Playbook
Home / Logging & Syslog / Network & security

Open the right ports (Ubuntu, Windows, AWS)

careful beginner #firewall#ufw#windows firewall#security group#port 514

When to use this: The server is configured but the firewall blocks messages, or you must open ports safely.

Be careful with this one. Allow only the sender IPs. An open 514 to the world invites log spoofing and floods.

Steps

  1. Ubuntu (ufw)

    terminal
    sudo ufw allow from 192.168.1.1 to any port 514 proto udp
sudo ufw allow from 192.168.1.1 to any port 514 proto tcp
sudo ufw status numbered

    One rule per sender IP. Remove a rule with sudo ufw delete <number>.

  2. Windows (PowerShell as Administrator)

    PowerShellGit Bash
    New-NetFirewallRule -DisplayName "Syslog UDP 514" -Direction Inbound -Protocol UDP -LocalPort 514 -RemoteAddress 192.168.1.1 -Action Allowpowershell.exe -Command "New-NetFirewallRule -DisplayName 'Syslog UDP 514' -Direction Inbound -Protocol UDP -LocalPort 514 -RemoteAddress 192.168.1.1 -Action Allow"

    Add a second rule for TCP if needed.

  3. AWS security group

    EC2, Security Groups, Edit inbound rules: type Custom UDP (and Custom TCP) port 514, source = the sender's public IP with /32. Never 0.0.0.0/0.

  4. Check from the sender's side

    terminal
    nc -vz 192.168.1.10 514

    Tests TCP reachability from a Linux or macOS machine. UDP cannot be proven by a connect test, so watch the server with tcpdump.

How to verify it worked

  • A packet capture on the server shows incoming traffic from the sender on the expected port.

How to undo it

Delete the rules you added (ufw delete, Remove-NetFirewallRule, or remove the security group rule).

Common errors and fixes

TCP works, UDP does not A rule exists for TCP only. Add the matching UDP rule. Also check that a network firewall in between allows UDP.
Rule exists but still no data The sender may not be coming from the IP you allowed (NAT). Capture on the server to see the real source.

Q&A

Which ports do syslog servers use?

514 UDP and TCP (classic), 6514 TCP for TLS, and non-privileged alternatives like 1514 or 5514.

Why restrict by source IP?

Classic syslog has no authentication. Anyone who can reach the port can send fake or flooding messages.

Practice these as flashcards →

Terms in this scenario

Syslog server

Related scenarios

My notes

Saved in this browser only.