NAT SO Manger for Forward Node

[ng1991]

Hi,

I am very new to this, and it is a setup that is already in place.

Basically, I need to add a new FWD node however i need to NAT the SO manger IP, this is fine, and I can add the forward node to the manager, but I noticed no logs were being forwarded. on inspection of the logs the file beat docker container was still pointing to the real IP of the SO manger which can't route.

How do I update the docker container image so the filebeat uses the correct IP and can route

[reyesj2]

What logs are you trying to forward? The forwarding should all be done by the forward node itself without modification of the filebeat docker container.

You successfully added the FWD node to the manager node and it shows up in the Grid dashboard? Your forward node should be pointing to an address it can reach.

Manager internal IP 192.168.1.10 > Manager NAT 54.123.54.10 > Forward node NAT 54.123.54.11 > Forward node internal IP 192.168.1.11

Have you taken a look at the docs

[ng1991]

Hi so this was actually an odd one as our manager was on a seperate network sending data behind a NAT IP on an ASA what we did was actually NAT on the docker interface as we couldnt amend the sls file as that would of broke our other forwarders:

iptables -t nat -A PREROUTING -i docker0 -p tcp -d 10.5.X.X -j NETMAP --to 10.100.Y.Y