[dohabandit]

My experience is that you need to go into the configuration section and edit the subnets in the access control lists that restrict access to the SO nodes/web interfaces. By default they won't know about that VPN subnet. Also I have done several installs where I thought I had the correct subnets added during installation only to find out they weren't there after installation completed.

[SankaGamage]

My experience is that you need to go into the configuration section and edit the subnets in the access control lists that restrict access to the SO nodes/web interfaces. By default they won't know about that VPN subnet.

How can I access the configuration section to edit the subnets in the access control lists if I don’t have access to the web interface?

[dohabandit]

In the past this was done via CLI using the SO-ALLOW command. If you have SSH shell access, I think you could still use SO-FIREWALL command to add a rule to allow your VPN subnet. Unless you want to manipulate iptables directly, probably not recommended approach.

Normally you would connect to the so manager node during installation steps, then navigate to administration->configuration then look over on the right hand side there are some quick links there under firewall that take you directly to the SOC access lists you need ot modify to allow your VPN analyst subnet to connect to the web interface. You could also plug this into the filter "firewall.hostgroups.analyst", then add the VPN subnet there.

https://docs.securityonion.net/en/2.4/post-installation.html
https://docs.securityonion.net/en/2.4/firewall.html

sudo so-firewall includehost analyst <IP ADDRESS>

[dohabandit]

[SankaGamage]

In the past this was done via CLI using the SO-ALLOW command. If you have SSH shell access, I think you could still use SO-FIREWALL command to add a rule to allow your VPN subnet. Unless you want to manipulate iptables directly, probably not recommended approach.

Normally you would connect to the so manager node during installation steps, then navigate to administration->configuration then look over on the right hand side there are some quick links there under firewall that take you directly to the SOC access lists you need ot modify to allow your VPN analyst subnet to connect to the web interface. You could also plug this into the filter "firewall.hostgroups.analyst", then add the VPN subnet there.

https://docs.securityonion.net/en/2.4/post-installation.html https://docs.securityonion.net/en/2.4/firewall.html

sudo so-firewall includehost analyst

I have SSH access to the CLI, but I don’t fully understand your solution. I know this can be done through the web interface, but I’m unsure how to do it via the CLI. I don’t think it’s included in the documentation. Could you guide me through it simply, if possible?

[dohabandit]

sudo so-firewall includehost analyst <IP ADDRESS>

sudo so-firewall includehost analyst 172.27.0.0/16

If you validated that these configuration settings were properly added during installation steps, you'll need to look at some sort of layer 3 issue between VPN client and the SO node. You might consider using a tcp traceroute, hping3 tests, etc. Is it possible the vpn/firewall or some cloud gateway is proxying the ICMP response for the SO node, so you might think you are pinging it but not actually reaching the node?

You could also confirm that iptables on the node isn't dropping your traffic by adding some logging:
iptables -N LOGGING
iptables -A INPUT -j LOGGING
iptables -A LOGGING -m limit --limit 2/min -j LOG --log-prefix "IPTables-Dropped: " --log-level 4
iptables -A LOGGING -j DROP