Splunk’s web interface runs on port 8000 by default. That’s fine for internal access, but if you want to expose it on the standard HTTPS port (443) without running Splunk as root or setting up a reverse proxy, firewalld’s port forwarding is the simplest solution.

One command, no extra services, and Splunk stays on its default port.

The Problem

Binding to ports below 1024 requires root privileges on Linux. Splunk runs as the splunk user (as it should), so it can’t bind directly to 443. Your options:

  1. Reverse proxy (nginx, HAProxy) — Works, but adds complexity and another service to maintain
  2. setcap — Grant the Splunk binary the CAP_NET_BIND_SERVICE capability. Works but feels hacky and can break on upgrades
  3. firewalld port forwarding — Redirect 443 → 8000 at the kernel level. Clean and simple

Option 3 is the path of least resistance for a single-server setup.

The Command

1
2
firewall-cmd --permanent --add-forward-port=port=443:proto=tcp:toport=8000
firewall-cmd --reload

That’s it. Traffic hitting port 443 now gets forwarded to 8000. Splunk doesn’t know or care — it’s still listening on 8000.

Breaking It Down

The --add-forward-port syntax:

port=443        # incoming port to intercept
proto=tcp       # protocol (tcp or udp)
toport=8000     # destination port on this host
toaddr=         # destination IP (optional, omit for localhost)

If you wanted to forward to a different host:

1
firewall-cmd --permanent --add-forward-port=port=443:proto=tcp:toport=8000:toaddr=10.0.0.50

But for same-host forwarding, just omit toaddr.

Verification

Check the rule exists:

1
firewall-cmd --list-forward-ports

Output:

port=443:proto=tcp:toport=8000:toaddr=

Test access from another machine:

1
curl -kI https://splunk.example.com

You should see Splunk’s web interface (or a redirect to /en-US/account/login).

Don’t test with curl https://localhost on the Splunk server itself. firewalld’s forward rule only applies to traffic arriving over the network — connections that start on the same host never pass through it, so a local test fails even when the forward is working.

Splunk SSL Configuration

This forwards TCP packets — it doesn’t handle SSL termination. Splunk needs to serve HTTPS on port 8000 for this to work properly.

In $SPLUNK_HOME/etc/system/local/web.conf:

1
2
[settings]
enableSplunkWebSSL = true

Restart Splunk:

1
/opt/splunk/bin/splunk restart

If you want to use your own certificate instead of Splunk’s self-signed one:

1
2
3
4
[settings]
enableSplunkWebSSL = true
privKeyPath = /opt/splunk/etc/auth/mycerts/server.key
serverCert = /opt/splunk/etc/auth/mycerts/server.pem

Removing the Forward

If you need to remove it later:

1
2
firewall-cmd --permanent --remove-forward-port=port=443:proto=tcp:toport=8000
firewall-cmd --reload

Common Issues

“Permission denied” or Connection Refused

Make sure port 443 is open in firewalld:

1
2
firewall-cmd --permanent --add-port=443/tcp
firewall-cmd --reload

Or add the https service:

1
2
firewall-cmd --permanent --add-service=https
firewall-cmd --reload

Forwarding Not Working

Check if IP forwarding is enabled:

1
sysctl net.ipv4.ip_forward

If it returns 0, enable it:

1
2
echo 'net.ipv4.ip_forward = 1' >> /etc/sysctl.conf
sysctl -p

Note: For same-host forwarding, this usually isn’t required, but cross-host forwarding needs it.

Splunk Still Shows Port 8000 in URLs

Splunk doesn’t know about the 443 → 8000 forward, so anything it generates from its own configured port (some links in alert emails, for example) will still say 8000. Browser redirects are usually fine because they follow the Host header the client sent.

If that matters for your setup, a reverse proxy is the cleaner fix. But if you’re just accessing Splunk directly and don’t mind the occasional port-8000 reference in logs or redirects, the forwarding works fine.

Why Not Just Change Splunk’s Port?

You can configure Splunk to listen on any port in web.conf:

1
2
[settings]
httpport = 443

But then you need to either: - Run Splunk as root (bad idea) - Use setcap on the Python binary Splunk uses (breaks on upgrades) - Use authbind (another package to manage)

Port forwarding at the firewall level avoids all of that. Splunk stays on 8000, running as an unprivileged user, and the kernel handles the redirect.

Automating with Ansible

If you’re managing multiple Splunk servers:

1
2
3
4
5
6
7
8
9
- name: Forward 443 to Splunk web port
  ansible.posix.firewalld:
    port_forward:
      - port: 443
        proto: tcp
        toport: 8000
    permanent: true
    immediate: true
    state: enabled

Or using the command module if you prefer the explicit syntax:

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
- name: Forward 443 to Splunk web port
  command: firewall-cmd --permanent --add-forward-port=port=443:proto=tcp:toport=8000
  notify: reload firewalld

- name: Ensure HTTPS service is allowed
  ansible.posix.firewalld:
    service: https
    permanent: true
    immediate: true
    state: enabled

Summary

For single-server Splunk deployments where you just want 443 access without the overhead of a reverse proxy:

1
2
3
4
5
6
7
8
# Enable forwarding
firewall-cmd --permanent --add-forward-port=port=443:proto=tcp:toport=8000
firewall-cmd --permanent --add-service=https
firewall-cmd --reload

# Verify (run the curl from another machine)
firewall-cmd --list-forward-ports
curl -kI https://splunk.example.com

Simple, no extra services, survives reboots. For more complex setups (multiple backends, load balancing, SSL termination with custom certs), a proper reverse proxy makes more sense. But for “I just want to hit Splunk on 443,” this is the cleanest path.