Deployment Architecture

Connecting a search head to indexer through a proxy

mbrunetto
Path Finder

I have the following commands in server.conf:

[proxyConfig]
http_proxy = 192.168.1.5:8080
https_proxy = 192.168.1.5:8080
no_proxy = 192.168.0.0/16, localhost, 127.0.0.1, ::1

In the web GUI, I try to enter a new distributed search peer, 10.15.12.20. This system is not accessible to splunk through routing, but can be reached by connecting to the proxy for an outbound connection. However, when I attempt to enter the distributed peer in the GUI, I can watch the attempted traffic from the search head and see traffic sent directly on the wire to 10.15.12.20 (which is dropped by the firewall), instead of traffic going to 192.168.1.5 to pass through the proxy.

Has anyone experienced this before, or any ideas why the proxyConfig commands may not be working?
I understand that 80/443 are not the standard/ideal ports for this connection, but that's what I'm working with, and once the connection gets to 192.168.1.5, I can begin working on the other problems of the ports, but for now, the SH is putting traffic directly onto the network, and not trying to take advantage of the proxy.

                             FW
|----|          |-----|      |        |-------|
|    |          | 192 |      |(80/443)| 10.15 |
| SH |--------->|168.1|----->|------->| .12.20|
|    |          | .5  |      |        |(idxr2)|
|----|          |-----|      |        |-------|
  |                          |
------------------------------FW
  | (splunk ports allowed through)
|-------|
|192.168|
|.1.100 |
|(idxr1)|
|-------|
0 Karma

tpeveler_splunk
Splunk Employee
Splunk Employee
0 Karma
Get Updates on the Splunk Community!

Enter the Agentic Era with Splunk AI Assistant for SPL 1.4

  🚀 Your data just got a serious AI upgrade — are you ready? Say hello to the Agentic Era with the ...

Stronger Security with Federated Search for S3, GCP SQL & Australian Threat ...

Splunk Lantern is a Splunk customer success center that provides advice from Splunk experts on valuable data ...

Accelerating Observability as Code with the Splunk AI Assistant

We’ve seen in previous posts what Observability as Code (OaC) is and how it’s now essential for managing ...