How to block all incoming connection on syslog server?

To block all incoming connections on a syslog server, you can use one of the following methods:

 

1. Using Firewall Rules

The most effective way to block incoming connections is by configuring the firewall on the syslog server. Depending on your system's firewall, you can follow these steps:

For UFW (Uncomplicated Firewall):

1. Deny Incoming Connections on the Syslog Port:

o For standard syslog (UDP port 514): 

o sudo ufw deny 514/udp

o For secure syslog (TCP port 6514): 

o sudo ufw deny 6514/tcp

2. Block All Incoming Connections (Optional): If you want to block all incoming traffic to the syslog server:

3. sudo ufw default deny incoming

4. Allow Specific Outgoing Traffic (Optional): Allow only necessary outgoing traffic:

5. sudo ufw default allow outgoing

6. Enable or Reload UFW:

7. sudo ufw enable

 

For iptables:

1. Drop Packets on the Syslog Port:

o For standard syslog (UDP port 514): 

o sudo iptables -A INPUT -p udp --dport 514 -j DROP

o For secure syslog (TCP port 6514): 

o sudo iptables -A INPUT -p tcp --dport 6514 -j DROP

2. Drop All Incoming Traffic (Optional): To block all incoming traffic, except for established connections:

3. sudo iptables -P INPUT DROP

4. sudo iptables -A INPUT -m state --state ESTABLISHED,RELATED -j ACCEPT

5. Save the iptables Rules: Save the configuration to persist after reboot:

6. sudo iptables-save > /etc/iptables/rules.v4

 

For firewalld (CentOS/RHEL-based systems):

1. Block Incoming Traffic on the Syslog Port:

o For standard syslog (UDP port 514): 

o sudo firewall-cmd --permanent --zone=public --add-rich-rule='rule family="ipv4" port port="514" protocol="udp" reject'

o For secure syslog (TCP port 6514): 

o sudo firewall-cmd --permanent --zone=public --add-rich-rule='rule family="ipv4" port port="6514" protocol="tcp" reject'

2. Reload firewalld:

3. sudo firewall-cmd --reload

 

2. Configure the Syslog Server to Reject Connections

You can also configure your syslog server (e.g., rsyslog, syslog-ng) to reject incoming connections directly:

For rsyslog:

1. Open the rsyslog configuration file: 

2. sudo nano /etc/rsyslog.conf

3. Comment out or remove the imudp or imtcp module that listens for incoming connections: 

4. #module(load="imudp")

5. #input(type="imudp" port="514")

6.

7. #module(load="imtcp")

8. #input(type="imtcp" port="6514")

9. Restart rsyslog to apply changes: 

10. sudo systemctl restart rsyslog

 

3. Block Specific IPs (Optional)

If you want to block incoming connections from specific IP addresses, you can add rules to the firewall. For example, using iptables:

sudo iptables -A INPUT -s <IP_ADDRESS> -j DROP

 

Verify the Configuration

1. Check Listening Ports: Ensure the syslog server is no longer listening on the ports:

2. sudo netstat -tuln | grep -E '514|6514'

3. Test the Rules: Use tools like nc or telnet from a client machine to verify that the connection is blocked:

4. nc -vz <syslog_server_ip> 514