Otdfbt

Multi tool use

Why doesn't a particle exert force on itself?

Can radiation block all wireless communications?

How can I test a shell script in a "safe environment" to avoid harm to my computer?

Is there an idiom that means "revealing a secret unintentionally"?

Why is it wrong to *implement* myself a known, published, widely believed to be secure crypto algorithm?

What will Doctor Strange protect now?

Is this strange Morse signal type common?

Capturing the entire webpage with WebExecute's CaptureImage

Expl3 and recent xparse on overleaf: No expl3 loader detected

Visual Studio Code download existing code

What computer port is this?

Add elements inside Array conditionally in JavaScript

How can it be that ssh somename works, while nslookup somename does not?

How do I calculate my to-hit bonus when using the Great Weapon Master feat?

For a Small race using a heavy weapon, does the Enlarge spell remove disadvantage on attacks with it?

How is it believable that Euron could so easily pull off this ambush?

Identity of a supposed anonymous referee revealed through "Description" of the report

When an electron around an atom drops to a lower state, is 100% of the energy converted to a photon?

How could a civilization detect tachyons?

How would an instant or sorcery with an effect that targets work with Feather?

Linear Independence for Vectors of Cosine Values

Are there vaccine ingredients which may not be disclosed ("hidden", "trade secret", or similar)?

My perfect evil overlord plan... or is it?

How to avoid overlap in the fractions of a table

having trouble with rsyslog forward and include origin IP or iptables mirror while using ufw

How to configure traffic from a specific IP hardcoded to an IP to forward to another IP:PORT using iptables?iptables port forward forwardingForward http traffic to another ip address with iptablesHow to configure port-forwarding to enable internal service accessed by another machine?Portforwarding with IPTABLES and Remote IP detectionRHEL 6 Having issues forwarding port 80 to port 8080iptables - Redirect except list MAC Addressrewrite destination IP of TEEed trafficHow to NAT inbound external traffic from port 80 to a local different port using iptables?How can I duplicate incoming DNS packets and send them to a different nameserver with iptables?

.everyoneloves__top-leaderboard:empty,.everyoneloves__mid-leaderboard:empty,.everyoneloves__bot-mid-leaderboard:empty height:90px;width:728px;box-sizing:border-box;

2

How do i get rsyslog to mirror traffic unmodified (including origin IP) to another port?

I have many devices sending data into port 514 but i need two different applications on the server to receive that data.

I tried adding the following to the bottom of /etc/rsyslog.conf

*.* @@127.0.0.1:1514

# also tried
*.* @127.0.0.1:1514

The application listening on 1514 get's all the data but the source address is always 127.0.0.1. If i send logs directly to port 1514 the application listening at 1514 see's the correct source address but now rsyslog doesn't see the data since it's listening on port 514.

How do i get rsyslog to mirror traffic unmodified (including origin IP) to another port?

For whatever reason the following iptables rules as an alternative to the above are not redirecting traffic on Ubuntu server 18.04LTS to resolve the problem so i was hoping there was a way to tweak my /etc/rsyslog.conf to make sure 1514 saw the original source instead of 127.0.0.1.

Example alternative iptables rule that isn't mirroring traffic (or at least graylog can't see it).

iptables -t mangle -A PREROUTING -p tcp --dport 514 -j TEE --gateway 127.0.0.2
iptables -t nat -A PREROUTING -d 127.0.0.2 -p tcp --dport 514 -j DNAT --to 127.0.0.1:1514

iptables -t mangle -A PREROUTING -p udp --dport 514 -j TEE --gateway 127.0.0.2
iptables -t nat -A PREROUTING -d 127.0.0.2 -p udp --dport 514 -j DNAT --to 127.0.0.1:1514

Note that my ufw rules are 22 ALLOW Anywhere and 514 ALLOW Anywhere

iptables rsyslog

share|improve this question

asked Apr 29 at 15:11

learnsomemorelearnsomemore

112

• 
  
  
  

  
  

  
  
  
  
  
  

  
  
  *. * ....do you have a space between the dot and the 2nd asterisk?
  
  – Sirch
  Apr 29 at 15:31
  

  
  
  
  


• 
  
  
  

  
  

  
  
  
  
  
  

  
  
  no. i'll add it and see what happens and update.
  
  – learnsomemore
  Apr 29 at 15:37
  

  
  
  
  


• 
  
  
  

  
  

  
  
  
  
  
  

  
  
  no, using *. * (astrix dot space astrix) throws error and stops rsyslog service error during parsing file /etc/rsyslog.conf, on or before line 61: warnings occured in file '/etc/rsyslog.conf' around line 61 [ invalid character in selector line - ';template' expected [v8.32.0]
  
  – learnsomemore
  Apr 29 at 15:42
  
  

  
  
  
  


• 
  
  
  

  
  

  
  
  
  
  
  

  
  
  Yes, sorry - it shoudnt be there, I thought I saw one. I'm not sure if ufw would need to have port 1514 ALLOWED, but your config looks good... are you sure IPTABLES isnt filtering too?
  
  – Sirch
  Apr 29 at 15:50
  

  
  
  
  

add a comment | 

2

How do i get rsyslog to mirror traffic unmodified (including origin IP) to another port?

I have many devices sending data into port 514 but i need two different applications on the server to receive that data.

I tried adding the following to the bottom of /etc/rsyslog.conf

*.* @@127.0.0.1:1514

# also tried
*.* @127.0.0.1:1514

The application listening on 1514 get's all the data but the source address is always 127.0.0.1. If i send logs directly to port 1514 the application listening at 1514 see's the correct source address but now rsyslog doesn't see the data since it's listening on port 514.

How do i get rsyslog to mirror traffic unmodified (including origin IP) to another port?

For whatever reason the following iptables rules as an alternative to the above are not redirecting traffic on Ubuntu server 18.04LTS to resolve the problem so i was hoping there was a way to tweak my /etc/rsyslog.conf to make sure 1514 saw the original source instead of 127.0.0.1.

Example alternative iptables rule that isn't mirroring traffic (or at least graylog can't see it).

iptables -t mangle -A PREROUTING -p tcp --dport 514 -j TEE --gateway 127.0.0.2
iptables -t nat -A PREROUTING -d 127.0.0.2 -p tcp --dport 514 -j DNAT --to 127.0.0.1:1514

iptables -t mangle -A PREROUTING -p udp --dport 514 -j TEE --gateway 127.0.0.2
iptables -t nat -A PREROUTING -d 127.0.0.2 -p udp --dport 514 -j DNAT --to 127.0.0.1:1514

Note that my ufw rules are 22 ALLOW Anywhere and 514 ALLOW Anywhere

iptables rsyslog

share|improve this question

asked Apr 29 at 15:11

learnsomemorelearnsomemore

112

• 
  
  
  

  
  

  
  
  
  
  
  

  
  
  *. * ....do you have a space between the dot and the 2nd asterisk?
  
  – Sirch
  Apr 29 at 15:31
  

  
  
  
  


• 
  
  
  

  
  

  
  
  
  
  
  

  
  
  no. i'll add it and see what happens and update.
  
  – learnsomemore
  Apr 29 at 15:37
  

  
  
  
  


• 
  
  
  

  
  

  
  
  
  
  
  

  
  
  no, using *. * (astrix dot space astrix) throws error and stops rsyslog service error during parsing file /etc/rsyslog.conf, on or before line 61: warnings occured in file '/etc/rsyslog.conf' around line 61 [ invalid character in selector line - ';template' expected [v8.32.0]
  
  – learnsomemore
  Apr 29 at 15:42
  
  

  
  
  
  


• 
  
  
  

  
  

  
  
  
  
  
  

  
  
  Yes, sorry - it shoudnt be there, I thought I saw one. I'm not sure if ufw would need to have port 1514 ALLOWED, but your config looks good... are you sure IPTABLES isnt filtering too?
  
  – Sirch
  Apr 29 at 15:50
  

  
  
  
  

add a comment | 

How do i get rsyslog to mirror traffic unmodified (including origin IP) to another port?

I have many devices sending data into port 514 but i need two different applications on the server to receive that data.

I tried adding the following to the bottom of /etc/rsyslog.conf

*.* @@127.0.0.1:1514

# also tried
*.* @127.0.0.1:1514

The application listening on 1514 get's all the data but the source address is always 127.0.0.1. If i send logs directly to port 1514 the application listening at 1514 see's the correct source address but now rsyslog doesn't see the data since it's listening on port 514.

How do i get rsyslog to mirror traffic unmodified (including origin IP) to another port?

For whatever reason the following iptables rules as an alternative to the above are not redirecting traffic on Ubuntu server 18.04LTS to resolve the problem so i was hoping there was a way to tweak my /etc/rsyslog.conf to make sure 1514 saw the original source instead of 127.0.0.1.

Example alternative iptables rule that isn't mirroring traffic (or at least graylog can't see it).

iptables -t mangle -A PREROUTING -p tcp --dport 514 -j TEE --gateway 127.0.0.2
iptables -t nat -A PREROUTING -d 127.0.0.2 -p tcp --dport 514 -j DNAT --to 127.0.0.1:1514

iptables -t mangle -A PREROUTING -p udp --dport 514 -j TEE --gateway 127.0.0.2
iptables -t nat -A PREROUTING -d 127.0.0.2 -p udp --dport 514 -j DNAT --to 127.0.0.1:1514

Note that my ufw rules are 22 ALLOW Anywhere and 514 ALLOW Anywhere

iptables rsyslog

share|improve this question

asked Apr 29 at 15:11

learnsomemorelearnsomemore

112

*.* @@127.0.0.1:1514

# also tried
*.* @127.0.0.1:1514

iptables -t mangle -A PREROUTING -p tcp --dport 514 -j TEE --gateway 127.0.0.2
iptables -t nat -A PREROUTING -d 127.0.0.2 -p tcp --dport 514 -j DNAT --to 127.0.0.1:1514

iptables -t mangle -A PREROUTING -p udp --dport 514 -j TEE --gateway 127.0.0.2
iptables -t nat -A PREROUTING -d 127.0.0.2 -p udp --dport 514 -j DNAT --to 127.0.0.1:1514

share|improve this question

asked Apr 29 at 15:11

learnsomemorelearnsomemore

112

share|improve this question

asked Apr 29 at 15:11

learnsomemorelearnsomemore

112

asked Apr 29 at 15:11

learnsomemorelearnsomemore

112

asked Apr 29 at 15:11

learnsomemorelearnsomemore

112