Security

Splunk behind reverse proxy keeps redirecting me to 127.0.0.1

Simon
Contributor

Hi all,

I've place splunkweb behind a reverse proxy and bound splunkweb and splunkd to 127.0.0.1.
The config:

splunk-launch.conf:

SPLUNK_BINDIP=127.0.0.1

web.conf:

[settings]
mgmtHostPort = 127.0.0.1:8189
httpport = 8100
tools.proxy.on = True
enableSplunkWebSSL = True

Apache's httpd.conf:

SSLProxyEngine On
ProxyPass /cgi-bin !
ProxyPass / https://127.0.0.1:8100/ retry=0
ProxyPassReverse / https://127.0.01:8100/ retry=0

When I now open splunk via the reverse proxy (https://mysplunksrv.domain.local), I get redirected to https://127.0.0.1:8100/de-DE/
Hitting directly https://mysplunksrv.domain.local/en-US/account/login opens the login page, after loggin in, I get redirected again to https://127.0.0.1:8100/de-DE/.

Any ideas?
Thx,
Simon

1 Solution

gkanapathy
Splunk Employee
Splunk Employee

Seems you have a typo in your ProxyPassReverse directive? But you also should put

ProxyPreserveHost On

in your Apache config.

View solution in original post

gkanapathy
Splunk Employee
Splunk Employee

Seems you have a typo in your ProxyPassReverse directive? But you also should put

ProxyPreserveHost On

in your Apache config.

Simon
Contributor

Oh god... how embarassing. The typo was the key. Thanks for pointing it out!

gkanapathy
Splunk Employee
Splunk Employee

Seems you have a typo in your ProxyPassReverse directive?

0 Karma

jbouch03
Path Finder

Have you tried using the actual IP of the Splunk system in the Splunk binding? I haven't tried this on my setup, but it looks like the redirect is caused by the Splunk binding. Try using the actual IP of the system and see if it fixes the issue.

0 Karma

Simon
Contributor

I only want to access splunk via web proxy, which is bound to the actual ip. Splunk should not listen to any non-local interface. But it works now, it was a typo (see below)

0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...