I have a server on my DMZ whichs relays syslog and OcsInventory messages to a server on a vlan for logging servers.
In order to allow the packets to go through I must allow port 80 (OcsInventory) and port 514 udp from this DMZ server to the machine on the vlan.
If the machine on the DMZ were ever compromised an attacker would have full access to port 80 and 514 UDP.
Is there any way to only allow these connections when Syslog/OcsInventory need to send a message?
Port knocking maybe?
Better yet, is there a way to only allow certain processes on my DMZ server to access the remote ports?
Any suggestions are very much appreciated.