# (2021) Can't cURL 9200 from some hosts in network **URL:** \ **Category:** Elasticsearch\ **Created:** [January 6, 2021, 9:57pm UTC](https://discuss.elastic.co/t/2021-cant-curl-9200-from-some-hosts-in-network/260388 "2021-01-06T21:57:02Z")\ **Posts on this page:** 10\ **Page:** 1
**Author:** ![brett.b](https://avatars.discourse-cdn.com/v4/letter/b/ce73a5/32.png) [@brett.b](https://discuss.elastic.co/u/brett.b)\ **Post date:** [January 6, 2021, 9:57pm UTC](https://discuss.elastic.co/t/2021-cant-curl-9200-from-some-hosts-in-network/260388/1 "2021-01-06T21:57:02Z")
Hello everyone, I have seen this question posted in other ways, but a lot of them were about Elasticsearch inside of a docker container. I hope this question is not truly a duplicate. My situation is that I have a DMZ and a core DC. In the core DC, I can curl my client node and get the appropriate cluster overview. From my DMZ node, I have opened up port 9200 TCP traffic. The Logstash node in the DMZ ends up connecting but receiving the "connection reset by peer" ![image](https://us1.discourse-cdn.com/elastic/original/3X/4/6/464fba86f3a35e44ecf0cec6f0080cb7a7e82dbe.png) I have followed some other forums where others suggested updating the `network.host` and I have since set mine to `network.host: _site_`. Does anyone have any debugging suggestions? Thank you for your time! ---
**Author:** ![warkolm](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/warkolm/32/39224_2.png) [@warkolm](https://discuss.elastic.co/u/warkolm)\ **Post date:** [January 6, 2021, 9:59pm UTC](https://discuss.elastic.co/t/2021-cant-curl-9200-from-some-hosts-in-network/260388/2 "2021-01-06T21:59:52Z")
Welcome to our community! 😃 Please don't post pictures of text, they are difficult to read, impossible to search and replicate (if it's code), and some people may not be even able to see them 🙂 However looking at what I can see I would ask if there is a proxy or firewall in use at all? ---
**Author:** ![brett.b](https://avatars.discourse-cdn.com/v4/letter/b/ce73a5/32.png) [@brett.b](https://discuss.elastic.co/u/brett.b)\ **Post date:** [January 6, 2021, 10:11pm UTC](https://discuss.elastic.co/t/2021-cant-curl-9200-from-some-hosts-in-network/260388/3 "2021-01-06T22:11:39Z")
Hey there, I'm sorry - my VMWare console won't let me copy text out of it. Yes, there is a firewall between the DMZ (logstash) and Core (elasticsearch). I was assuming that the connection was established with the elasticsearch client, but do you think that may not be the case? ---
**Author:** ![warkolm](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/warkolm/32/39224_2.png) [@warkolm](https://discuss.elastic.co/u/warkolm)\ **Post date:** [January 6, 2021, 10:13pm UTC](https://discuss.elastic.co/t/2021-cant-curl-9200-from-some-hosts-in-network/260388/4 "2021-01-06T22:13:10Z")
Well a peer reset could be many things, but from my experience it's usually those that cause it. Can you check your Elasticsearch logs, and try a curl from one of the Elasticsearch nodes to itself? ---
**Author:** ![brett.b](https://avatars.discourse-cdn.com/v4/letter/b/ce73a5/32.png) [@brett.b](https://discuss.elastic.co/u/brett.b)\ **Post date:** [January 6, 2021, 10:14pm UTC](https://discuss.elastic.co/t/2021-cant-curl-9200-from-some-hosts-in-network/260388/5 "2021-01-06T22:14:17Z")
Okay, I am not too familiar with the peer resets. From any of the nodes inside the Core network (master, client, data), they can all query any node in the cluster on port 9200 successfully. At first, they couldn't, so I updated my `network.host` info and now they can. That's what led me to believe there was maybe some other simple flag I was missing that may be thwarting this communication. I will gather the ES client logs now ---
**Author:** ![warkolm](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/warkolm/32/39224_2.png) [@warkolm](https://discuss.elastic.co/u/warkolm)\ **Post date:** [January 6, 2021, 10:15pm UTC](https://discuss.elastic.co/t/2021-cant-curl-9200-from-some-hosts-in-network/260388/6 "2021-01-06T22:15:09Z")
Ok, then I would try disabling the firewall and seeing that works? ---
**Author:** ![brett.b](https://avatars.discourse-cdn.com/v4/letter/b/ce73a5/32.png) [@brett.b](https://discuss.elastic.co/u/brett.b)\ **Post date:** [January 6, 2021, 10:17pm UTC](https://discuss.elastic.co/t/2021-cant-curl-9200-from-some-hosts-in-network/260388/7 "2021-01-06T22:17:59Z")
I will work with my team to see if that's possible. Thanks for this recommendation (and your lightning-fast responses). To your knowledge, there aren't any other minor flags I may be overlooking? ---
**Author:** ![warkolm](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/warkolm/32/39224_2.png) [@warkolm](https://discuss.elastic.co/u/warkolm)\ **Post date:** [January 6, 2021, 10:20pm UTC](https://discuss.elastic.co/t/2021-cant-curl-9200-from-some-hosts-in-network/260388/8 "2021-01-06T22:20:20Z")
Not that I can think of. If it works on the cluster level, but not from external, that'd suggest it's nothing to do with Elasticsearch. ---
**Author:** ![brett.b](https://avatars.discourse-cdn.com/v4/letter/b/ce73a5/32.png) [@brett.b](https://discuss.elastic.co/u/brett.b)\ **Post date:** [January 18, 2021, 3:54pm UTC](https://discuss.elastic.co/t/2021-cant-curl-9200-from-some-hosts-in-network/260388/9 "2021-01-18T15:54:35Z")
Hello all - For anyone reading this, my issue was unfortunately firewall, as suggested by warkolm. I'd opened up the correct port (9200) for communication from my DMZ -\> core, but additionally the Palo Alto firewall needed to allow the "type" of traffic, which was considered to be "Web Application". Thanks again, warkolm for bearing with me. ---
**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\ **Post date:** [February 15, 2021, 3:54pm UTC](https://discuss.elastic.co/t/2021-cant-curl-9200-from-some-hosts-in-network/260388/10 "2021-02-15T15:54:42Z")
This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.