Deployment Architecture

Connecting a search head to indexer through a proxy

mbrunetto
Path Finder

I have the following commands in server.conf:

[proxyConfig]
http_proxy = 192.168.1.5:8080
https_proxy = 192.168.1.5:8080
no_proxy = 192.168.0.0/16, localhost, 127.0.0.1, ::1

In the web GUI, I try to enter a new distributed search peer, 10.15.12.20. This system is not accessible to splunk through routing, but can be reached by connecting to the proxy for an outbound connection. However, when I attempt to enter the distributed peer in the GUI, I can watch the attempted traffic from the search head and see traffic sent directly on the wire to 10.15.12.20 (which is dropped by the firewall), instead of traffic going to 192.168.1.5 to pass through the proxy.

Has anyone experienced this before, or any ideas why the proxyConfig commands may not be working?
I understand that 80/443 are not the standard/ideal ports for this connection, but that's what I'm working with, and once the connection gets to 192.168.1.5, I can begin working on the other problems of the ports, but for now, the SH is putting traffic directly onto the network, and not trying to take advantage of the proxy.

                             FW
|----|          |-----|      |        |-------|
|    |          | 192 |      |(80/443)| 10.15 |
| SH |--------->|168.1|----->|------->| .12.20|
|    |          | .5  |      |        |(idxr2)|
|----|          |-----|      |        |-------|
  |                          |
------------------------------FW
  | (splunk ports allowed through)
|-------|
|192.168|
|.1.100 |
|(idxr1)|
|-------|
0 Karma

tpeveler_splunk
Splunk Employee
Splunk Employee
0 Karma
Get Updates on the Splunk Community!

Upcoming Webinar: Unmasking Insider Threats with Slunk Enterprise Security’s UEBA

Join us on Wed, Dec 10. at 10AM PST / 1PM EST for a live webinar and demo with Splunk experts! Discover how ...

.conf25 technical session recap of Observability for Gen AI: Monitoring LLM ...

If you’re unfamiliar, .conf is Splunk’s premier event where the Splunk community, customers, partners, and ...

A Season of Skills: New Splunk Courses to Light Up Your Learning Journey

There’s something special about this time of year—maybe it’s the glow of the holidays, maybe it’s the ...