topic Re: Gateway on EVE-NG in Firewall and Security Management

Gateway on EVE-NG

Moudar — Mon, 15 Apr 2024 12:02:04 GMT

Hi,

I have just installed a gateway on EVE-NG. Everything looks fine but I cannot login to do the first time wizard.

I got the IP address on eth0:192.168.40.185.

I can ping it, and I can ssh to the gateway with no problem.

But when try to open https://192.168.40.185, I get this:

Re: Gateway on EVE-NG

the_rock — Mon, 15 Apr 2024 12:06:29 GMT

Can you send output of ifconfig -a and route?

Re: Gateway on EVE-NG

Moudar — Mon, 15 Apr 2024 12:17:58 GMT

ifconfig is deprecated!

show interface eth0:

Interface eth0 state on mac-addr 50:00:00:05:00:00 type ethernet link-state link up mtu 1500 auto-negotiation on speed 1000M ipv6-autoconfig Not configured monitor-mode Not configured duplex full link-speed 1000M/full comments ipv4-address 192.168.40.185/24 ipv6-address Not Configured ipv6-local-link-address Not Configured

show route all:

A-GW-2> show route all Codes: C - Connected, S - Static, R - RIP, B - BGP (D - Default), O - OSPF IntraArea (IA - InterArea, E - External, N - NSSA), IS - IS-IS (L1 - Level 1, L2 - Level 2, IA - InterArea, E - External), A - Aggregate, K - Kernel Remnant, H - Hidden, P - Suppressed, NP - NAT Pool, U - Unreachable, i - Inactive C 127.0.0.0/8 is directly connected, lo C 192.168.40.0/24 is directly connected, eth0

I got 3 other interfaces and all are "state off"

Re: Gateway on EVE-NG

the_rock — Mon, 15 Apr 2024 12:33:14 GMT

Its from expert mode, ifconfig works fine, as well as route command. Anyway, what you sent is sort of same...so if that interface is up, can you check if same happens if you try another browser? Make sure if fw is not connected to mgmt, its most likely running initial policy, which WILL block web UI access, though since its port 443, technically it should work, but as a test, you can run fw unloadlocal from expert mode and try again.

Andy

Re: Gateway on EVE-NG

Moudar — Mon, 15 Apr 2024 12:47:20 GMT

Tried all browsers: Firefox, chrome, and Edge. Same problem!

[Expert@A-GW-2:0]# ifconfig -a eth0 Link encap:Ethernet HWaddr 50:00:00:05:00:00 inet addr:192.168.40.185 Bcast:192.168.40.255 Mask:255.255.255.0 UP BROADCAST RUNNING MULTICAST MTU:1500 Metric:1 RX packets:537 errors:0 dropped:0 overruns:0 frame:0 TX packets:331 errors:0 dropped:0 overruns:0 carrier:0 collisions:0 txqueuelen:1000 RX bytes:47046 (45.9 KiB) TX bytes:35435 (34.6 KiB) eth1 Link encap:Ethernet HWaddr 50:00:00:05:00:01 BROADCAST MULTICAST MTU:1500 Metric:1 RX packets:0 errors:0 dropped:0 overruns:0 frame:0 TX packets:0 errors:0 dropped:0 overruns:0 carrier:0 collisions:0 txqueuelen:1000 RX bytes:0 (0.0 b) TX bytes:0 (0.0 b) eth2 Link encap:Ethernet HWaddr 50:00:00:05:00:02 BROADCAST MULTICAST MTU:1500 Metric:1 RX packets:0 errors:0 dropped:0 overruns:0 frame:0 TX packets:0 errors:0 dropped:0 overruns:0 carrier:0 collisions:0 txqueuelen:1000 RX bytes:0 (0.0 b) TX bytes:0 (0.0 b) eth3 Link encap:Ethernet HWaddr 50:00:00:05:00:03 BROADCAST MULTICAST MTU:1500 Metric:1 RX packets:0 errors:0 dropped:0 overruns:0 frame:0 TX packets:0 errors:0 dropped:0 overruns:0 carrier:0 collisions:0 txqueuelen:1000 RX bytes:0 (0.0 b) TX bytes:0 (0.0 b) gretap0 Link encap:Ethernet HWaddr 00:00:00:00:00:00 BROADCAST MULTICAST MTU:1462 Metric:1 RX packets:0 errors:0 dropped:0 overruns:0 frame:0 TX packets:0 errors:0 dropped:0 overruns:0 carrier:0 collisions:0 txqueuelen:1000 RX bytes:0 (0.0 b) TX bytes:0 (0.0 b) gre0 Link encap:UNSPEC HWaddr 00-00-00-00-56-F7-38-90-00-00-00-00-00-00-00-00 NOARP MTU:1476 Metric:1 RX packets:0 errors:0 dropped:0 overruns:0 frame:0 TX packets:0 errors:0 dropped:0 overruns:0 carrier:0 collisions:0 txqueuelen:1000 RX bytes:0 (0.0 b) TX bytes:0 (0.0 b) lo Link encap:Local Loopback inet addr:127.0.0.1 Mask:255.0.0.0 UP LOOPBACK RUNNING PROMISC DYNAMIC MTU:65536 Metric:1 RX packets:16931 errors:0 dropped:0 overruns:0 frame:0 TX packets:16931 errors:0 dropped:0 overruns:0 carrier:0 collisions:0 txqueuelen:1000 RX bytes:2581031 (2.4 MiB) TX bytes:2581031 (2.4 MiB)

[Expert@A-GW-2:0]# route Kernel IP routing table Destination Gateway Genmask Flags Metric Ref Use Iface 192.168.40.0 * 255.255.255.0 U 0 0 0 eth0

And I did add a default gateway route like this:

[Expert@A-GW-2:0]# route Kernel IP routing table Destination Gateway Genmask Flags Metric Ref Use Iface default 192.168.40.2 0.0.0.0 UG 0 0 0 eth0 192.168.40.0 * 255.255.255.0 U 0 0 0 eth0

still not working. I can ping the internet as well!

and there is no firewall:

[Expert@A-GW-2:0]# fw unloadlocal Local host is not a FireWall-1 module

Re: Gateway on EVE-NG

the_rock — Mon, 15 Apr 2024 12:53:33 GMT

Ok, so its just mgmt server, got it now. Maybe as a quick test, disable web access, save, re-enable, save, test again.

Andy

Re: Gateway on EVE-NG

Moudar — Mon, 15 Apr 2024 13:02:33 GMT

if you mean:

set web daemon-enable off/on

that did not make it better!

Re: Gateway on EVE-NG

Moudar — Mon, 15 Apr 2024 13:07:40 GMT

this server is not a gateway nor a SMS, because i could not enter the first configuration wizard

Re: Gateway on EVE-NG

the_rock — Mon, 15 Apr 2024 13:15:49 GMT

I think now I get the whole "picture". So you installed Gaia, then rebooted, tried web UI, to initiate first time wizard to install it as either mgmt or gateway and thats where you are "stuck, got it. Hm, I cant say I personally ever experienced that myself, really odd. Are you allowed to do remote? I would like to check and see if I can help you fix it.

If you are, just message me directly.

Re: Gateway on EVE-NG

PhoneBoy — Mon, 15 Apr 2024 13:19:41 GMT

Since you’re installing this in EVE-NG which is not technically supported, what specific ram/hdd did you allocate to the VM?
What version was installed?

If you did not allocate the minimum values specified in the release notes for the version you’re running, you could experience behavior like this.

Realistically for a standalone gateway in a lab (no external management), you need to allocate at least 8GB of RAM and about ~200GB for hard drive.
That is assuming lab usage only.

Re: Gateway on EVE-NG

Moudar — Mon, 15 Apr 2024 13:25:21 GMT

My machine got 4 vCPU and 8GB ram and about 40GB disk.

The same specification (maybe less) is working when running the server directly on VMware workstation!

I run 81.20

Re: Gateway on EVE-NG

the_rock — Mon, 15 Apr 2024 13:26:44 GMT

I use eve-ng all the time and I never give it more than 100GB, works just fine.

Andy

Re: Gateway on EVE-NG

the_rock — Mon, 15 Apr 2024 13:27:05 GMT

Lets do remote if you are allowed to, just message me offline.

Re: Gateway on EVE-NG

Moudar — Mon, 15 Apr 2024 13:27:55 GMT

You got it! it is just a lab

How do you prefer to remote? TeamViewer

Re: Gateway on EVE-NG

Moudar — Mon, 15 Apr 2024 13:28:52 GMT

or Teams, is best

Re: Gateway on EVE-NG

the_rock — Mon, 15 Apr 2024 13:28:55 GMT

I dont like teamviewer, not so secure in my opinion. I will send you zoom offline

Andy

Re: Gateway on EVE-NG

the_rock — Mon, 15 Apr 2024 14:16:40 GMT

Just a quick update. @Moudar and I did remote session and though we verified DG is correct and config is saved, ssh works fine, but web UI does not. We even attempted different port, same issue. Spun up another instance in eveng, no joy.

The unfortunate thing is that NO cp commands will work, as we cant even run first time wizard to configure the lab. I told him would get access later to our lab eveng and report back. We also tested different nic types available, but exact same problem after restart.

Andy

Re: Gateway on EVE-NG

the_rock — Mon, 15 Apr 2024 14:42:08 GMT

my eve-ng fw settings

Re: Gateway on EVE-NG

the_rock — Mon, 15 Apr 2024 14:57:50 GMT

K, so here is the strange thing that I experienced...so, if I create new VM in even-ng with say 4 ethernets, BUT, I ONLY connect one, I have same problem, but as soon as I connect at least 2, works fine in web UI.

Maybe you can try that and see if it works for you? If it does, maybe its even-ng bug, not sure...

Andy

Re: Gateway on EVE-NG

Bob_Zimmerman — Mon, 15 Apr 2024 15:09:49 GMT

If you have command line access, just use config_system.

For that matter, EVE-NG does cloud-init, right? That would be the ideal option, since you wouldn't need to log in to the command line or web UI at all to get a fully-configured box.