Server Fault is a question and answer site for system and network administrators. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

I am working on an OSSEC deployment where I will have multiple agents behind 1 public IP. Below is an example of the setup

Private Network
OSSEC-Agent1 (
OSSEC-Agent2 (
OSSEC-Agent3 (

Those IPs NAT to 1 public IP (

Then talks to the public OSSEC server on

I've read some OSSEC documentation talking about NAT here, but it doesn't tell me exactly what I need to know. Their example is using an entire /24 subnet and mine will mainly have multiple agents to only 1 public IP. With the setup so far, I brought Agent1 online fine and it is communicating to the OSSEC server. However Agent2 continues to fail trying to connect to Even though when I added the key, I had the correct name for it, so I know it talked to the portal at least once for that information. I'm assuming it's just getting confused with the multiple keys to 1 public IP. I basically want to know if this is possible and/or if I'm just overlooking something simple. Any help would be greatly appreciated.

share|improve this question
Try this: – quanta Jun 8 '12 at 4:06
@quanta - That seems to work for getting 2 agents to work behind the same IP. My only concern about that is what is going to happen when I expand this setup? In the end, I am probably going to have ~50 separate external IPs, each of which has anywhere between 5-15 agents behind it. So I am not sure how well the "any" will scale if OSSEC is having to distinguish between so many different keys. – Eric Jun 8 '12 at 13:29
Maybe you should ask this question in the OSSEC's mailing list. – quanta Jun 8 '12 at 14:49
I'm up to around 20 IPs or so across 5 different public IPs and everything is working fine. I've even taken computers off one location and took them to another and OSSEC picks it right back up correctly by distinguishing the key and accepting the "any" IP address. If you want to "answer this question" with your comments, I'll go ahead and accept it. Thanks again. – Eric Jun 13 '12 at 21:37
up vote 0 down vote accepted

I found this when Googling. Let me know if it works for you.

share|improve this answer

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.