Security

Configure Splunk instance with 2 IP addresses ?

sieutruc
Contributor

Hello Splunkers,

I have a Splunk server configured with 2 interfaces (178.17.0.80, 192.168.194.80, hostname=searchhead).In splunklaunch.conf, i bind Splunk's IP to 178.17.0.80.
I can connect to Splunk inside network 178.17.0.0, but not in network 192.168.194.0. This Splunk machine has name server configured from DNS server of each network to make sure the hostname "searchhead" be resolved to the correct ip address.
So my question is how to connect to Splunk web from 2 networks that uses only common hostname "searchhead" ?

0 Karma
1 Solution

MuS
SplunkTrust
SplunkTrust

hi sieutruc

sounds more like a routing problem, if you bind splunk to IP 178.17.0.80 you must have a network route to reach it from inside 192.168.194.0.

are you able to do the following:

  • 'ping searchhead' from inside 192.168.194.0, it resolves to the correct IP and you get an answer?
  • are you able to open the splunk web page on http://178.17.0.80:<yourport>; from inside 192.168.194.0?

update:
why don't you unset the SPLUNK_BINDIP option so it binds to '*' ?

 SPLUNK_BINDIP=<ip address>
 * If unset, Splunk makes no specific request operating system when binding to
 ports/opening a listening socket.  This means it effectively binds to '*' or
 an unspecified bind.  The exact result of this is contolled by operating
 system behavior and configuration.

cheers,

MuS

View solution in original post

bmacias84
Champion

Alternatively you could use use port fowarding using iptables or netsh depending on platform.


#Linux
iptables -A PREROUTING -t nat -i eth0 -p tcp --dport 8000 -j DNAT --to 192.168.194.80:8000
iptables -A FORWARD -p tcp -d 192.168.194.80 --dport 8000 -j ACCEPT


#Windows
netsh interface portproxy add v4tov4 listenport=8000 listenaddress=192.168.194.80 connectport=8000 connectaddress=178.17.0.80

Netsh_PortProxy

iptables

Hope this helps or gets you started.
Cheers,

MuS
SplunkTrust
SplunkTrust

hi sieutruc

sounds more like a routing problem, if you bind splunk to IP 178.17.0.80 you must have a network route to reach it from inside 192.168.194.0.

are you able to do the following:

  • 'ping searchhead' from inside 192.168.194.0, it resolves to the correct IP and you get an answer?
  • are you able to open the splunk web page on http://178.17.0.80:<yourport>; from inside 192.168.194.0?

update:
why don't you unset the SPLUNK_BINDIP option so it binds to '*' ?

 SPLUNK_BINDIP=<ip address>
 * If unset, Splunk makes no specific request operating system when binding to
 ports/opening a listening socket.  This means it effectively binds to '*' or
 an unspecified bind.  The exact result of this is contolled by operating
 system behavior and configuration.

cheers,

MuS

sieutruc
Contributor

I haven't solved it yet.I will try SPLUNK_BINDIP=* tomorrow, but for the security reason, 2 domains with separate sub-network cannot connect together, so if iam in 192.168.194.0, searchhead is resolved to 192.168.194.80. And i can't open the splunk web page on http://178.17.0.80: from inside 192.168.194.0.
The thing i want is to connect splunk web page with the hostname, no matter what source it's from.

0 Karma
Get Updates on the Splunk Community!

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...

What's new in Splunk Cloud Platform 9.1.2312?

Hi Splunky people! We are excited to share the newest updates in Splunk Cloud Platform 9.1.2312! Analysts can ...