T-pot communicates with public IP addresses

[ThomasToto]

Hello everyone,
For my project I want to use T-Pot without Internet connection. According to my researches I saw that it wasn't possible in the state. If you stop internet access to Hive it stops working.
I analyzed streams from the Hive to the internet and saw several communications with public IP addresses.

I was able to see some of them :
80.158.38.137 -> listbot download server
51.145.123.29 / 151.80.32.71 / 151.80.211.8 / 195.154.226.102 etc -> NTP Server
etc etc

But there are others public ip addresses that I would like to define. The goal is to create a local repository to prevent T-Pot Hive from accessing the Internet.

Is it possible to get the list of ip addresses used by T-Pot ? Thank you in advance.

[t3chn0m4g3]

Without internet access T-Pot will still work, however functionality will be reduced since neither the OS nor the Docker images will be updated automatically, you will not get access to the latest geo_ip databases, etc.
Also some honeypots will have a reduced functionality as they require access to the internet, i.e. to intercept malware.
There is no list of IPs we can offer, only the ports list in the ReadMe.

[ThomasToto]

Ok, thank you for your answer.
Is a version without internet planned in the following months? If not, what files should be modified to reduce T-Pot's communications with the internet?

[lvto2000]

I have had little luck getting TPot to work without Internet. In the journal logs, it will get hung up on pulling updates or other information from the Internet then, all the honeypot docker containers fail to start. The last few errors after this happens are the following:

Error response from daemon: Get "https://registry-1.docker.io/v2/": dial tcp: lookup registry-1.docker.io on 10.10.10.1:53: dial udp 10.10.10.1:53: connect: network is unreachable

then the next error is

tpot.service: Main process exited, code=exited, status=18/n/a

then it finally fails with

tpot.service: Failed with result 'exit-code'

All this happens either when I do not allow it to connect to the internet or if I change the interface IP, or if I change the interface and IP on a virtual machine.

The only service that starts is ssh. There is no access to Kibana or any of the other ports that should be listening for service.

[t3chn0m4g3]

Setting this to never will prevent docker compose from trying to update the docker images.