### Author:  [@nick-george](https://discuss.elastic.co/u/nick-george)
#### Post date: [October 25, 2016, 11:58pm UTC](https://discuss.elastic.co/t/java-exception-when-using-cap-net-bind-service-ep-with-logstash-5-x/63947/1 "2016-10-25T23:58:46Z")
I require Logstash to listen on TCP and UDP port 514. To do this, I use setcap to allow java to bind to this low port number. After doing this (and rerunning ldconfig), Java throws an exception.
```
logstash: Sending Logstash logs to /var/log/logstash which is now configured via log4j2.properties.
logstash: null:-2:in `getOpenFileDescriptorCount': java.lang.InternalError:
errno: 13 error: Unable to open directory /proc/self/fd
logstash: from ProcessMonitor.java:37:in `'
logstash: from ProcessMonitor.java:82:in `detect'
logstash: from RubyProcessReport.java:27:in `generate'
logstash: from RubyProcessReport$INVOKER$s$0$0$generate.gen:-1:in `call'
logstash: from CachingCallSite.java:306:in `cacheAndCall'
logstash: from CachingCallSite.java:136:in `call'
logstash: from CallNoArgNode.java:60:in `interpret'
logstash: from LocalAsgnNode.java:123:in `interpret'
logstash: from NewlineNode.java:105:in `interpret'
logstash: from BlockNode.java:71:in `interpret'
logstash: from ASTInterpreter.java:74:in `INTERPRET_METHOD'
logstash: from InterpretedMethod.java:139:in `call'
```
Logstash version: 5.0.0-rc1-1 (installed from RPM)
OS: Oracle Linux 7.2 running kernel 3.8.13-118.13.2.el7uek.x86\_64
Java version: Oracle JRE 1.8.0\_111-b14
This doesn't appear to be an issue with Logstash itself, but it looks like it will effect any Logstash users that wish to bind to privileged ports. After using setcap on the java binary, I can see that it totally changes the permissions under Logstash's /proc entry from being owned by Logstash to being owned by root instead, which explains the error I'm seeing. One possible fix is to stop Logstash from calling "getOpenFileDescriptorCount"
Regards,
Nick
---
### Author:  [@iconeb](https://discuss.elastic.co/u/iconeb)
#### Post date: [November 9, 2016, 8:39am UTC](https://discuss.elastic.co/t/java-exception-when-using-cap-net-bind-service-ep-with-logstash-5-x/63947/2 "2016-11-09T08:39:40Z")
As a temporary workaround, you can add also CAP\_DAC\_READ\_SEARCH capability, to allow reading /proc/self/fd regardless of permissions.
Surely this is not a viable definitive solution for security concerns, but it works in the meantime.
Regards,
federico
---
### Author:  [@nick-george](https://discuss.elastic.co/u/nick-george)
#### Post date: [November 12, 2016, 11:59pm UTC](https://discuss.elastic.co/t/java-exception-when-using-cap-net-bind-service-ep-with-logstash-5-x/63947/3 "2016-11-12T23:59:27Z")
> [@iconeb](#):
>
> self/fd regardless of permissions.
> Surely this is not a viable definitiv
Thanks for your suggestion Federico. In the end, I used iptables to forward the traffic to the desired port. This allows me to get the desired outcome without giving java unnecessary permissions.
---
### Author:  [@bopa](https://discuss.elastic.co/u/bopa)
#### Post date: [November 29, 2016, 5:40am UTC](https://discuss.elastic.co/t/java-exception-when-using-cap-net-bind-service-ep-with-logstash-5-x/63947/4 "2016-11-29T05:40:17Z")
how you did the port forwarding. I use centos 7 with following command,
**firewall-cmd --permanent --add-forward-port=port=514:proto=udp:toport=5514**
But it's not working. Any Idea why is that??
---
### Author:  [@nick-george](https://discuss.elastic.co/u/nick-george)
#### Post date: [November 29, 2016, 6:32am UTC](https://discuss.elastic.co/t/java-exception-when-using-cap-net-bind-service-ep-with-logstash-5-x/63947/5 "2016-11-29T06:32:21Z")
Hi Bopa,
I'm afraid I have little experience with firewall-cmd. I'm using iptables (which I'm configuring using puppet)
This works for me:
sudo iptables -t nat -A PREROUTING -p tcp --dport 514 -j REDIRECT --to-port 5514
For forwall-cmd, have you enabled masquerading? As suggested in [https://docs.fedoraproject.org/en-US/Fedora/19/html/Security\_Guide/sec-Configure\_Port\_Forwarding-CLI.html](https://docs.fedoraproject.org/en-US/Fedora/19/html/Security_Guide/sec-Configure_Port_Forwarding-CLI.html)
firewall-cmd --zone=external --add-masquerade
firewall-cmd --permanent --zone=external --add-forward-port=port=514:proto=tcp:toport=5514
Cheers,
Nick
---
### Author:  [@bopa](https://discuss.elastic.co/u/bopa)
#### Post date: [November 29, 2016, 6:45am UTC](https://discuss.elastic.co/t/java-exception-when-using-cap-net-bind-service-ep-with-logstash-5-x/63947/6 "2016-11-29T06:45:03Z")
Will it work for udp as well?
---
### Author:  [@nick-george](https://discuss.elastic.co/u/nick-george)
#### Post date: [November 29, 2016, 11:09pm UTC](https://discuss.elastic.co/t/java-exception-when-using-cap-net-bind-service-ep-with-logstash-5-x/63947/7 "2016-11-29T23:09:16Z")
Yes, works for UDP as well as it does for TCP. Just replace the "tcp" with "udp" in your rules.
Cheers,
Nick
---
### Author:  [@system](https://discuss.elastic.co/u/system)
#### Post date: [July 6, 2017, 4:30am UTC](https://discuss.elastic.co/t/java-exception-when-using-cap-net-bind-service-ep-with-logstash-5-x/63947/8 "2017-07-06T04:30:07Z")