VirtualBox Network

[ralphramos1]

Watching the video it says to create 2 network adapters. My question is which one am I suppose to select on the VirtualBox Network setting for Adapter 1 and for Adapter 2, NAT, Bridget Adapter, Internal Network, Host-Only Adapter, Generic Driver, NAT network, Cloud Network or Not Attached.

[vanh20]

Hello ralpheeeek,

What video? It depends on what you want to accomplish and what you are trying to create. Virtualbox networking is quite flexible and will allow different scenarios. Please check 6.2. Introduction to Networking Modes as a reference for what you might want to accomplish. Usually, I use Adapter 1 as my management interface, where updates are also done by soup and the second adapter is for sniffing. If you want to do an internal network via Vbox, then you configure Adapter 2 as Internal Network, by that it means you have your VMs to sniff also placed under that same internal network, and you will have to configure it over Vbox. In that scenario, I would want my Adapter 1 to be reachable by my workstation/host so I might configure it in "Bridge mode" or "Nat mode" (with port forwarding).

Security Onion would want your management port to be either configured with STATIC IP Address or via Hostname. Please go through the install procedure for First Time Users. Also please take note of how you will access your web interface. This one explains Vbox networking better.

[reyesj2]

You'll find the best answer here

[ralphramos1]

Thanks for the replies! I'm just trying to set up security onion on my home network. Then maybe have another vm with kali and run like port scans on my home network so I can see how it looks like in the Siem and other attacks as well. Thanks in advance!

[ralphramos1]

Also I get confused on what IP address to assign it to.

[vanh20]

Hello ralpheeeek,

If you followed the tutorial above, you will have a better picture of what IP Address to assign to your Security Onion Interfaces (Adapters 1 & 2) and your VMs. Please see the photos in the "Bridged Adapter" section as well as the "Internal Network" section. They give you exact values you can use for your "Internal Network". It is best to configure your Adapter 1 as a "Bridge Adapter", on this situation, just let your home router assign it its IP Address, etc. via DHCP, or you may manually assign it. Remember, you need to decide which way to access your Security Onion Console Web interface. Will it be via IP Address or Hostname or Other? For simplicity's sake, just chose IP (default) for now. Later on, you may experiment using a Hostname (write this down) and resolve it on your workstation via the "hosts" file or your DHCP server (your home router or a dedicated Linux/Windows DHCP Server).

How to do this?

1. You install Security Onion via the ISO image.

2. Then it requires you to log in using the account and password you supplied during the previous Setup.

3. Then the next phase of the Security Onion Setup will kick in. Click "Yes" to continue.

4. You will be presented this option during the setup process. Select "Configure Networking Only" this time.

5. Go through the next steps until you are presented to select how you will configure the management interface. Select DHCP.

6. Continue until you are now at the command line interface. Your network interface now has an IP Address (IF your router is configured to provide that service).

7. run the command "ifconfig" at the CLI and take note of the IP Address, MAC Address, and the Network Mask your router assigned to your Adapter 1, assuming that's the adapter you used during the "configure networking only" phase above.

8. Now, go to your home router admin/config interface and assign that IP address to your VM's MAC address as recorded in step 7 above. You may need to exclude that IP Address from the DHCP IP address pool in your home router. If this is not possible because of previously assigned IP addresses that were already assigned from that pool (DHCP address pool must be contiguous), make the IP address exclusion at the end of the IP Address pool configured on your router. For example, 192.168.1.2 -192.168.1.254, make the address pool something like 192.168.1.2 -192.168.1.200, giving you 54 IP addresses you can use for your VMs that you do not want to be assigned via DHCP. You may configure your router to automatically assign 192.168.1.201 to your Security Onion Adapter 1, but you don't have to. What is important here is that you have an IP Address you can use to assign to your Security Onion which your DHCP server will not mess with. DHCP stuff.

9. Once you have done that (you configured your home router to automatically assign that IP Address above), confirm the assigned IP Address for your Adapter 1 if it is so. If you did not, still, take note of this IP Address (write it down) in the CIDR format as you will need this when you continue your Security Onion setup later.

10. Now, log out and log in one more time and the Next Phase of Security Onion will kick in. Same as in step 3 above.

11. Continue with the setup process and go through the management interface setup once more and use that IP address you noted in Step 9 above.

12. Now, go through the setup process and select Adapter 2 as your sniffing adapter. Complete your setup process.

13. Don't assign Adapter 2 any IP Address on your Vbox, just select "Internal Network" and chose the same internal network "Name" for your VMs and your Security Onion Adapter 2. And yes! Don't forget to set that Adapter 2 to "promiscuous mode" as suggested by the link provided by reyesj2 above.

This process is very lengthy. You can cut this short by going straight to your home router's admin/configuration web interface and reserving an IP Address for your Security Onion Adapter 1 which your DHCP server will never assign to another host on your network. After that, you take note of that IP Address in CIDR format and continue to step 10.

Lunch is calling. :D I hope this helps.