# Elasticsearch and Kibana network.host CIDR? **URL:** \ **Category:** Elasticsearch\ **Created:** [August 26, 2021, 9:28pm UTC](https://discuss.elastic.co/t/elasticsearch-and-kibana-network-host-cidr/282612 "2021-08-26T21:28:43Z")\ **Posts on this page:** 5\ **Page:** 1
**Author:** ![Tydorius](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/tydorius/32/88729_2.png) [@Tydorius](https://discuss.elastic.co/u/Tydorius)\ **Post date:** [August 26, 2021, 9:28pm UTC](https://discuss.elastic.co/t/elasticsearch-and-kibana-network-host-cidr/282612/1 "2021-08-26T21:28:43Z")
Good afternoon (At least, for EST) - Do the various hosts field in the elasticsearch.yml and kibana.yml file support CIDR for restricting access to specific subnets? I attempted to set ```auto network.host: 10.0.0.0/24 ``` And Elasticsearch failed to start, but it starts fine if I set it to a specific local IP or if I set it to 0.0.0.0. I can set up whitelist-only firewall rules or other security measures, but ideally I would like a clean way to restrict network.host (elasticsearch) and server.host (kibana) to specific subnets if possible. It's entirely possible (And likely) that this is already possible, and terms like subnet and CIDR simply aren't getting me anywhere when searching. Thank you for your time! ---
**Author:** ![Iker](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/iker/32/91708_2.png) [@Iker](https://discuss.elastic.co/u/Iker)\ **Post date:** [August 26, 2021, 9:49pm UTC](https://discuss.elastic.co/t/elasticsearch-and-kibana-network-host-cidr/282612/2 "2021-08-26T21:49:22Z")
I haven't seen any network restriction options in the config files for Kibana or elastic; the option "network.host" is the network address in which the services are going to listen (From the local interfaces, 0.0.0.0 is all interfaces); if you want to restrict the access, use a reverse proxy(Nginx, HAProxy, etc.) or firewall. ---
**Author:** ![DavidTurner](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/davidturner/32/22453_2.png) [@DavidTurner](https://discuss.elastic.co/u/DavidTurner)\ **Post date:** [August 26, 2021, 10:00pm UTC](https://discuss.elastic.co/t/elasticsearch-and-kibana-network-host-cidr/282612/3 "2021-08-26T22:00:49Z")
This isn't possible today (except for the [special values](https://www.elastic.co/guide/en/elasticsearch/reference/current/modules-network.html#network-interface-values), notably `_site_` means `10.0.0.0/8,172.16.0.0/12,192.168.0.0/16` which might work for you). But this isn't the first time someone has suggested this feature, I think it makes a lot of sense, and it doesn't look too hard to implement. A PR would be welcome! ---
**Author:** ![Tydorius](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/tydorius/32/88729_2.png) [@Tydorius](https://discuss.elastic.co/u/Tydorius)\ **Post date:** [September 2, 2021, 1:51pm UTC](https://discuss.elastic.co/t/elasticsearch-and-kibana-network-host-cidr/282612/4 "2021-09-02T13:51:50Z")
It would definitely be useful for smaller deployments that do not wish to handle individual port/routing security on their local network - But for now, I'll go that route. I'll just use iptables or something and set my Elastic and Kibana to 0.0.0.0. Thank you for your responses! **For anyone that finds this message in the future, here is the solution I will be using:** ```auto iptables -A INPUT -p tcp --dport 9200 -s 10.0.0.0/8 -j ACCEPT iptables -A INPUT -p tcp --dport 9200 -j DROP iptables -A INPUT -p tcp --dport 5601-s 10.0.0.0/8 -j ACCEPT iptables -A INPUT -p tcp --dport 5601 -j DROP ``` With the caveat that the CIDR range will be replaced with whatever I'm using for Elastic and Kibana respectively. ---
**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\ **Post date:** [September 30, 2021, 1:52pm UTC](https://discuss.elastic.co/t/elasticsearch-and-kibana-network-host-cidr/282612/5 "2021-09-30T13:52:24Z")
This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.