Avoid/Remove inter-node communication in elasticsearch

Elastic Stack Elasticsearch
1

Hi,
I am looking for a way to avoid inter-node communication (that happens through port 9300),
Is there a way to block this.

Thanks

2

What's your aim for doing that?

3

As of now i need only one node for testing and development purposes, and taking security into consideration i want to block inter-node communication(also i have completely removed x-pack as well).

4

If you don't have other nodes listed in the unicast list, then the existing node will not try to contact any others.

6

You will need a firewall on the host then.

7

Thank you for your reply,is it the only way

8

The only other option would be to listen on localhost.

9

I blocked the port in firewall but still its listening on port 9300.

10

i have completely removed x-pack as well

Why not downloading the OSS version then?

11

no i am debugging elasticsearch in eclipse.

12

You can't stop it listening on 9300. You can only block external access to it.

13

I tried to stop binding of socketaddress .
and it threw me this error,
BindTransportException[Failed to bind to [9300]]; nested: NullPointerException;
Is there any reason why i can't stop listening through transport layer.

14

This is not supported I think.
What did you do? Did you modify elasticsearch code?

15

Yes i did modify netty code for transport.
Actually i dont want inter-node communication to happen,I have been trying many things but nothing seems to be working.

16

Can't we run elasticsearch without communication through 9300, that is just through rest.

17

Yes i did modify netty code for transport.

Then you introduced most likely the NullPointerException.

Can't we run elasticsearch without communication through 9300, that is just through rest.

No you can't. The only settings you can work with are: Transport | Elasticsearch Guide [8.11] | Elastic

Actually i dont want inter-node communication to happen,I have been trying many things but nothing seems to be working.

I got that. That's IMO a waste of your time. Just block 9300 on a firewall level and you'll be sure that no one would be able to access your machine.

But as already said you can easily do:

network.host: your_ip
transport.host: localhost

Then you can test from another machine if you can reach 9300 using telnet. I'm sure you won't be able.

1 Like
18

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.