topic Re: Cant connect to port 8089 non-localhost, just only localhost in Security

Cant connect to port 8089 non-localhost, just only localhost

s2upin — Thu, 16 Mar 2017 12:19:48 GMT

I'm just install splunk enterprise in centos 7 , but i cant connect splunk enterprise with port 8089 by python sdk in non-localhost, but i can connect and run script in localhost , anyone have solve ?

Re: Cant connect to port 8089 non-localhost, just only localhost

jwelch_splunk — Thu, 16 Mar 2017 13:13:31 GMT

Probably a firewall issue

On local host run:
systemctl stop firewalld
If that fixes the issue, then you know it is the firewall on the local host. If that does not fix the issue then most likley there is another firewall off the box.

If the first one fixes your issue then the solution would be to create a firewall policy that would allow remote connectivity to your box on the splunk ports and turn your firewall back on.

Okie

Re: Cant connect to port 8089 non-localhost, just only localhost

mattymo — Thu, 16 Mar 2017 13:15:51 GMT

Hi s2upin,

you probably need to add the port to firewalld.

first, verify that splunkd is indeed listening:

[splunker@n00bserver ~]$ ss -tulpn | grep 8089
tcp    LISTEN     0      128       *:8089                  *:*                   users:(("splunkd",pid=11047,fd=5))

The do:

firewall-cmd --add-port 8089/tcp --permanent
firewall-cmd --reload

Verify with:

[root@n00bserver ~]# firewall-cmd --list-ports
5907/tcp 1022/tcp 5908/tcp 5222/tcp 9997/tcp 8089/tcp 5900/tcp 5901/tcp 5904/tcp 5905/tcp 80/tcp 514/udp 8000/tcp 5902/tcp 5903/tcp 5906/tcp

Re: Cant connect to port 8089 non-localhost, just only localhost

jwelch_splunk — Thu, 16 Mar 2017 13:19:06 GMT

Examples below

Splunk Enterprise also requires several ports to be opened through the firewall(s). To allow
these ports through the built-in firewalld on RHEL enter the following commands:
sudo firewall-cmd -permanent --add-port =8000/tcp
sudo firewall-cmd -permanent --add-port =9997/tcp
sudo firewall-cmd -permanent --add-port =514/tcp
sudo firewall-cmd -permanent --add-port =514/udp
sudo firewall-cmd -reload
sudo firewall-cmd -list-ports

Re: Cant connect to port 8089 non-localhost, just only localhost

s2upin — Fri, 17 Mar 2017 18:13:54 GMT

Tks you so much 😄