topic Re: Get Data in from DMZ servers in Getting Data In

How to get data in from DMZ servers?

Lwoods — Thu, 15 Jun 2023 18:04:01 GMT

Hello,

I have a few Linux devices that are located within the DMZ. My 3 Splunk servers (Search Head, Indexer, Deployment) are inside my network. I've installed the forwarders on my dmz servers, and set up the set-poll-deployment command (myserver.com:8089) to ensure it's pointing to the deployment server. There is no communication from the dmz servers to the deployment server

I did 2 tests:

1. I was able to connect from 1 dmz server to the deployment server. Result: Connection good.

2. I was not able to connect from the deployment server to the dmz server: Result: Connection refused

Are there other options to get the dmz servers to connect?

Thanks

Re: Get Data in from DMZ servers

richgalloway — Wed, 14 Jun 2023 19:21:48 GMT

There is no need for the DS to connect to the DMZ server. Forwarders always initiate communication with the DS.

You also, however, need to ensure the forwarder can communicate with the indexer.

Re: Get Data in from DMZ servers

Lwoods — Thu, 15 Jun 2023 11:40:22 GMT

I had ports 8089, and 9997 opened on the firewall. What is the Linux command to test the connection from the DMZ server to the Deployment server?

Re: Get Data in from DMZ servers

Lwoods — Thu, 15 Jun 2023 12:04:26 GMT

I had ports 8089, and 9997 opened on the firewall. What is the Linux command to test the connection from the DMZ server to the Deployment server?

Re: Get Data in from DMZ servers

richgalloway — Thu, 15 Jun 2023 12:22:13 GMT

You can use telnet, curl, nc, or even cat.