所以我试图通过 udp 将流量从内部端口 514 转发到内部端口 55514（运行 Ubuntu 19，系统日志从防火墙进入 514，logstash 监听 55514）虽然它没有发生。我剥离并刷新了 iptables：
sudo iptables -P INPUT ACCEPT
sudo iptables -P FORWARD ACCEPT
sudo iptables -P OUTPUT ACCEPT
sudo iptables -t nat -F
sudo iptables -t mangle -F
sudo iptables -F
sudo iptables -X
禁用防火墙：
sudo ufw disable
Firewall stopped and disabled on system startup
IP表状态：
sudo iptables -L
Chain INPUT (policy ACCEPT)
target prot opt source destination
Chain FORWARD (policy ACCEPT)
target prot opt source destination
Chain OUTPUT (policy ACCEPT)
target prot opt source destination
流量肯定是通过端口 514 进入的：
sudo tcpdump -u -i eno1 port 514
tcpdump: verbose output suppressed, use -v or -vv for full protocol decode
listening on eno1, link-type EN10MB (Ethernet), capture size 262144 bytes
13:04:49.898982 IP _gateway.syslog > elktest.syslog: SYSLOG user.warning, length: 70
13:04:50.429960 IP _gateway.syslog > elktest.syslog: SYSLOG user.warning, length: 70
13:04:50.961035 IP _gateway.syslog > elktest.syslog: SYSLOG user.warning, length: 70
13:04:51.164793 IP _gateway.syslog > elktest.syslog: SYSLOG local0.info, length: 185
13:04:51.491999 IP _gateway.syslog > elktest.syslog: SYSLOG user.warning, length: 70
我应用了这些规则：
sudo iptables -I FORWARD -i eno1 -p udp -d 192.168.50.225 --dport 514 -j ACCEPT
sudo iptables -I FORWARD -i eno1 -p tcp -d 192.168.50.225 --dport 514 -j ACCEPT
sudo iptables -t nat -I PREROUTING -i eno1 -p udp --dport 514 -j DNAT --to-destination 192.168.50.225:55514
sudo iptables -t nat -I PREROUTING -i eno1 -p tcp --dport 514 -j DNAT --to-destination 192.168.50.225:55514
然而，当我收听所需的端口 (55514) 时：
sudo tcpdump -u -i eno1 port 55514
tcpdump: verbose output suppressed, use -v or -vv for full protocol decode
listening on eno1, link-type EN10MB (Ethernet), capture size 262144 bytes
**crickets**
我什么也得不到。感谢您给我的任何建议和意见。请帮忙。