# Logstash bind to port 514
**URL:** https://discuss.elastic.co/t/logstash-bind-to-port-514/44022
**Category:** Logstash
**Created:** [March 10, 2016, 11:33am UTC](https://discuss.elastic.co/t/logstash-bind-to-port-514/44022 "2016-03-10T11:33:47Z")
**Posts on this page:** 14
**Page:** 1
### Author:  [@mikula](https://discuss.elastic.co/u/mikula)
#### Post date: [March 10, 2016, 11:33am UTC](https://discuss.elastic.co/t/logstash-bind-to-port-514/44022/1 "2016-03-10T11:33:47Z")
Hello,
Is there a way to run logstash as nonroot user and to use port 514 (syslog plugin)?
I can not reconfigure all clients to other port...
Thank you .
AM
---
### Author:  [@magnusbaeck](https://discuss.elastic.co/u/magnusbaeck)
#### Post date: [March 10, 2016, 6:32pm UTC](https://discuss.elastic.co/t/logstash-bind-to-port-514/44022/2 "2016-03-10T18:32:22Z")
There are a few options listed [http://stackoverflow.com/questions/413807/is-there-a-way-for-non-root-processes-to-bind-to-privileged-ports-1024-on-l](http://stackoverflow.com/questions/413807/is-there-a-way-for-non-root-processes-to-bind-to-privileged-ports-1024-on-l). I'd probably start with the iptables port redirection.
---
### Author:  [@mikula](https://discuss.elastic.co/u/mikula)
#### Post date: [March 10, 2016, 7:18pm UTC](https://discuss.elastic.co/t/logstash-bind-to-port-514/44022/3 "2016-03-10T19:18:03Z")
Hello,
Thank you for advice...
But I knew about this already.
Iptables way is really nice but I run dualstack (no nat table in ip6tables)...
There is no authbind in SL6.
Sudo - same as now runs as root.
NO SE linux here - too complex to setup and I am not the only admin here.
And java with setcap is useless (until something has changed since september).
That is why I ask here.
AM
---
### Author:  [@magnusbaeck](https://discuss.elastic.co/u/magnusbaeck)
#### Post date: [March 10, 2016, 7:45pm UTC](https://discuss.elastic.co/t/logstash-bind-to-port-514/44022/4 "2016-03-10T19:45:13Z")
Well, the fact that you knew about all that but had rejected them is information that you could've included in your first post. Unfortunately I believe the options brought up are what you have at your disposal.
---
### Author:  [@mikula](https://discuss.elastic.co/u/mikula)
#### Post date: [March 10, 2016, 8:29pm UTC](https://discuss.elastic.co/t/logstash-bind-to-port-514/44022/5 "2016-03-10T20:29:28Z")
Sorry for not telling that beforehand.
It is sad that none of this is feasible for me.
Thank you for your kind help.
AM
---
### Author:  [@bopa](https://discuss.elastic.co/u/bopa)
#### Post date: [December 7, 2016, 4:12am UTC](https://discuss.elastic.co/t/logstash-bind-to-port-514/44022/6 "2016-12-07T04:12:45Z")
I tried set cap option but when set cap is enabled logstash service cannot be started.
following is my set cap command
**setcap cap\_net\_bind\_service=+epi /usr/lib/jvm/java-1.8.0-openjdk-1.8.0.102-1.b14.el7\_2.x86\_64/jre/bin/java**
---
### Author:  [@Sawyer](https://discuss.elastic.co/u/Sawyer)
#### Post date: [February 24, 2017, 5:36pm UTC](https://discuss.elastic.co/t/logstash-bind-to-port-514/44022/7 "2017-02-24T17:36:07Z")
I am not sure which OS you are running. But I had nothing but trouble with the setcap method on Centos 7.3, where it worked on 6.8 without issue. So, as Magnus suggests, I tried the port redirection. But I leverage firewall-cmd rather than the iptables commands. Here are my working methods for forwarding syslog 514 to 5514:
#UDP Rule
sudo firewall-cmd --add-forward-port=port=514:proto=udp:toport=5514:toaddr=127.0.0.1 --permanent
#TCP Rule
sudo firewall-cmd --add-forward-port=port=514:proto=tcp:toport=5514:toaddr=127.0.0.1 --permanent
# Restart firewalld
sudo systemctl restart firewalld
Then, all I had to do was update my Logstash input conf to listen on 5514 instead of 514, events are flowing into Elasticsearch now, hope this helps!
---
### Author:  [@arnydo](https://discuss.elastic.co/u/arnydo)
#### Post date: [March 16, 2017, 4:21pm UTC](https://discuss.elastic.co/t/logstash-bind-to-port-514/44022/8 "2017-03-16T16:21:23Z")
Sawyer,
I have port forwarding setup and Logstash is able to collect events via 5514 but it doesn't look like the OS is actually listening on 514 in order to forward it.
Any ideas on this?
---
### Author:  [@Sawyer](https://discuss.elastic.co/u/Sawyer)
#### Post date: [March 16, 2017, 7:09pm UTC](https://discuss.elastic.co/t/logstash-bind-to-port-514/44022/9 "2017-03-16T19:09:00Z")
Hi arnydo,
It will not show it is listening, but you do need to make sure 514 is permitted on the firewall, then restart the firewalld service. I have it setup and events are flowing to 514 and forwarded to 5514, but only 5514 is actually listening.
If that doesn't resolve your issue, then you may need to check your zones in firewall-cmd and verify that you are adding the forwarding to the appropriate zone where the interface is attached. For instance, I have all my internal syslog forwarding to the interface tied to my INTERNAL zone. So, if the zone isn't your default, you'll need to specify it when you create the port forwarding. You also may need to enable masquerade to permit forwarding locally. Below is an example of my zone configuration and some of the commands required to set it up this way.
Additionally, you can also remove the 127.0.0.1 from the setting, if it is null it will default back to localhost, see below:
Example of my complete updated config where I used the internal zone for my interface:
# CENTOS 7.3 CONFIG
### Specify which interface should default to the applicable zone.
# Edit network config at /etc/sysconfig/network-scripts/ifcfg-_interfacename_
# Add [ZONE=internal] without brackets
### Config Firewall ACLs
sudo firewall-cmd --set-default-zone=internal
sudo firewall-cmd --permanent --zone=internal --add-port=514/tcp #syslog port
sudo firewall-cmd --permanent --zone=internal --add-port=514/udp #syslog port
sudo firewall-cmd --permanent --zone=internal --add-port=5514/tcp #syslog forwarded port
sudo firewall-cmd --permanent --zone=internal --add-port=5514/udp #syslog forwarded port
sudo firewall-cmd --permanent --zone=internal --add-port=5600/tcp #kibana
sudo firewall-cmd --permanent --zone=internal --add-port=5601/tcp #kibana
sudo firewall-cmd --permanent --zone=internal --add-port=9600/tcp #logstash
sudo firewall-cmd --permanent --zone=internal --add-port=9200/tcp #elasticsearch
sudo firewall-cmd --permanent --zone=internal --add-port=9300/tcp #elasticsearch
sudo firewall-cmd --zone=internal --add-masquerade --permanent
sudo systemctl restart network.service
sudo systemctl restart firewalld
sudo firewall-cmd --add-forward-port=port=514:proto=udp:toport=5514 --permanent
sudo firewall-cmd --add-forward-port=port=514:proto=tcp:toport=5514 --permanent
sudo systemctl restart firewalld
firewall-cmd --list-all-zones
firewall-cmd --zone=internal --list-all
firewall-cmd --zone=internal --query-masquerade
### LOGSTASH SYSLOG INPUT CONFIG
[elasticsearch@blf-logstash-001 ~]$ cat /etc/logstash/conf.d/20-network-syslog.conf
input {
udp {
port =\> 5514
type =\> network
}
tcp {
port =\> 5514
type =\> network
}
}
---
### Author:  [@arnydo](https://discuss.elastic.co/u/arnydo)
#### Post date: [March 16, 2017, 8:44pm UTC](https://discuss.elastic.co/t/logstash-bind-to-port-514/44022/10 "2017-03-16T20:44:20Z")
Thank you for your quick reply!
I have followed your steps exactly and seem to have the same result...
---
### Author:  [@Sawyer](https://discuss.elastic.co/u/Sawyer)
#### Post date: [March 16, 2017, 9:05pm UTC](https://discuss.elastic.co/t/logstash-bind-to-port-514/44022/11 "2017-03-16T21:05:43Z")
Try from another server, loopback to 514 probably will not be permitted. I get the same response when done from the logstash server, but from another server it goes through no problem.
from the listening server
from another server
---
### Author:  [@arnydo](https://discuss.elastic.co/u/arnydo)
#### Post date: [March 17, 2017, 12:02pm UTC](https://discuss.elastic.co/t/logstash-bind-to-port-514/44022/12 "2017-03-17T12:02:54Z")
Perfect! This indeed worked from another server.
Thank you so much for your assistance with this!
---
### Author:  [@Sawyer](https://discuss.elastic.co/u/Sawyer)
#### Post date: [March 17, 2017, 2:23pm UTC](https://discuss.elastic.co/t/logstash-bind-to-port-514/44022/13 "2017-03-17T14:23:52Z")
Glad I could help!
---
### Author:  [@system](https://discuss.elastic.co/u/system)
#### Post date: [July 6, 2017, 4:27am UTC](https://discuss.elastic.co/t/logstash-bind-to-port-514/44022/14 "2017-07-06T04:27:46Z")