Deployment Architecture

Connecting a search head to indexer through a proxy

mbrunetto
Path Finder

I have the following commands in server.conf:

[proxyConfig]
http_proxy = 192.168.1.5:8080
https_proxy = 192.168.1.5:8080
no_proxy = 192.168.0.0/16, localhost, 127.0.0.1, ::1

In the web GUI, I try to enter a new distributed search peer, 10.15.12.20. This system is not accessible to splunk through routing, but can be reached by connecting to the proxy for an outbound connection. However, when I attempt to enter the distributed peer in the GUI, I can watch the attempted traffic from the search head and see traffic sent directly on the wire to 10.15.12.20 (which is dropped by the firewall), instead of traffic going to 192.168.1.5 to pass through the proxy.

Has anyone experienced this before, or any ideas why the proxyConfig commands may not be working?
I understand that 80/443 are not the standard/ideal ports for this connection, but that's what I'm working with, and once the connection gets to 192.168.1.5, I can begin working on the other problems of the ports, but for now, the SH is putting traffic directly onto the network, and not trying to take advantage of the proxy.

                             FW
|----|          |-----|      |        |-------|
|    |          | 192 |      |(80/443)| 10.15 |
| SH |--------->|168.1|----->|------->| .12.20|
|    |          | .5  |      |        |(idxr2)|
|----|          |-----|      |        |-------|
  |                          |
------------------------------FW
  | (splunk ports allowed through)
|-------|
|192.168|
|.1.100 |
|(idxr1)|
|-------|
0 Karma

tpeveler_splunk
Splunk Employee
Splunk Employee
0 Karma
Get Updates on the Splunk Community!

Detecting Remote Code Executions With the Splunk Threat Research Team

REGISTER NOWRemote code execution (RCE) vulnerabilities pose a significant risk to organizations. If ...

Observability | Use Synthetic Monitoring for Website Metadata Verification

If you are on Splunk Observability Cloud, you may already have Synthetic Monitoringin your observability ...

More Ways To Control Your Costs With Archived Metrics | Register for Tech Talk

Tuesday, May 14, 2024  |  11AM PT / 2PM ET Register to Attend Join us for this Tech Talk and learn how to ...