Possibility to swap ports 514 and 8220

[thomas-rocheteau]

Hello,

I would like to forward logs from a remote machine to Security Onion (standalone installation) using rsyslog.
I need to forward ports using port 8220. Is it possible to swap ports 8220 and 514 in the Security Onion configuration?

At this point, my endpoint can connect via telnet (for debugging) to ports 8220, 5055, and 8443 when I do not modify the S.O. configuration.
When I try to swap ports 514 and 8220 in the configuration accessible via the S.O. web interface, I can no longer connect via telnet to port 8220 (which I want to use for rsyslog).

Thank you for your help.

[reyesj2]

I think your best bet would be to get the remote host to send logs over a different port vs trying to modify a core component of Security Onion. If you can't modify the outbound port on the remote host can you setup an intermediary host?

[thomas-rocheteau]

Hello,

Thank you for your reply.
Between my remote machine and my operating system there is a firewall that only allows port 8220 through, but unfortunately I am not the administrator of this firewall. I am also unable to add an intermediate machine.
I hope to be able to modify the operating system configuration from the web interface, particularly the values in firewall>portgroups. I tried inverting ports 8220 and 514 in this way, but it doesn't work.
Are there other values that need to be changed? Perhaps it is possible to modify the configuration more deeply by modifying yaml files in the system?

Thank you for your help.