Not receiving traffic in suricata on proxmox host machine from other hosts - linux

I am running proxmox on my server machine. I have attached a bridge adapter to it and 2 containers (A and B) are installed on proxmox.
I have also install Suricata on the Proxmox machine for it to act as an IDS. I have setup promiscuous mode on my bridge adapter in order to receive traffic from other machines present in my local network. However, in the Suricata logs, i am only receiving logs relating to my Containers (A and B) and not from the other Devices (Non Proxmox Based) present in my local network.

suricata installed directly on proxmox server is not good at all, you must do any if this
redirect (mirror) all traffic from home router to suricata (proxmox), it can be setup on router or switch before router - based on what you have there, but sending all traffic to proxmox(suricata) is bad idea, you will see
buy some rpi4 (4 or 8GB ram) make pfsense running on it with suricata "addon" or suricata itself - place it in front of your main LAN gateway/router and reconfigure all home devices to use it as gateway

Related

Connecting using TCP/IP from a virtualbox to another

I have 2 different machines running ubuntu on virtual box and i'm trying to run a server on one machine and connect with the client from another machine . However I am not able to connect due to the fact that the IP adress given from the virtual box machine is very strange that is 10.x.x.x . I am managing to run both programs one as ./server and the other ./client localhost 2017 on the same virtual box machine however not on different machines .. I am trying to run the client using ./client 10.x.x.x 2017 and the resulting error is error connecting . I should also add that both machines on virtual box are said to have the same IP address when I checked.. any help please ?
By default VirtualBox configures NAT networking.
You need to setup your addaptors in bridge mode and make sure your router can provide both VMs with IP addresses.
You can read more about it HERE.

how to ping the ip of linux running under vmware from window(host) of that same PC

I have window 7, and install Enterprises LINUX in vmware workstation, I have assign static IP I eth0 and eth1, and both are pinging from root as well as oracle user, but I cannot able to ping either of them from window of that same machine. Please help to advise how can i ping those static IP from my window 7 which is a host.
The answer depends on your VMWare networking setup for that virtual machine.
If the virtual machine is connected via a bridge or via a host-only network, you can just ping the VM's address.
If you're using NAT, then it's a problem since the VM has a private IP that's not seen by the host. The opposite ping should however work (if VMWare's NAT is smart enough) - you should be able to ping the host from the VM.

How to share folders b/n VirtualBox and Win 7 using NAT adapter and Samba

When I had my Adapter set to Host Only I followed this tutorial and was able to view the folder # \samba\share\ only buy typing \\192.168.55.444 in my windows start up. So, this means I could share this folder without any problem between two machines. But, now that I have switched to NAT adapter, and my ifconfig eth0 shows this as the host address 10.0.2.15 I am unable to access my samba shared folder no matter how I try to access it.
You can have two network adapters configured and use them at the same time. Use the Host-only as well as the NAT adapter. In the Virtualbox settings page just add another network adapter.
In your VirtualBox GUI click on your VM.
- then click Settings (Ctrl+S)
- click Network
- click Advanced
- click Port Forwarding
Configure port forwarding on ports 139 and 445
This port forwarding setup will work only if you don't have samba on your HOST machine, otherwise those port are reserved so virtualbox can not take them over to forward to your guest machine.
Better solution to share files between Host and Guest machine is to install and configure VirtualBox Guest Additions.
What OS do you have installed on yor VM ¿? ... The only way (for me to know) for get in work the share over NAT it's with the VBox Guest Additions...
It is not very difficult to install the guest additions; assuming you have an *buntu OS Family, mint or even debian linux, you can try this tutorials...
DEBIAN
*BUNTU
Then you can test the connection again ...

How to make virtual machines see each other and host

We have Virtual Machines operating within the KVM environment. We setup one as a dev server running apache etc and the other as a Windows development environment.
The two environments are setup and running fine. However, they cannot ping (see) each other. I am wondering if there is a clear solution to this.
This is what is happening.
From Host:
Cannot ping either of 2 VM's (one linux, one windows)
From Either of the VM's:
Cannot ping host
Cannot ping each other
From other network machines (for instance my laptop from within my company network)
Successfully ping host at 192.168.0.64
Successfully ping VM1 (Linux) 192.168.0.43
Successfully ping VM2 (Windows) 192.168.0.84
What sayeth the group ?
Jay Lepore
CompuMatter

VBox network mode to test Win 2008 server?

I have 2 machines running on my VirtualBox, one is a Windows XP client the second one is a 2008 Server with DHCP and DNS installed and configured.
now i want to test my server setup with my client machine, i tried all the network mode in VirtualBox but none of them worked
NAT mode get dhcp setting from VirtualBox itself i think
Bridged mode get dhcp from my router
...
any idea what should i do ?
My first guess would be to configure both virtual machines to have a single virtual network adapter that is configured as "internal network" and set a static IP address on both virtual machines. That will effectively isolate both guests to their own private network for testing.
I suggest to you to set network adapters on both virtual machines in "Bridge Mode".
On Windows Server 2008 you must choose type: Intel PRO/1000 MT Server (82545EM)
In this way, your virtual machine will get an IP address on the same LAN of your host machine, and the three machines can communicate

Resources