Configuring IPtables for UDP Multiline Syslog events

To collect UDP Multiline Syslog events in IBM QRadar, if you are unable to send the events directly to the standard UDP Multiline port of 517 or any other available port that is not already in use by QRadar, then you must redirect events from port 514 to the default port 517 or your chosen alternate port by using IPTables as outlined below. You must configure IPtables on your QRadar Console or for each QRadar Event Collector that receives UDP Multiline Syslog events from an Open LDAP server, and then complete the configuration for each Open LDAP server IP address that you want to receive logs from.

1. Using SSH, log in to QRadar as the root user.

   Login: <root>

   Password: <password>

2. Type the following command to edit the IPtables file:

   vi /opt/qradar/conf/iptables-nat.post

   The IPtables NAT configuration file is displayed.

3. Type the following command to instruct QRadar to redirect syslog events from UDP port 514 to UDP port 517:

   -A PREROUTING -p udp --dport 514 -j REDIRECT --to-port <new-port> -s <IP address>

   Where:

   <IP address> is the IP address of your Open LDAP server.

   <New port> is the port number that is configured in the UDP Multiline protocol for Open LDAP.

   You must include a redirect for each Open LDAP IP address that sends events to your QRadar Console or Event Collector. Example:

   -A PREROUTING -p udp --dport 514 -j REDIRECT --to-port 517 -s <IP_address>

4. Save your IPtables NAT configuration.

   You are now ready to configure IPtables on your QRadar Console or Event Collector to accept events from your Open LDAP servers.

5. Type the following command to edit the IPtables file:

   vi /opt/qradar/conf/iptables.post

   The IPtables configuration file is displayed.

6. Type the following command to instruct QRadar to allow communication from your Open LDAP servers:

   -I QChain 1 -m udp -p udp --src <IP_address> --dport <New port> -j ACCEPT

   Where:

   <IP address> is the IP address of your Open LDAP server.

   <New port> is the port number that is configured in the UDP Multiline protocol for Open LDAP.

   You must include a redirect for each Open LDAP IP address that sends events to your QRadar Console or Event Collector. Example:

   -I QChain 1 -m udp -p udp --src <IP_address> --dport 517 -j ACCEPT

7. Type the following command to update IPtables in QRadar:

   ./opt/qradar/bin/iptables_update.pl