# Rest API Potential Design Flaw **URL:** \ **Category:** Development\ **Created:** [October 30, 2017, 10:09am UTC](https://community.graylog.org/t/rest-api-potential-design-flaw/2951 "2017-10-30T10:09:45Z")\ **Posts on this page:** 4\ **Page:** 1
**Author:** ![GTownson](https://sea2.discourse-cdn.com/flex016/user_avatar/community.graylog.org/gtownson/32/793_2.png) [@GTownson](https://community.graylog.org/u/GTownson)\ **Post date:** [October 30, 2017, 10:09am UTC](https://community.graylog.org/t/rest-api-potential-design-flaw/2951/1 "2017-10-30T10:09:45Z")
We have a Graylog instance hosted on a clients site, we have firewall rules in to allow our office IP to be able to connect to the virtual machine with Graylog on. The Graylog instance is hosting the Rest API on the external IP of the virtual machine, this allows our browsers to connect to the Rest API due to the existing firewall rules. However when the Rest API is on the external address Graylog has to go out and then connect back on itself which doesn’t work as the firewall blocks it. I then changed the Rest API to the internal address of the virtual machine, but then we can’t login as our browsers can’t connect to the API. Overall this seems kind of like a potential design flaw. We already have a firewall rule to allow our IP to the external IP of the virtual machine over port 9000, but then Graylog can’t access the API on this IP. So setting the IP to the internal address so that Graylog can access it means that our browsers can’t access it. We have had to ask our clients to put in another firewall rule. So am I doing something wrong? or is this just the way in which Graylog is designed? Cheers, George ---
**Author:** ![jan](https://sea2.discourse-cdn.com/flex016/user_avatar/community.graylog.org/jan/32/11_2.png) [@jan](https://community.graylog.org/u/jan)\ **Post date:** [November 6, 2017, 7:23am UTC](https://community.graylog.org/t/rest-api-potential-design-flaw/2951/2 "2017-11-06T07:23:38Z")
hej @GTownson When you need to connect from multiple Networks to Graylog, the easiest option would be to use a proxy ( [http://docs.graylog.org/en/2.3/pages/configuration/web\_interface.html#making-the-web-interface-work-with-load-balancers-proxies](http://docs.graylog.org/en/2.3/pages/configuration/web_interface.html#making-the-web-interface-work-with-load-balancers-proxies) ). ---
**Author:** ![GTownson](https://sea2.discourse-cdn.com/flex016/user_avatar/community.graylog.org/gtownson/32/793_2.png) [@GTownson](https://community.graylog.org/u/GTownson)\ **Post date:** [November 6, 2017, 4:13pm UTC](https://community.graylog.org/t/rest-api-potential-design-flaw/2951/3 "2017-11-06T16:13:37Z")
I resolved the issue in this forum post. > [@Graylog API Call Timing Out](https://community.graylog.org/t/graylog-api-call-timing-out/2868/): > > When I tried to start and input I got an error about the input not being able to start. The popup suggested I check my error logs, here is what I see: 2017-10-23T10:47:51.826+01:00 WARN [ProxiedResource] Unable to call http://VMExternalIP:9000/api/system/metrics/multiple on node \<0e3dcc02-a09a-4a7f-b9eb-13ff286b89f8\> java.net.SocketTimeoutException: connect timed out I have provided what I deem to be the relevant parts of my config. rest\_listen\_uri = http://InternalP:9000/api/ rest\_transpor… ---
**Author:** ![system](https://us1.discourse-cdn.com/flex016/uploads/graylog/original/3X/c/7/c7c09c6b5099570133d6502b83f50ba4430de5b6.png) [@system](https://community.graylog.org/u/system)\ **Post date:** [November 20, 2017, 4:13pm UTC](https://community.graylog.org/t/rest-api-potential-design-flaw/2951/4 "2017-11-20T16:13:45Z")
This topic was automatically closed 14 days after the last reply. New replies are no longer allowed.