<html>
<head>
<meta http-equiv="Content-Type" content="text/html; charset=iso-8859-1">
<meta name="Generator" content="Microsoft Exchange Server">
<!-- converted from text --><style><!-- .EmailQuote { margin-left: 1pt; padding-left: 4pt; border-left: #800000 2px solid; } --></style>
</head>
<body>
<meta content="text/html; charset=UTF-8">
<style type="text/css" style="">
<!--
p
{margin-top:0;
margin-bottom:0}
-->
</style>
<div dir="ltr">
<div id="x_divtagdefaultwrapper" dir="ltr" style="font-size:12pt; color:#000000; font-family:Calibri,Helvetica,sans-serif">
<p>Hi.</p>
<p>i've changed the configuration:</p>
<p></p>
<div>stream {</div>
<div> upstream master {</div>
<div> server 10.0.0.7:1515;</div>
<div> }</div>
<div> upstream mycluster {</div>
<div> hash $remote_addr consistent;</div>
<div> server 10.0.0.7:1514;</div>
<div> server 10.0.0.6:1514;</div>
<div><br>
</div>
<div> }</div>
<div> server {</div>
<div> listen 1515;</div>
<div> proxy_pass master;</div>
<div> }</div>
<div> server {</div>
<div> listen 1514 udp;</div>
<div> proxy_pass mycluster;</div>
<div> proxy_bind 10.0.0.8;</div>
<div> }</div>
<div>}</div>
<div><br>
</div>
<br>
<p></p>
<p>Execute this command on agent:</p>
<p><br>
</p>
<p><span> nc -vnzu -w 1 192.168.1.5 1514</span></p>
<p><span>to check if is abel to connect to my Nxinx LB port, the result is positive:</span><br>
</p>
<p><span></p>
<div>Ncat: Version 7.50 ( https://nmap.org/ncat )</div>
<div>Ncat: Connected to 192.168.1.5:1514.</div>
<div>Ncat: UDP packet sent successfully</div>
<div>Ncat: 1 bytes sent, 0 bytes received in 2.01 seconds.</div>
<div><br>
</div>
<div>Same from LB to my HIDS node:</div>
<div>
<div>nc -vnzu -w 5 10.0.0.6 1514</div>
<div>Ncat: Version 7.50 ( https://nmap.org/ncat )</div>
<div>Ncat: Connected to 10.0.0.6:1514.</div>
<div>Ncat: UDP packet sent successfully</div>
<div><br>
</div>
<div><br>
</div>
<div>but my agents are still unable to send logs over port 1514 UDP</div>
<div><br>
</div>
<br>
</div>
<div><br>
</div>
<br>
</span>
<p></p>
<p><span><br>
</span></p>
<p><br>
</p>
</div>
<hr tabindex="-1" style="display:inline-block; width:98%">
<div id="x_divRplyFwdMsg" dir="ltr"><font face="Calibri, sans-serif" color="#000000" style="font-size:11pt"><b>Da:</b> nginx <nginx-bounces@nginx.org> per conto di Reinis Rozitis <r@roze.lv><br>
<b>Inviato:</b> lunedì 2 marzo 2020 00:09:53<br>
<b>A:</b> nginx@nginx.org<br>
<b>Oggetto:</b> RE: problem with proxy pass</font>
<div> </div>
</div>
</div>
<font size="2"><span style="font-size:10pt;">
<div class="PlainText">> The agents in my local network(192.x.x.x)) instead, are able to authenticate<br>
> over port 1515 TCP, but not to send logs over 1514 UDP. The agents log said<br>
> that they are unable to connect over that port.<br>
> <br>
> If I temporally change the port 1514 UDP to 1514 TCP in my HIDS nodes, and<br>
> make the same change on Nginx configuration, they are able to send logs<br>
> like nothing happen<br>
<br>
This gives more things to test:<br>
(I would also change the error_log level to notice and see if there is anything logged)<br>
<br>
1. Can you test from any client in the lan (192.x.x.x) that you are able to connect to the nginx udp port Iand send some message /csee if it lands in the backends), for example with netcat: nc -u your.centos.ip 1514<br>
<br>
2. See if you are able to actually connect from the centos box to the backends: nc -u 10.0.0.7 1514<br>
<br>
<br>
With two network interfaces there might be also routing issues and depending on the configuration you could need to specify the outgoing 10.x interface with proxy_bind (<a href="https://nginx.org/en/docs/stream/ngx_stream_proxy_module.html?#proxy_bind">https://nginx.org/en/docs/stream/ngx_stream_proxy_module.html?#proxy_bind</a>)
<br>
<br>
Something like:<br>
<br>
server {<br>
listen 1514 udp;<br>
proxy_pass mycluster;<br>
proxy_bind 10.x.x.x; // the ip of the centos machine<br>
}<br>
<br>
rr<br>
<br>
<br>
_______________________________________________<br>
nginx mailing list<br>
nginx@nginx.org<br>
<a href="http://mailman.nginx.org/mailman/listinfo/nginx">http://mailman.nginx.org/mailman/listinfo/nginx</a><br>
</div>
</span></font>Ai sensi dell'art. 13 del Regolamento UE 2016/679 (GDPR), si informa che gli eventuali dati personali indicati in questo documento sono trattati dallo Scrivente secondo i principi di correttezza liceità e trasparenza. L’informativa completa è
disponibile a richiesta presso i ns uffici o all’indirizzo email: info@ngway.it. Si informa inoltre che le informazioni contenute nella presente comunicazione e i relativi allegati possono essere riservate e sono, comunque, destinate esclusivamente alle persone
o alla Società destinatari. La diffusione, distribuzione e/o copiatura del documento trasmesso da parte di qualsiasi soggetto diverso dal destinatario è proibita, ai sensi dell’art. 616 c.p. Se avete ricevuto questo messaggio per errore, vi preghiamo di distruggerlo.
</body>
</html>