How to Send Linux Server logs with an external IP to splunk server with no external IP?

[naseeb41]

I have a Splunk server which doesn't have an external IP and all my servers with private IP can send their logs through Splunk Universal forwarder to Splunk, but I have couple of servers which are hosted elsewhere and can't talk to the splunk server because it doesn't have an external IP. Is there any way or solution to have my external servers send their logs to my internal Splunk server? I appreciate any suggestion or solution to this issue.

Thank you,

[Richfez]

You can daisy-chain forwarders. So, your externally-hosted servers can forward to some device in your DMZ, which forwards that on to your indexer. Here are the docs on how to configure an intermediate forwarder which will help you configure your intermediate device.

In a nutshell, the outside boxes would point to the Intermediate forwarder (which has one interface public and another private with both sides firewalled), then the intermediate forwarder points to your internal Wplunk server. Think of it like a proxy.

[naseeb41]

Thank you so much for your help. So, I just installed a universal forwarder on the server which is not in my DMZ and on output.conf I specified the name of the receiving server ( intermediate forwarder) in my DMZ with a public interface. Now where can I see in intermediate forwarder if the logs from other servers were forwarded and how to test the connection between intermediate forwarder and the universal forwarder? Do I have to change any other configurations?

I really appreciate your help.