Web portal:64297 doesn't accept connections coming from a different subnet

[no-good-usernames-left]

I tried the updated T-pot and it's fighting back like it's being attacked on the web and ssh ports when all I want to do is just login to Kibana!

I tried multiple subnets and port-forwards and it does not work!

I can only access it on the same subnet whereas before Tpot broke with the kernel extensions, I could port-forward :64297 with ease for the management interface.

SSH doesn't work right either, I can't login as tsec remotely on port 64295, but it works locally

To put it simply, it looks like Cowrie is not configured correctly and is capturing management ssh+web in the honeypot.

[t3chn0m4g3]

No problems here, cannot reproduce.

[no-good-usernames-left]

When I did get Local access to the T-pot, the credentials I was using to login to SSH/Kibana are showing in the honeypot top10 attacks/logins.

We did a 1:1 NAT on just the management ports, but connecting to those ports over Layer3 are being sent to Cowrie instead of to management.

I've set up three T-pots on three different subnets & publics, same result every time, honeypots are capturing management ports.

[t3chn0m4g3]

It seems your setup is not using the correct ports or forwards, otherwise you would not end up in Cowrie if you did setup a 1:1 NAT for 64295->64295.