# Access elasticsearch from public ip instead of LAN ipv4 **URL:** \ **Category:** Elasticsearch\ **Created:** [September 10, 2020, 12:27am UTC](https://discuss.elastic.co/t/access-elasticsearch-from-public-ip-instead-of-lan-ipv4/248087 "2020-09-10T00:27:25Z")\ **Posts on this page:** 14\ **Page:** 1
**Author:** ![Abdul\_Samad](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/abdul_samad/32/46709_2.png) [@Abdul\_Samad](https://discuss.elastic.co/u/Abdul_Samad)\ **Post date:** [September 10, 2020, 12:27am UTC](https://discuss.elastic.co/t/access-elasticsearch-from-public-ip-instead-of-lan-ipv4/248087/1 "2020-09-10T00:27:26Z")
I have elasticsearch installed in one machine with 1. local LAN ipv4 = 192.168._._ 2. public ip = 39._._.\* i have http.port: 9200 network.host: 0.0.0.0 in my elasticsearch.yml I can access this with in same network: ipv4:9200 but i want to access elasticsearch from different machine with publicip:9200, but i can't access it. ---
**Author:** ![warkolm](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/warkolm/32/39224_2.png) [@warkolm](https://discuss.elastic.co/u/warkolm)\ **Post date:** [September 10, 2020, 12:29am UTC](https://discuss.elastic.co/t/access-elasticsearch-from-public-ip-instead-of-lan-ipv4/248087/2 "2020-09-10T00:29:12Z")
Please read [Is it safe to expose Elasticsearch to the Internet?](https://discuss.elastic.co/t/is-it-safe-to-expose-elasticsearch-to-the-internet/247041) first. > [@Abdul\_Samad](#): > > network.host: 0.0.0.0 in my elasticsearch.yml That means Elasticsearch will use any and all IPs that are attached to network interfaces on the host. > [@Abdul\_Samad](#): > > i want to access elasticsearch from different machine with publicip:9200, but i can't access it. Is there a firewall in place? ---
**Author:** ![Abdul\_Samad](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/abdul_samad/32/46709_2.png) [@Abdul\_Samad](https://discuss.elastic.co/u/Abdul_Samad)\ **Post date:** [September 10, 2020, 12:32am UTC](https://discuss.elastic.co/t/access-elasticsearch-from-public-ip-instead-of-lan-ipv4/248087/3 "2020-09-10T00:32:51Z")
**Yes, I have also created inbound rules for port 9200 and 9300.** Before creating rules, i was not even getting access with ipv4:9200. But i am now getting access with ipv4:9200. Now i want to access elasticsearch from different machine with diferent network with [http://publicip:9200](http://publicip:9200) I am getting "site can't be reached" ---
**Author:** ![warkolm](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/warkolm/32/39224_2.png) [@warkolm](https://discuss.elastic.co/u/warkolm)\ **Post date:** [September 10, 2020, 12:35am UTC](https://discuss.elastic.co/t/access-elasticsearch-from-public-ip-instead-of-lan-ipv4/248087/4 "2020-09-10T00:35:07Z")
You do not want to expose port 9300 to the internet, there's no reason to at all. Can you curl the public IP on 9200 to get a response? Are you sure that IP is attached to a network interface on the host? ---
**Author:** ![Abdul\_Samad](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/abdul_samad/32/46709_2.png) [@Abdul\_Samad](https://discuss.elastic.co/u/Abdul_Samad)\ **Post date:** [September 10, 2020, 12:37am UTC](https://discuss.elastic.co/t/access-elasticsearch-from-public-ip-instead-of-lan-ipv4/248087/5 "2020-09-10T00:37:03Z")
There is no response is in curl. Can you tell how should i attach my public ip to the network interface on the windows host? ---
**Author:** ![warkolm](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/warkolm/32/39224_2.png) [@warkolm](https://discuss.elastic.co/u/warkolm)\ **Post date:** [September 10, 2020, 12:42am UTC](https://discuss.elastic.co/t/access-elasticsearch-from-public-ip-instead-of-lan-ipv4/248087/6 "2020-09-10T00:42:39Z")
That depends on the OS. ---
**Author:** ![Abdul\_Samad](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/abdul_samad/32/46709_2.png) [@Abdul\_Samad](https://discuss.elastic.co/u/Abdul_Samad)\ **Post date:** [September 10, 2020, 12:43am UTC](https://discuss.elastic.co/t/access-elasticsearch-from-public-ip-instead-of-lan-ipv4/248087/7 "2020-09-10T00:43:39Z")
i am using windows 10. ---
**Author:** ![warkolm](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/warkolm/32/39224_2.png) [@warkolm](https://discuss.elastic.co/u/warkolm)\ **Post date:** [September 10, 2020, 1:03am UTC](https://discuss.elastic.co/t/access-elasticsearch-from-public-ip-instead-of-lan-ipv4/248087/8 "2020-09-10T01:03:35Z")
`ipconfig` in a command prompt should show you. ---
**Author:** ![Abdul\_Samad](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/abdul_samad/32/46709_2.png) [@Abdul\_Samad](https://discuss.elastic.co/u/Abdul_Samad)\ **Post date:** [September 10, 2020, 1:38am UTC](https://discuss.elastic.co/t/access-elasticsearch-from-public-ip-instead-of-lan-ipv4/248087/9 "2020-09-10T01:38:25Z")
ipconfig shows me [localIP] which is 192.168._._ I want to access elasticsearch with public ip from different machine which is 39.xxx.xxx.xxx ---
**Author:** ![warkolm](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/warkolm/32/39224_2.png) [@warkolm](https://discuss.elastic.co/u/warkolm)\ **Post date:** [September 10, 2020, 1:45am UTC](https://discuss.elastic.co/t/access-elasticsearch-from-public-ip-instead-of-lan-ipv4/248087/10 "2020-09-10T01:45:37Z")
If it doesn't show the public IP then you will need to get it assigned to an interface. That's outside the scope of what we can help with sorry. ---
**Author:** ![stephenb](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/stephenb/32/40856_2.png) [@stephenb](https://discuss.elastic.co/u/stephenb)\ **Post date:** [September 10, 2020, 2:46am UTC](https://discuss.elastic.co/t/access-elasticsearch-from-public-ip-instead-of-lan-ipv4/248087/11 "2020-09-10T02:46:41Z")
> [@Abdul\_Samad](#): > > Now i want to access elasticsearch from different machine with diferent network with [http://publicip:9200](http://publicip:9200) Hi @Abdul_Samad I just want to add to what @warkolm said. 1st please read the discussion that he posted, it is very important. 2nd so it is exactly clear if you make Elasticsearch as you describe above using http on a truly public IP anyone on the Internet can read, create, delete alter your data. At the very least secure it with SSL and Basic Authentication. See [here](https://www.elastic.co/guide/en/elasticsearch/reference/7.9/elasticsearch-security.html) ---
**Author:** ![rcowart](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/rcowart/32/88091_2.png) [@rcowart](https://discuss.elastic.co/u/rcowart)\ **Post date:** [September 10, 2020, 3:29pm UTC](https://discuss.elastic.co/t/access-elasticsearch-from-public-ip-instead-of-lan-ipv4/248087/12 "2020-09-10T15:29:34Z")
This is most likely a network configuration issue than an Elasticsearch issue. While forwarding ports from the internet facing IP of your router/firewall will allow _public_ clients to access Elasticsearch. It will not allow _private/internal_ clients to access Elasticsearch via the same public IP. Your router/firewall must support and be configured for [NAT "hairpinning"](https://en.wikipedia.org/wiki/Hairpinning) to do that. Even if you can configure NAT hairpinning, I would recommend against this, as it means all traffic to/from Elasticsearch MUST traverse your router/firewall, only to be turned around and sent back out the same interface that it entered. This unnecessarily adds latency and impacts performance. A better solution is to leverage DNS to direct traffic to Elasticsearch by hostname or FQDN. Your external DNS provider would be configured to resolve public DNS requests to the public IP, while your internal DNS would be configured to resolve to the private IP. This ensures that both internal and external clients can reach Elasticsearch, even if your router/firewall doesn't support hairpinning, and with the best performance. ---
**Author:** ![PuffPuff\_Pass](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/puffpuff_pass/32/72188_2.png) [@PuffPuff\_Pass](https://discuss.elastic.co/u/PuffPuff_Pass)\ **Post date:** [September 14, 2020, 12:46pm UTC](https://discuss.elastic.co/t/access-elasticsearch-from-public-ip-instead-of-lan-ipv4/248087/13 "2020-09-14T12:46:42Z")
HelloAbdul, When a service/app is started it is looking for the assigned network interface to.listen to, having it 0.0.0.0 it means it accepts data and can talk to everyone no matter from where the query comes, so if you have 3-4 network cards on that server with different IPs it means you can insert data from different networks, internal or external, even from localhost ( 127.0.0.1 ),. So let's say you have 2 network cards with IPs 192.168.0.2, 10.10.0.2 and 127.0.0.1. If you set 0.0.0.0 as the ip to listen to, everyone can i sert data or query your db, from 10.10.x.x and 192.168.0.x and 127.0.0.1. If you want it to be accesible from the internet ( which is not really recomended ) you need to know very well your usecase. If you are behind a personal gateway ( router provided by your ISP ) i would make the ip in the config to be the internal ip of the server that provides internet access ( 192.168.x.x and i recomend port forwarding in the gateway from the public IP to your local on specific ports that you need. DO NOT set the gateway in DMZ towards your elasticsearch internal IP as all the ports of that machine will be exposed to the internet and you open the door for more vulnerabilities not only the database. You can then create rules in the machine's firewall to allow access on those ports only from specific machines using mac address filtering or ip filtering or any other trust mechanism you see fit ( tls and ssl auth might add another layer of security that you need ) If you are behind a corporate firewall make sure your IT dept makes comprehensive rules from the public ip to your elasticsearch server. If it would be me wanting to provide a customer or some friend access to my data using kibana, grafana or any other custom tool that does not have access to my private network i would vpn the kibana in my network, mKe it talk with the elasticsearch and expose that kibana/grafana/whatever.tool machine only on port 5601 or the proxy port you use but i would stillenforce authentication between the 2 with tls, also activate user authentication and well defined user rights per group, that way not everyone can write or delete from your db. This is if you want to play and se how things work. As best practices, i would use one of the main rules in database security : NEVER EXPOSE YOUR DB TO THE INTERNET unless it'sa honeypot Hope this helps ---
**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\ **Post date:** [October 12, 2020, 12:46pm UTC](https://discuss.elastic.co/t/access-elasticsearch-from-public-ip-instead-of-lan-ipv4/248087/14 "2020-10-12T12:46:52Z")
This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.