Not able to access web interface of SecurityOnion

[Mr-AnyThink]

Hello Everyone,

I am newbie and installed SO 2.3.70 in VMWare with NAT adapter. However, currently I am not able to access SO from browser. I added 0.0.0.0/0 as well as my own subnet in so-allow

Please help.

Thanks in advance.

[Sahale]

Hello! What kind of VMware? ESXi?

In general, if you use NAT, you have to DNAT ports 80/tcp and 443/tcp to your manager node on NAT router.

[Mr-AnyThink]

Thanks for response. It is VMware workstation. I tried NAT as well as Bridge adapter. Still same issue. All services are up and running.

Also, there is no router, it is just a NAT adapter of VMware workstation.

[Sahale]

I'd start tcpdump and check traffic from your PC to VM to ports 80 or 443. If you'll see only inbound traffic and not outbound, the problem is most probably is in firewall.

[dougburks]

Did you assign a static IP address in the same subnet as the NAT interface on your host machine?

One option might be to install the Analyst desktop and then try accessing the web interface locally inside the VM itself:
https://docs.securityonion.net/en/2.3/analyst-vm.html

[Mr-AnyThink]

Yes, I am assigning static IP, network connection is fine. I can access internet as well (in bothe scenario NAT as well as Bridged). I can ping to VM from host machine. I checked for option to access through IP.

I will try installing analyst desktop.