When SO behind NAT boundary (changing url_Base), Sensoroni/PCAP breaks

[jayfranklin]

We are running Security Onion 2.3.91 behind a firewall and have to change the url_base so that we can login and manage from the web interface.

After changing url_base and running the sudo salt-call state.highstate, sensoroni no longer works and consistently displays errors in /opt/so/log/sensoroni/sensoroni.log

level=info message="HTTP request finished" contentLength=1121 method=POST status="404 Not Found" statusCode=404 url=https://123.45.67.89/sensoroniagents/api/node
level=warn message="Failed to poll for pending jobs" error="Request did not complete successfully (404): 404 Not Found"

I noticed the /opt/so/conf/sensoroni/sensoroni.json file had the serverURL pointed to the external NAT address, presumably it got from url_base, which does not exist on this machine. I tried changing that parameter to my local address, but that change had no affect when I restarted pcap service (sudo so-pcap-restart).

I also tried changing the server bindAddress in /opt/so/conf/soc/soc.json to the internal address and restarting soc (sudo so-soc-restart). However, that didn't resolve the sensoroni 404 issue and it reverted my sensoroni.json serverURL parameter back to using the url_base address.

Does anyone have a solution to this issue? Maybe I should change another file to resolve the issue?

This is a standalone sensor running Security Onion 2.3.91.

Thanks for looking into this!

[dougburks]

Have you tried setting url_base to a hostname and making sure that the local box can resolve that hostname correctly?

[jayfranklin]

We do not have the capability to add DNS records to the external network. Are there any other options or a work around to this issue? Thanks!

[dougburks]

If you can't add DNS records, perhaps you could add an entry to the hosts file on the local machine.