topic Re: Configure Splunk instance with 2 IP addresses ? in Security

Configure Splunk instance with 2 IP addresses ?

sieutruc — Tue, 06 Nov 2012 13:08:03 GMT

Hello Splunkers,

I have a Splunk server configured with 2 interfaces (178.17.0.80, 192.168.194.80, hostname=searchhead).In splunklaunch.conf, i bind Splunk's IP to 178.17.0.80.
I can connect to Splunk inside network 178.17.0.0, but not in network 192.168.194.0. This Splunk machine has name server configured from DNS server of each network to make sure the hostname "searchhead" be resolved to the correct ip address.
So my question is how to connect to Splunk web from 2 networks that uses only common hostname "searchhead" ?

Re: Configure Splunk instance with 2 IP addresses ?

MuS — Tue, 06 Nov 2012 13:39:40 GMT

hi sieutruc

sounds more like a routing problem, if you bind splunk to IP 178.17.0.80 you must have a network route to reach it from inside 192.168.194.0.

are you able to do the following:

'ping searchhead' from inside 192.168.194.0, it resolves to the correct IP and you get an answer?
are you able to open the splunk web page on http://178.17.0.80:<yourport>; from inside 192.168.194.0?

update:
why don't you unset the SPLUNK_BINDIP option so it binds to '*' ?

 SPLUNK_BINDIP=<ip address>
 * If unset, Splunk makes no specific request operating system when binding to
 ports/opening a listening socket.  This means it effectively binds to '*' or
 an unspecified bind.  The exact result of this is contolled by operating
 system behavior and configuration.

cheers,

MuS

Re: Configure Splunk instance with 2 IP addresses ?

sieutruc — Tue, 06 Nov 2012 18:43:15 GMT

I haven't solved it yet.I will try SPLUNK_BINDIP=* tomorrow, but for the security reason, 2 domains with separate sub-network cannot connect together, so if iam in 192.168.194.0, searchhead is resolved to 192.168.194.80. And i can't open the splunk web page on http://178.17.0.80: from inside 192.168.194.0.
The thing i want is to connect splunk web page with the hostname, no matter what source it's from.

Re: Configure Splunk instance with 2 IP addresses ?

bmacias84 — Wed, 07 Nov 2012 03:18:35 GMT

Alternatively you could use use port fowarding using iptables or netsh depending on platform.



#Linux

iptables -A PREROUTING -t nat -i eth0 -p tcp --dport 8000 -j DNAT --to 192.168.194.80:8000

iptables -A FORWARD -p tcp -d 192.168.194.80 --dport 8000 -j ACCEPT



#Windows

netsh interface portproxy add v4tov4 listenport=8000 listenaddress=192.168.194.80 connectport=8000 connectaddress=178.17.0.80

Netsh_PortProxy

iptables

Hope this helps or gets you started.
Cheers,