ossec-remoted: WARNING: (1213): Message from '172.25.0.1' not allowed.

[Xabier Rodríguez Bouza]

Hi,

I just updated to the docker image 2.1 and since then Im seeing this
errors on the ossec log, I backed up the proper files and restored them
and all my agents were able to connect back but for some reason Im
seeing this message.

As you can see per the ip the container is not using the usual mapping
for docker as this is a internet exposed server so Im using nat to allow
the agents to reach the container whats making it quite difficult to
troubleshoot the issue.

Any ideas?

Thanks in advance!

[Xabier Rodríguez Bouza]

Finally the problem was a syslog trying to connect to wazuh but as the
ip changed due to the masquerade it wasn't matching the allowed ip in
the configuration.

Thanks a lot Jose for your help !!!

[Jose Luis Ruiz]

No problem Xabier, i just realized that our conversation was in a private mail apologizes for the community.

Regards

-----------------------

Jose Luis Ruiz
Wazuh Inc.
jo...@wazuh.com

--
You received this message because you are subscribed to the Google Groups "Wazuh mailing list" group.
To unsubscribe from this group and stop receiving emails from it, send an email to wazuh+un...@googlegroups.com.
To post to this group, send email to wa...@googlegroups.com.
Visit this group at https://groups.google.com/group/wazuh.
To view this discussion on the web visit https://groups.google.com/d/msgid/wazuh/c36f0faf-d009-1c69-4fb4-9ccaa10fd644%40kalrong.net.
For more options, visit https://groups.google.com/d/optout.