can I connect the client that I created using the vm to the pfsense interface in virtualbox?
-
@stephenw10
Yes, my host-only is LAN, and what I ping is the IP of the client.after I tried to change the network interface to a bridge in both Snort and the client it worked. but what works is only ping from snort to client, ping from client to snort can't.
-
You are trying to run Snort in pfSense between client and a server, yes?
But where is the client and where is the server? They are in different subnets? Does pfSense have an interface in those subnet?
LAN as host-only means either the server of client must running on the VBox host. But if it also has other interfaces that traffic might not go through pfSense.
Steve
-
@stephenw10
so the vm Client network interface must be host-only? won't it collide? I have set host-only with static ipif i change static ip to dhcp web gui pfsense it won't run sir, i don't know why it won't work if my host-only LAN is setting dhcp.
do you have a way to get the pfsense web gui to run without me setting the host-only to a static IP? -
@stephenw10
The topology I use is like this, sir.
so the client server will connect to snort/suricata, when the attacker attacks snort/suricata it will protect the client serverso the concept of the topology that I made is like that, which makes me confused about how to make the network interface of the client server secure by snort/suricata
-
OK, so pfSense is running Snort there? Which interface is which?
The host-only interface is only accessible from the VBox host. So if you are running that as LAN either the 'client-server' or the attacker must also be running there.
If I was setting this up I would not use a host-only interface at all.
Steve
-
@stephenw10
yes sir, if i set the vbox host-only network interface to dhcp web gui for pfsense it won't work sir.so what kind of network interface do I have to set up, sir, so that I can run the topology concept that I'm using?
-
@stephenw10
I'm confused about the network settings, sir, because it always doesn't connect between pfsense and the client-server. -
It depends where your 'client-server' and attacker hosts are. Are those also VMs in VBox? Is one of them the host itself? There are lots of ways you could set this up.
-
@stephenw10
I made all of them on the VM sir -
OK so what I expect is to have each of those VMs in a separate internal network and pfSense have an interface in each. It will then route between them with Snort.
So to do that you need to define at least two internal networks in VBox then use internal interface NICs to connect to them. -
can you give an example of the VM project, sir? I'm still confused to understand what you explained sir.
excuse me sir
-
@stephenw10
from the screenshot I gave about my VM project, what should be changed sir? if you mind giving an example please tell me sir what to change from my VM project -
@ezvink said in can I connect the client that I created using the vm to the pfsense interface in virtualbox?:
The topology I use is like this, sir.
Your network topology looks strange to me
-
Why have you shown the cloud / internet coming directly to the client server?
-
Typically an attacker is internet based so both normal friendly and hostile internet access both go through the firewall.
-
Firewall rules and services such as snort / Suricate / pfBlockerNG are then used to separate friend from foe
-
Externally accessible servers may also be put on a separate (V)LAN to further control access from the relatively expose / at risk computers
-
-
I expect to see something like this:
Steve
-
@stephenw10
the network settings like this sir?
-
looks like I put it wrong, the internet/cloud should be above the firewall.
if so how sir? -
@ezvink
if i use network settings like this one i can't access the web gui from pfsense sir.
the host-only interface must be on adapter 2 and the internal network must be on adapter 3 @stephenw10 -
@ezvink said in can I connect the client that I created using the vm to the pfsense interface in virtualbox?:
i can't access the web gui from pfsense
pfsense should be accessed from a LAN.
The default settings with anti- lockout protection allows access from the default / fist LAN. For other internal LANs you need to explicitly add a firewall rule to allow GUI access to pfsense (port 443 from that lan to pfsense).If you need WAN access to pfsense set up a secure link (VPN) first then use that.
See https://docs.netgate.com/pfsense/en/latest/config/advanced-admin.html
-
@patch
so I have to use a vpn so that the client can connect to pfsense? is that so sir? -
@ezvink
Exposing pfsense GUI to the internet is a bad idea. If you need WAN access to pfsense GUI do it via a secure means such as VPN to the LAN side then use that.To access the GUI from an interface other than the default LAN you need to add a firewall rule to allow such access.
