Security

Splunk behind reverse proxy keeps redirecting me to 127.0.0.1

Contributor

Hi all,

I've place splunkweb behind a reverse proxy and bound splunkweb and splunkd to 127.0.0.1.
The config:

splunk-launch.conf:

SPLUNK_BINDIP=127.0.0.1

web.conf:

[settings]
mgmtHostPort = 127.0.0.1:8189
httpport = 8100
tools.proxy.on = True
enableSplunkWebSSL = True

Apache's httpd.conf:

SSLProxyEngine On
ProxyPass /cgi-bin !
ProxyPass / https://127.0.0.1:8100/ retry=0
ProxyPassReverse / https://127.0.01:8100/ retry=0

When I now open splunk via the reverse proxy (https://mysplunksrv.domain.local), I get redirected to https://127.0.0.1:8100/de-DE/
Hitting directly https://mysplunksrv.domain.local/en-US/account/login opens the login page, after loggin in, I get redirected again to https://127.0.0.1:8100/de-DE/.

Any ideas?
Thx,
Simon

1 Solution

Splunk Employee
Splunk Employee

Seems you have a typo in your ProxyPassReverse directive? But you also should put

ProxyPreserveHost On

in your Apache config.

View solution in original post

Splunk Employee
Splunk Employee

Seems you have a typo in your ProxyPassReverse directive? But you also should put

ProxyPreserveHost On

in your Apache config.

View solution in original post

Contributor

Oh god... how embarassing. The typo was the key. Thanks for pointing it out!

Splunk Employee
Splunk Employee

Seems you have a typo in your ProxyPassReverse directive?

0 Karma

Path Finder

Have you tried using the actual IP of the Splunk system in the Splunk binding? I haven't tried this on my setup, but it looks like the redirect is caused by the Splunk binding. Try using the actual IP of the system and see if it fixes the issue.

0 Karma

Contributor

I only want to access splunk via web proxy, which is bound to the actual ip. Splunk should not listen to any non-local interface. But it works now, it was a typo (see below)

0 Karma