Forwarder behind a proxy

[Matthias_BY]

Hi,

i want to send out data with an forwarder to a splunk indexer hosted in the web like splunk storm.

Is it possible to route the traffic of a forwarder over a proxy server?

br
matthias

[mnatkin_splunk]

While forwarder-to-indexer traffic can be wrapped in SSL, it's not technically an HTTP connection, and therefore won't properly traverse a web proxy.

The 2 ways I know how to accomplish this are as follows:

1. Use an intermediate forwarder (generally within a DMZ). Internal hosts have access to this host, and send their logs to the IMF. That host has outbound access to the indexer layer.
2. Use a SOCKS v5 Proxy

If you wish to secure your forwarder-to-indexer traffic behind a proxy, note that as of 6.3, Splunk supports the use of SOCKS v5 proxies for forwarder-to-indexer traffic. Details are available on-line at:

http://docs.splunk.com/Documentation/Splunk/6.6.3/Forwarding/ConfigureaforwardertouseaSOCKSproxy

[chauhananand]

New link to doc:
https://docs.splunk.com/Documentation/Splunk/9.1.1/Forwarding/ConfigureaforwardertouseaSOCKSproxy

[eddiewebb]

Found another user with this problem, answers.splunk.com/answers/85935/forward-to-splunk-storm-using-universal-forwarder-through-proxy

They quote a insufficient response from splunk

If the problem is directly linked to
your company proxy (or firewall),
there is nothing that we can do.
Splunk protocol requires a connection
on the port 9997, with acknowledgement
back. Please contact your entreprise
network team to see if they can open
the port and route the data to it.

Also found this article - docs.splunk.com/Documentation/Splunk/6.0/Forwarding/Setupforwardingandreceiving

Note: You cannot forward data across a proxy, because the communication between forwarder and receiver does not use the HTTP protocol.

[msn2507]

Yes, the documentation is here

http://docs.splunk.com/Documentation/Splunk/5.0.4/admin/Specifyaproxyserver

[eddiewebb]

Confirmed that setting PROXY, HTTP_PROXY, and HTTPS_PROXY in the universal forwarder's splunk-launch.conf has no effect on this issue.

[Matthias_BY]

Hi,

sorry that is not the answer. You're referring to splunk web. i'm asking for forwarder traffic.

br