topic Re: Forwarder behind a proxy in Getting Data In

Forwarder behind a proxy

Matthias_BY — Fri, 16 Aug 2013 12:35:19 GMT

Hi,

i want to send out data with an forwarder to a splunk indexer hosted in the web like splunk storm.

Is it possible to route the traffic of a forwarder over a proxy server?

br
matthias

Re: Forwarder behind a proxy

msn2507 — Wed, 18 Sep 2013 01:29:49 GMT

Yes, the documentation is here

http://docs.splunk.com/Documentation/Splunk/5.0.4/admin/Specifyaproxyserver

Re: Forwarder behind a proxy

Matthias_BY — Wed, 18 Sep 2013 16:20:59 GMT

Hi,

sorry that is not the answer. You're referring to splunk web. i'm asking for forwarder traffic.

Re: Forwarder behind a proxy

eddiewebb — Mon, 28 Sep 2020 15:21:18 GMT

Confirmed that setting PROXY, HTTP_PROXY, and HTTPS_PROXY in the universal forwarder's splunk-launch.conf has no effect on this issue.

Re: Forwarder behind a proxy

eddiewebb — Fri, 22 Nov 2013 22:07:27 GMT

Found another user with this problem, answers.splunk.com/answers/85935/forward-to-splunk-storm-using-universal-forwarder-through-proxy

They quote a insufficient response from splunk

If the problem is directly linked to
your company proxy (or firewall),
there is nothing that we can do.
Splunk protocol requires a connection
on the port 9997, with acknowledgement
back. Please contact your entreprise
network team to see if they can open
the port and route the data to it.

Also found this article - docs.splunk.com/Documentation/Splunk/6.0/Forwarding/Setupforwardingandreceiving

Note: You cannot forward data across a proxy, because the communication between forwarder and receiver does not use the HTTP protocol.

Re: Forwarder behind a proxy

mnatkin_splunk — Tue, 05 Sep 2017 13:58:25 GMT

While forwarder-to-indexer traffic can be wrapped in SSL, it's not technically an HTTP connection, and therefore won't properly traverse a web proxy.

The 2 ways I know how to accomplish this are as follows:

Use an intermediate forwarder (generally within a DMZ). Internal hosts have access to this host, and send their logs to the IMF. That host has outbound access to the indexer layer.
Use a SOCKS v5 Proxy

If you wish to secure your forwarder-to-indexer traffic behind a proxy, note that as of 6.3, Splunk supports the use of SOCKS v5 proxies for forwarder-to-indexer traffic. Details are available on-line at:

http://docs.splunk.com/Documentation/Splunk/6.6.3/Forwarding/ConfigureaforwardertouseaSOCKSproxy

Re: Forwarder behind a proxy

chauhananand — Fri, 29 Sep 2023 13:07:17 GMT

New link to doc:
https://docs.splunk.com/Documentation/Splunk/9.1.1/Forwarding/ConfigureaforwardertouseaSOCKSproxy