Splunk Cloud Forwarder Static IP Allowlisting for s2s

A Splunk universal or heavy forwarder is not an HEC client. It sends forwarder-to-indexer traffic through Splunk's s2s path. A Python HTTP request to HEC proves an HTTPS client path, but it does not prove that a forwarder's port 9997 socket uses the same source IP.

The correct static-IP design keeps those transports separate. Put both QuotaGuard subscription addresses in the Splunk s2s feature list only after the actual forwarder host sends port 9997 through a supported TCP tunnel.

Splunk Cloud Maps Forwarders to the s2s Feature on Port 9997

Splunk's current IP allow-list documentation maps universal and heavy forwarder ingestion to the s2s feature on port 9997. The list controls which source subnets may send forwarder traffic to the indexer tier.

Splunk documents s2s as open until it is restricted. Once a subnet is added to an open list, only listed sources may reach that feature. A forwarder whose actual egress address is missing from the list won't pass the network boundary.

Splunk also requires the forwarder credentials app for the specific Splunk Cloud deployment. The app supplies the destination and credentials needed by the universal forwarder, heavy forwarder, or deployment server. The source-IP list is an additional network control. It doesn't replace Splunk's connection configuration.

A Forwarder Static-IP Design Needs a TCP Tunnel

QuotaGuard Static's HTTP proxy on port 9293 is appropriate for proxy-aware HTTP and HTTPS clients. It doesn't automatically intercept the raw TCP socket created by a Splunk forwarder. Setting QUOTAGUARDSTATIC_URL for a Python process does not change the forwarder's outputs.conf connection.

QuotaGuard Static also supports SOCKS5 on port 1080 for non-HTTP TCP traffic. A forwarder deployment still needs a local tunnel or connector that accepts the forwarder's TCP connection and carries it through the proxy. That component must run on, or be reachable from, the actual forwarder host.

Use a QuotaGuard-supported tunnel design for the exact operating system, forwarder type, and process model. Don't publish or deploy a generic tunnel command until that path has been exercised with the actual Splunk forwarder runtime.

The Deployment Test Must Prove the Whole Forwarder Path

A production check needs to establish all of these facts:

1. The universal or heavy forwarder connects to the intended Splunk Cloud destination on port 9997.
2. The forwarder's TCP connection enters the local tunnel instead of bypassing it.
3. Splunk sees one of the two IPv4 addresses assigned to the applicable QuotaGuard subscription.
4. Both subscription addresses are present as individual /32 entries in the s2s feature list.
5. Forwarding still works after the forwarder and tunnel processes restart.
6. The deployment remains healthy when traffic uses either address in the QuotaGuard pair.

Record only the client and version, pass or fail, HTTP or TCP status where available, observed source IP, and test date. Keep forwarder credentials, proxy credentials, tokens, and log contents out of test records.

Both Subscription IPs Belong in the s2s Allow List

Each QuotaGuard subscription includes two load-balanced static IPv4 addresses. Enter each one as a separate /32 in the s2s feature list. The pair belongs to the subscription that carries the forwarder traffic, not to the customer account as a whole.

Splunk Web supports the change on eligible deployments:

1. Open Settings, then Server settings, then IP allow list.
2. Confirm token authentication is enabled and your role has the edit_ip_allow_list capability.
3. Select Indexer ingestion, which maps to the s2s feature.
4. Add both QuotaGuard addresses as separate /32 entries.
5. Save the change and allow at least 15 minutes for propagation.

The Splunk Web allow-list guide requires Splunk Cloud Platform 8.2.2201 or later, token authentication, and the edit_ip_allow_list capability. The Admin Config Service API is another supported management path. FedRAMP High allow-list changes must go through Splunk Support.

On AWS deployments, Splunk allows up to 200 subnets per feature and 230 across the applicable feature group. GCP deployments allow up to 200 subnets per feature. A two-address QuotaGuard pair fits within those limits.

The Forwarder Credentials App Still Defines the Splunk Connection

Splunk's forwarder documentation requires the credentials app for the target Splunk Cloud deployment. Install and maintain that app according to Splunk's instructions.

The tunnel changes the network route and source IP. It doesn't replace the credentials app, Splunk's TLS configuration, forwarder load balancing, deployment-server management, or the data-routing rules already defined for the forwarder.

HEC Is the Supported HTTP Route for Application Events

If the source is an application that can send JSON events over HTTPS, HEC is the simpler verified proxy path. Splunk Cloud normally exposes HEC on port 443 and maps it to the hec feature list. A proxy-aware HTTP client can route that request through QuotaGuard directly.

That is a different architecture from a universal or heavy forwarder. See Splunk Cloud HEC and search API static IP allowlisting for the Python Requests example and HEC cutover steps.

QuotaGuard Static Pricing Starts at $19/Month

QuotaGuard Static direct Starter costs $19 per month and includes 20,000 requests and 10 GB of bandwidth. Static supports HTTP and HTTPS proxy traffic on port 9293 and SOCKS5 on port 1080. Starter, Production, and Business use shared static IP pairs. Static Enterprise includes dedicated IPs and proxy resources for $219 per month.

QuotaGuard Shield Pricing Starts at $29/Month

QuotaGuard Shield direct Starter costs $29 per month and includes 20,000 requests and 10 GB of bandwidth. Shield adds TLS on the customer-to-proxy hop for supported proxy and tunnel patterns. It doesn't replace Splunk's own TLS or make the Splunk deployment compliant by itself. Shield Enterprise includes dedicated IPs and proxy resources for $269 per month.

See the complete plan table at quotaguard.com/products/pricing. Contact QuotaGuard support with the forwarder type, operating system, deployment model, and destination before implementing the TCP tunnel.