Configuring Security Onion for Proxmox Deployment

It’s not as simple as their documentation would lead you to believe!

Courtesy of Security Onion Solutions.

Wanting to have better visibility into my network, I decided to try doing a local deployment of Security Onion. I have Proxmox running on my homelab, so I assumed it would be easy to drop the ISO into that environment and spin it up just like any other OS.

I was mistaken.

Documentation

The project itself has very extensive documentation, which can be found here:

[embed]Security Onion Documentation - Security Onion Documentation 2.4 documentation Edit descriptiondocs.securityonion.net

The issue is that their Proxmox documentation is… lacking. I was able to follow their “First Time Users” deployment guide to get me to this point:

Oh boy, this is gonna be fun…

Searching up the issue, I found their configuration page has an instance of this exact message! Should be easy to solve then, right?

Wrong…

This tells me what the fix is supposed to be, but gives no indication as to how you are supposed to implement it.

Proxmox Configuration

To back up some, this section is the configurations I went through to get to this point of having a box I could interact with.

Go to “local (proxmox)” and upload your ISO, which you can get from here.

Then you create a VM.

Selecting whatever options make sense for your setup on this first page.

Then choosing that ISO for the OS, ensuring that Linux is selected for the Guest OS type.

Choose the machine type.

Make sure you add enough storage to meet the specifications.

Do the same with the CPU.

And the memory.

We can start with the default network settings, we will change this later.

And you can go ahead and create it, but do not boot it yet.

Network Configuration

At this point, we have to figure out how to create the IP-less network interface that SecOnion is requesting. I was eventually able to accomplish this using a combination of these resources, although I ended up taking a different approach from the first two:

[embed][TUTORIAL] - Proxmox + Security Onion without OVS Since there is a complete lack of SPAN/Mirror examples using Linux Bridges into Security Onion, I thought I'd post what…forum.proxmox.com

[embed]GitHub - 0xvext/proxmox-seconiontap.sh: A bash script to create a persistent port mirror for an IDS… A bash script to create a persistent port mirror for an IDS within a Proxmox hypervisor - 0xvext/proxmox-seconiontap.shgithub.com

[embed]Network Configuration Proxmox VE is using the Linux network stack. This provides a lot of flexibility on how to set up the network on the…pve.proxmox.com

The method I used was Creating a Dedicated Sniffing Bridge in Proxmox, which turned out to be pretty straightforward. The steps were:

1. Navigate to Proxmox Host Network Settings: Go to Datacenter -> YourProxmoxNode -> System -> Network.
2. Create a New Bridge: Click Create -> Linux Bridge.
3. Apply Configuration: Click Apply Configuration (you might need to reboot the host or reload networking, Proxmox will usually prompt if needed, often it applies dynamically).

For the second step, the options we had to use were:

• Name: Give it a descriptive name, e.g., vmbr1 (if not already used)
• IP Address / CIDR: Leave BLANK. This is crucial.
• Gateway: Leave BLANK.
• Bridge ports: This is where you link the physical NIC that receives the SPAN/TAP traffic.
• If using a physical SPAN/TAP port: Identify the physical NIC on your Proxmox host (e.g., eno2, eth1) that is exclusively connected to your switch’s SPAN/mirror port. Enter that physical NIC name here (e.g., eno2). Important: This physical NIC should not be part of any other bridge (like vmbr0).
• If monitoring traffic between VMs on the same Proxmox host: You might leave “Bridge ports” blank for now. You’ll attach the VMs you want to monitor and the SO sniffing interface to this bridge later.
• Comment: Add a note like “Security Onion Sniffing Port” or “SPAN Input”.
• Click Create.

The resulting entry will look like so:

Very, very basic.

Additional Proxmox Configuration

Now that we have our new bridge, we can go back to the securityonion machine and make our final tweaks. You’re going to want to navigate to the “Hardware” tab and click “Add,” then choose “Network Device.” You are going to choose the new vmbr1 and uncheck the “Firewall” box.

From here, you can start up the machine and begin configuration like normal. When prompted to choose the management interface, select the first NIC (ex. ens18) and select the other interface (ex. ens19) when prompted to choose the sniffing interface.

Then you’ll have a production instance of Security Onion to use on Proxmox!