# SOLVED! CentOs 7 minimal - Syslog received on port 5000 but not after a redirect fw rule from 514

**URL:** <https://discuss.elastic.co/t/solved-centos-7-minimal-syslog-received-on-port-5000-but-not-after-a-redirect-fw-rule-from-514/120345>\
**Category:** Logstash\
**Created:** [February 18, 2018, 11:11am UTC](https://discuss.elastic.co/t/solved-centos-7-minimal-syslog-received-on-port-5000-but-not-after-a-redirect-fw-rule-from-514/120345 "2018-02-18T11:11:14Z")\
**Posts on this page:** 2\
**Page:** 1

<div class="post-metadata">

**Author:** ![QuizzyRascal](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/quizzyrascal/32/27900_2.png) [@QuizzyRascal](https://discuss.elastic.co/u/QuizzyRascal)\
**Post date:** [February 18, 2018, 11:11am UTC](https://discuss.elastic.co/t/solved-centos-7-minimal-syslog-received-on-port-5000-but-not-after-a-redirect-fw-rule-from-514/120345/1 "2018-02-18T11:11:14Z")

</div>

Hi,  
I'm running a minimal centos 7 setup and am trying to receive syslog into Elk. I have installed ELK with defaults and all three services are up.

Using port 5000 for logstash I have started to receive Syslog - sending from KiwiSyslogGen. I have a kibana dashboard that shows syslog entries counting up - Yaaay

So I now have placed the following firewall rules in to see if I can avoid being root user and redirect syslog from port 514 to 5000 and so keep receiving them. Only problem is I can use TCPDUMP to monitor 514 and see syslog arriving but nothing appears in my kibana dashboard. It must be my firewall rules...

Can anyone take a peek and let me know where I have stepped on a landmine:

first I put rules in to allow elasticsearch ports  
sudo firewall-cmd --zone=public --add-port=9200/tcp --permanent  
sudo firewall-cmd --zone=public --add-port=9300/tcp --permanent

Then I added rules to gain access remotely to kibana  
Add a firewall redirect so port 80 goes to 5601 - allowing standard http to take you to kibana  
sudo firewall-cmd --zone=public --add-port=80/tcp --permanent  
sudo firewall-cmd --permanent --add-forward-port=port=80:proto=tcp:toport=5601

Next I tried to configure the firewall to allow syslog and to redirect it to port 5000 - so avoiding the need to run logstash with root privileges  
sudo firewall-cmd --zone=public --add-port=514/tcp --permanent  
sudo firewall-cmd --zone=public --add-port=514/udp --permanent  
#UDP Rule  
sudo firewall-cmd --add-forward-port=port=514:proto=udp:toport=5000:toaddr=127.0.0.1 --permanent  
#TCP Rule  
sudo firewall-cmd --add-forward-port=port=514:proto=tcp:toport=5000:toaddr=127.0.0.1 --permanent

Eventually after restarting firewalld I got the following status output:

public  
target: default  
icmp-block-inversion: no  
interfaces:  
sources:  
services: ssh dhcpv6-client  
ports: 9200/tcp 9300/tcp 80/tcp 514/tcp 514/udp  
protocols:  
masquerade: no  
forward-ports: port=80:proto=tcp:toport=5601:toaddr=  
port=514:proto=udp:toport=5000:toaddr=127.0.0.1  
port=514:proto=tcp:toport=5000:toaddr=127.0.0.1  
source-ports:  
icmp-blocks:  
rich rules:

Any help for this newbie would be greatly appreciated,

UPDATE: MY ERROR WAS IN ADDING toaddr TO THE 514 REDIRECTS. I REMOVED THAT AND ALL IS WELL!

Thanks  
QR

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [March 18, 2018, 11:11am UTC](https://discuss.elastic.co/t/solved-centos-7-minimal-syslog-received-on-port-5000-but-not-after-a-redirect-fw-rule-from-514/120345/2 "2018-03-18T11:11:17Z")

</div>

Closed on March 18, 2018, 11:11am UTC

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.