diff --git a/graylog/config/service.env b/graylog/config/service.env
index d7d2eb8..4371612 100644
--- a/graylog/config/service.env
+++ b/graylog/config/service.env
@@ -8,8 +8,8 @@ SSH_USER="root"
 WEB_PORT=9000           # Graylog web UI
 GELF_UDP_PORT=12201     # GELF UDP input
 GELF_TCP_PORT=12202     # GELF TCP input
-SYSLOG_UDP_PORT=1514    # Syslog UDP input
-SYSLOG_TCP_PORT=1515    # Syslog TCP input
+SYSLOG_UDP_PORT=514     # Syslog UDP input (external port, maps to 1514 internal)
+SYSLOG_TCP_PORT=514     # Syslog TCP input (external port, maps to 1514 internal)
 BEATS_PORT=5044         # Beats input
 
 # Graylog Admin Password (CHANGE THIS!)
diff --git a/graylog/docker-compose.yml b/graylog/docker-compose.yml
index 76df5de..40ca937 100644
--- a/graylog/docker-compose.yml
+++ b/graylog/docker-compose.yml
@@ -53,9 +53,9 @@ services:
       # GELF TCP
       - "${GELF_TCP_PORT:-12202}:12202"
       # Syslog UDP
-      - "${SYSLOG_UDP_PORT:-1514}:1514/udp"
+      - "${SYSLOG_UDP_PORT:-514}:1514/udp"
       # Syslog TCP
-      - "${SYSLOG_TCP_PORT:-1515}:1515"
+      - "${SYSLOG_TCP_PORT:-514}:1514"
       # Beats
       - "${BEATS_PORT:-5044}:5044"
     networks:
diff --git a/graylog/ports.sh b/graylog/ports.sh
index d8909f5..10c5008 100755
--- a/graylog/ports.sh
+++ b/graylog/ports.sh
@@ -8,6 +8,6 @@ _check_required_env_vars "WEB_PORT" "GELF_UDP_PORT" "GELF_TCP_PORT" "SYSLOG_UDP_
 echo "${WEB_PORT:-9000}"
 echo "${GELF_UDP_PORT:-12201}"
 echo "${GELF_TCP_PORT:-12202}"
-echo "${SYSLOG_UDP_PORT:-1514}"
-echo "${SYSLOG_TCP_PORT:-1515}"
+echo "${SYSLOG_UDP_PORT:-514}"
+echo "${SYSLOG_TCP_PORT:-514}"
 echo "${BEATS_PORT:-5044}"