Setup of rsyslog server in LXC

[NielsEliasen]

hi guys
have setup the rsyslog.conf to accept all from other servers, firewalls etc etc ..and it works locally... but when trying to access the 514 port from other servers I get a connection refused ....
and i suppose I have to add a line in the lxc.conf for that container.. but have been unable to find any docs on this .....
Any ideas ?

 

[LnxBil]

Please run thin inside your container (post in CODE-Tags):

netstat -tunlp

 

[NielsEliasen]

hi
Here's the output:
root@openvpn /home/nse# netstat -tunlp
Active Internet connections (only servers)
Proto Recv-Q Send-Q Local Address Foreign Address State PID/Program name
tcp 0 0 0.0.0.0:12320 0.0.0.0:* LISTEN 1480/stunnel4
tcp 0 0 0.0.0.0:12321 0.0.0.0:* LISTEN 1480/stunnel4
tcp 0 0 127.0.0.1:10000 0.0.0.0:* LISTEN 1634/perl
tcp 0 0 0.0.0.0:80 0.0.0.0:* LISTEN 1367/lighttpd
tcp 0 0 0.0.0.0:22 0.0.0.0:* LISTEN 1510/sshd
tcp 0 0 127.0.0.1:25 0.0.0.0:* LISTEN 1579/master
tcp 0 0 0.0.0.0:443 0.0.0.0:* LISTEN 1367/lighttpd
tcp 0 0 127.0.0.1:12319 0.0.0.0:* LISTEN 1256/shellinaboxd
tcp6 0 0 :::80 :::* LISTEN 1367/lighttpd
tcp6 0 0 :::22 :::* LISTEN 1510/sshd
udp 0 0 0.0.0.0:514 0.0.0.0:* 1259/rsyslogd
udp 0 0 0.0.0.0:1194 0.0.0.0:* 1401/openvpn
udp 0 0 0.0.0.0:10000 0.0.0.0:* 1634/perl
udp6 0 0 :::514 :::* 1259/rsyslogd
root@openvpn /home/nse#

 

[NielsEliasen]

Hi guys
Any ideas on this ?

 

[LnxBil]

I haven't answered yet because I have no further ideas. I'm running the same setup but in a KVM instead of an LXC. You have no PVE-based firewall on you container?

 

[NielsEliasen]

hi
nope.... nothing done explicitly ....

 

[NielsEliasen]

Besides....
I can make a connection locally ...... and then get entries in syslog ... but externally nothing!

 

[LnxBil]

Are the server and client on the same Proxmox VE?
Try to debug via tcpdump on the wire on the respective Proxmox VE servers. There are special nics for each VM, so you can capture only the traffic of the specified machine.

If you have the time, try to setup the environment in a KVM, so that LXC is not the limiting factor (whereas I do not suppose so).

 

[NielsEliasen]

Have an idea...
As this is based on an image from TurnkeyLinux... it could be that the firewall IS activated,.. will check !

 

[LnxBil]

Have you done a portscan of the machine? Maybe that'll also lead to some conclusions.

 

[NielsEliasen]

it's the Turnkey Linux builtin firewall ...
after defining a new rule(for port 514) via the Webmin interface i get a connection....
thanks for the help!

 

[LnxBil]

No problem.

Remark on Firewall:
I'd suggest to disable any VM firewall and only use the firewall from Proxmox VE. It is very, very good and you can administer all firewalls for every VM with ONE GUI. Very, very neat. Best is to define security groups and apply them to VMs. You can build virtual DMZ VMs with it. very good!