# Proxy / Forwarder security issue **URL:** \ **Category:** Elastic Cloud Enterprise (ECE)\ **Created:** [October 24, 2019, 1:55pm UTC](https://discuss.elastic.co/t/proxy-forwarder-security-issue/205082 "2019-10-24T13:55:27Z")\ **Posts on this page:** 6\ **Page:** 1
**Author:** ![robrotheram](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/robrotheram/32/27262_2.png) [@robrotheram](https://discuss.elastic.co/u/robrotheram)\ **Post date:** [October 24, 2019, 1:55pm UTC](https://discuss.elastic.co/t/proxy-forwarder-security-issue/205082/1 "2019-10-24T13:55:27Z")
Hi I am trialing ECE and I have setup secure route to a new cluster and that works fine. I get a access denied when I try and access it from anywhere except the host I allowed. But I can hit the frc-services-forwarders-services-forwarder (port 9244) on a server that is only a allocator. If I spoof the address for the cluster ie. add the cluster-id.ece-address.local to the allocator ip in the host file I can access the cluster anywhere I do this change. This raise some security concerns, also that communication looks to be frc-services-forwarders-services-forwarder http only. Does the poxy terminate the tls connection and its http to the elasticsearch cluster or is the something missing. ---
**Author:** ![Alex\_Piggott](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/alex_piggott/32/11053_2.png) [@Alex\_Piggott](https://discuss.elastic.co/u/Alex_Piggott)\ **Post date:** [October 24, 2019, 4:07pm UTC](https://discuss.elastic.co/t/proxy-forwarder-security-issue/205082/2 "2019-10-24T16:07:14Z")
It is intended that the services forwarder allows any allocator to make an HTTP request to any other allocator via the proxy - it's how Kibana and Stack monitoring work. In terms of security, the Services Forwarder route looks like: `cluster instance -> (http) localhost:9244 -> (https) proxy -> (https) -> other cluster` So all _network_ traffic is encrypted (provided each allocator host blocks 9244 access from external IPs, eg via `iptables`). In-memory traffic is unencrypted (but of course the allocator contains all the data unencrypted to local users anyway) Does that address your concerns? Alex ---
**Author:** ![robrotheram](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/robrotheram/32/27262_2.png) [@robrotheram](https://discuss.elastic.co/u/robrotheram)\ **Post date:** [October 24, 2019, 9:09pm UTC](https://discuss.elastic.co/t/proxy-forwarder-security-issue/205082/3 "2019-10-24T21:09:58Z")
So if I understand correctly Services Forwarder is used for services on that host to send data to other clusters. The internal cluster transport e.g for shard moving is all done via TLS. Does the proxy do any TLS termination or is the termination of my connection done at the elastic cluster? Is there any documentation for security hardening ECE, I saw nothing about needing to iptable off 9244? ---
**Author:** ![Alex\_Piggott](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/alex_piggott/32/11053_2.png) [@Alex\_Piggott](https://discuss.elastic.co/u/Alex_Piggott)\ **Post date:** [October 24, 2019, 9:18pm UTC](https://discuss.elastic.co/t/proxy-forwarder-security-issue/205082/4 "2019-10-24T21:18:08Z")
> [@robrotheram](#): > > So if I understand correctly Services Forwarder is used for services on that host to send data to other clusters. > The internal cluster transport e.g for shard moving is all done via TLS. That's exactly right yes > [@robrotheram](#): > > Does the proxy do any TLS termination or is the termination of my connection done at the elastic cluster? The proxy terminates TLS and has its own internal certification for `proxy<->ES/Kibana` communications. > [@robrotheram](#): > > Is there any documentation for security hardening ECE, I saw nothing about needing to iptable off 9244? The list of which ports you should allow (the implication being that all others should be blocked) is here: [Networking | Elastic Cloud Enterprise Reference [2.3] | Elastic](https://www.elastic.co/guide/en/cloud-enterprise/2.3/ece-prereqs-networking.html) (It doesn't mention 9244 because it's intended to be blocked) It would probably be good if we linked to this from [Security considerations | Elastic Cloud Enterprise Reference [2.3] | Elastic](https://www.elastic.co/guide/en/cloud-enterprise/2.3/ece-security-considerations.html) and also were more explicit on that page that other ports should be blocked (at least inbound), I think? Alex ---
**Author:** ![robrotheram](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/robrotheram/32/27262_2.png) [@robrotheram](https://discuss.elastic.co/u/robrotheram)\ **Post date:** [October 24, 2019, 9:23pm UTC](https://discuss.elastic.co/t/proxy-forwarder-security-issue/205082/5 "2019-10-24T21:23:16Z")
That has been very helpful Thanks ---
**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\ **Post date:** [November 7, 2019, 9:23pm UTC](https://discuss.elastic.co/t/proxy-forwarder-security-issue/205082/6 "2019-11-07T21:23:26Z")
This topic was automatically closed 14 days after the last reply. New replies are no longer allowed.