# Dec 18th, 2019: \[EN\]\[Elastic Stack\] Monitoring your home network with the Elastic Stack **URL:** \ **Category:** Advent Calendar\ **Created:** [December 18, 2019, 8:00am UTC](https://discuss.elastic.co/t/dec-18th-2019-en-elastic-stack-monitoring-your-home-network-with-the-elastic-stack/211453 "2019-12-18T08:00:12Z")\ **Posts on this page:** 2\ **Page:** 1
**Author:** ![Paul\_Coghlan](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/paul_coghlan/32/15249_2.png) [@Paul\_Coghlan](https://discuss.elastic.co/u/Paul_Coghlan)\ **Post date:** [December 18, 2019, 8:00am UTC](https://discuss.elastic.co/t/dec-18th-2019-en-elastic-stack-monitoring-your-home-network-with-the-elastic-stack/211453/1 "2019-12-18T08:00:12Z")
## Why add a home router? There are lots of good reasons to take control and start using your own home router: - You can add best-of-breed network and security features that are not always available in consumer modem routers. Tired of ads - install [Pi-hole](https://pi-hole.net/) ✂. Need to know which IP your internet-connected fridge is talking to at 3AM? No problem - you can check the flows with [Packetbeat](https://www.elastic.co/guide/en/beats/packetbeat/current/packetbeat-overview.html)🔎. - Most households become pretty unhappy places when the wifi is down. The good news is that if anything goes wrong in your router you shouldn't need to make any config changes to your existing Cable/DSL modem - just unplug your router from the existing modem and everything is back to normal, crisis resolved. 😃 - There are now many cheap low-power PCs with sufficient IO/CPU for the task. My home router is a few years old, so I've been using a low-power fanless PC ([Gigabyte Brix GB-BXBT-1900](https://www.gigabyte.com/uk/Mini-PcBarebone/GB-BXBT-1900-rev-10)) - you might find something like a [Raspberry Pi 4](https://www.raspberrypi.org/products/raspberry-pi-4-model-b/) might be a better option today. ## Networking For simplicity I've used a double-[NAT](https://en.wikipedia.org/wiki/Network_address_translation) configuration as below: ![Home Network Diagram](https://us1.discourse-cdn.com/elastic/original/3X/b/5/b569572b5fb641cb2e20e155f8bac82185c458b0.png) - `enp3s0` is the internal ethernet adapter, connected to the modem - `enx000ec6fa0c99` is an external 1000BaseT USB adapter that connects to my private network I'm running vanilla Ubuntu Linux on my router. I enabled a static IP for the private network by adding the following to `etc/network/interfaces`: ```auto auto enx000ec6fa0c99 iface enx000ec6fa0c99 inet static address 192.168.2.1 netmask 255.255.255.0 network 192.168.2.0 broadcast 192.168.2.255 ``` [`iptables`](https://en.wikipedia.org/wiki/Iptables) was configured with a basic NAT setup: ```auto sudo iptables -t nat -A POSTROUTING -o enp3s0 -j MASQUERADE sudo iptables -A INPUT -i lo -j ACCEPT sudo iptables -A FORWARD -i enp3s0 -o enx000ec6fa0c99 -m state --state RELATED,ESTABLISHED -j ACCEPT sudo iptables -A FORWARD -i enx000ec6fa0c99 -o enp3s0 -j ACCEPT ``` I enabled IP routing in `/etc/sysctl.conf` with: ```auto net.ipv4.ip_forward=1 ``` I installed a [DHCP Server](https://www.isc.org/dhcp/) and I added the following to `/etc/dhcp/dhcpd.conf `: ```auto subnet 192.168.2.0 netmask 255.255.255.0 { interface eth-int; range 192.168.2.10 192.168.2.250; option broadcast-address 192.168.2.255; option routers 192.168.2.1; default-lease-time 600; max-lease-time 7200; option domain-name "local"; option domain-name-servers 8.8.8.8, 8.8.4.4; } ``` ## Installing the Elastic Stack [Elastic Cloud](https://cloud.elastic.co/) allows you to try the Elasticsearch Service with a free 14-day trial. I've been using a 4GB Elasticsearch single node cluster for this demonstration. I installled the following Beats for Linux from the Elastic Stack (currently on version 7.5.0): - [Auditbeat](https://www.elastic.co/downloads/beats/auditbeat) - [Filebeat](https://www.elastic.co/downloads/beats/filebeat) - [Metricbeat](https://www.elastic.co/downloads/beats/metricbeat) - [Packetbeat](https://www.elastic.co/downloads/beats/packetbeat) I followed the Beats instructions as described online. It is worth noting that use of the [Elasticsearch Service](https://cloud.elastic.co) allows you to [simplify the configuration](https://www.elastic.co/guide/en/cloud/current/ec-cloud-id.html) - you don't need to specify `host` or `username`/`password` when you use the `cloud.id` and `cloud.auth`: ```auto cloud.id: "" cloud.auth: "elastic:" ``` After installation, I made two small tweaks to the default options: 1. I enabled `geoip` enrichment using [https://www.elastic.co/guide/en/beats/packetbeat/current/packetbeat-geoip.html](https://www.elastic.co/guide/en/beats/packetbeat/current/packetbeat-geoip.html) 2. In `/etc/packetbeat/packetbeat.yml` I bumped the flows reporting period from `30s` to `300s` to reduce traffic to the Elasticsearch cluster: ```auto packetbeat.flows: period: 300s ``` I then restarted `packetbeat` (`sudo service packetbeat restart`) to pickup the new configuration. Now you can grab a coffee whilst Elasticsearch starts to ingest your data. ## Kicking the tires A great place to start is to look at the [Packetbeat Dashboards](https://www.elastic.co/guide/en/beats/packetbeat/current/load-kibana-dashboards.html): ![Packetbeat Dashboard](https://us1.discourse-cdn.com/elastic/original/3X/c/f/cf25e526d85eb7d7915d83f9447f89bab82ef525.png) If I click on the `Network flows` I can see the traffic associated with each IP address. For example `192.168.2.39` seems to be doing a lot of downloading, and indeed this is the IP of my NVIDIA Shield TV box: ![Network Flows](https://us1.discourse-cdn.com/elastic/original/3X/e/e/ee5688ad149affafdd21be0b093d1ec0a4147989.png) Next try the [SIEM](https://www.elastic.co/products/siem) section in Kibana to investigate any suspicious activity. For example I can look at the uncommon processes running on my router: ![Uncommon processes](https://us1.discourse-cdn.com/elastic/original/3X/e/1/e1882c25f7aaa316c0006cbafa6a289c1694a107.png) All good! 😅 Hope this has provided some inspiration - have fun exploring your home network! ---
**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\ **Post date:** [November 4, 2022, 7:37am UTC](https://discuss.elastic.co/t/dec-18th-2019-en-elastic-stack-monitoring-your-home-network-with-the-elastic-stack/211453/4 "2022-11-04T07:37:00Z")