Use network access control lists to protect your deployment

You can limit network access to your Splunk Enterprise deployment by using access control lists (ACLs) in configuration files to restrict incoming network traffic to deployment components such as indexers and search heads.

Splunk Cloud Platform has security safeguards in place that limit access to nearly all components except for Splunk Web from external networks. You can also configure which addresses on your network have access to components of Splunk Cloud Platorm using the Splunk Cloud Platform Admin Config Service (ACS) API.

Configure network ACLs in Splunk Cloud Platform

To learn about how to use the Splunk Cloud Platform ACS API to limit network access to your Splunk Cloud Platform instance, see Configure IP allow lists for Splunk Cloud Platform.

Configure network ACLs in Splunk Enterprise

To configure ACLs to protect a Splunk Enterprise deployment, use the server.conf and inputs.conf configuration files to specify the network IP addresses that the deployment can accept or reject for various communications. It's not possible to perform this configuration with Splunk Web.

When you configure an ACL, you supply one or more IP addresses to determine what the instance is to accept or reject. You separate multiple addresses with either commas or spaces. You can provide the addresses in the following formats:

Type of address	Format example
A single IPv4 or IPv6 network address	10.1.2.3, fe80::4a3
A Classless Inter-Domain Routing (CIDR) block of network addresses	10/8 (which stands for "all addresses in the 10.0.0.0 block", fe80:1234/32
A DNS name, potentially using a * (asterisk) as a wildcard	myhost.example.com, *.splunk.com
Anything	*

To prevent inclusion of an address, place an ! (exclamation point) in front of that address, for example, !10.1/16.

The Splunk platform applies the rules in order, and uses the first rule that matches. For example, !10.1/16, * means to let connections in from any address except those that are in the 10.1.*.* network.

Where to configure network ACLs in Splunk Enterprise

You can secure IP addresses for the following connections by editing the accept_from setting in various configuration files. Where you edit the setting depends on the kind of network access that you want to control. See the following table for information on where you can establish ACLs with the accept_from setting.

Changes to access control lists happen when you reload the Splunk Enterprise configuration.

If you want to	Edit this file	Add to this stanza	Notes
Instruct a node to only accept replicated data from other nodes with specific IP addresses	server.conf	httpServer	If you configure this setting for indexer clusters, you must confirm that you include the IP addresses of all other peers in the cluster. For more information about clusters, see About clusters and index replication For more information about the server.conf file, see the server.conf specification file
Restrict TCP communications to specific IP addresses	inputs.conf	tcp	Changes in this file overwrite the output values in the server.conf file if there are conflicts
Restrict TCP communications that use transport layer security (TLS) to specific IP addresses	inputs.conf	tcp-ssl
Configure your indexer to accept data only from forwarders with specific IP addresses	inputs.conf	splunktcp	Edit the inputs.conf file on the indexer where you want to restrict inbound access.
Restrict User Datagram Protocol (UDP) communications to specific IP addresses	inputs.conf	UDP	For more information about the inputs.conf, see the specification file for inputs.conf.