Homenet

Currently homenet is only used for Suricata, but could be used for other tools in the future.

Configuration

A node can be assigned either the global homenet or its own homenet.

By default, a node will use the global homenet pillar value if it is defind in the global pillar file (/opt/so/saltstack/local/pillar/global.sls) under global:hnmanager.

global:
  soversion: '2.3.0'
  hnmanager: '10.0.0.0/8,192.168.0.0/16,172.16.0.0/12'

In order to define a per node homenet, it can be defined in the minion pillar file (/opt/so/saltstack/local/pillar/minions/$SENSORNAME_$ROLE.sls) under sensor:hnsensor.

sensor:
  interface: 'bond0'
  mainip: '172.16.106.112'
  mainint: 'eth0'
  zeek_lbprocs: 5
  suriprocs: 2
  manager: 'somanager1'
  mtu: 1500
  uniqueid: 1602623674
  hnsensor: 10.0.0.0/8

In order to sync the configuration change with the node, we can either wait for the node to automatically highstate on the predefined interval, or we can force for it. Since this homenet only applies to Suricata, we can apply the suricata state to the node.

  • From the manager:

    salt $SENSORNAME_$ROLE state.apply suricata
    

or

  • From the node:

    salt-call state.apply suricata
    

More Information

See also

For more information about Suricata, such as defining other address groups or ports groups please see Suricata.