Skip to content

Outbound-only monitoring for multi-site networks

Why monitoring many customer networks shouldn't require a single inbound firewall rule, and how the collector-and-hub design achieves it.

9 min read · For msp owners, security and network leads

The problem

Monitoring tools traditionally poll from a central server. For an MSP that means a path from your network into every customer's: VPN tunnels, port forwards or agents that accept inbound connections. Each is a standing path an attacker can use, and each needs to be justified to the customer's auditor.

Remote monitoring platforms have become a favoured target precisely because one compromise reaches many networks. The safest inbound path is the one that doesn't exist.

The design

Monitaria splits the work. A collector virtual machine sits inside each network and does all polling locally: ping, ports, HTTP, DNS, certificates and SNMP. It keeps measurement history on the site. Optionally, it pushes a small status snapshot outbound over HTTPS to a hosted hub that shows every site in one place.

  • No inbound ports at customer sites. The collector only makes outbound HTTPS requests.
  • Each push is signed with a per-site secret (HMAC-SHA256) and carries a timestamp and a single-use nonce, so a captured request can't be replayed or forged.
  • The hub accepts a site's data only when signed with that site's secret, and shows it only to the organization that owns the site.
  • Sensitive detail stays on site: IP addresses are redacted from messages, and targets, community strings and history never leave the collector.

What the hub can and can't do

The hub is a viewer. It has no credentials for customer devices and no channel to send commands to collectors. A compromise of the hub exposes status summaries, not a path into networks. That is a deliberate trade: configuration happens on the collector, inside the network it monitors.

Running without a hub

Every collector works standalone, with its own dashboards, alerts, users and reports. Organizations that can't send any data offsite simply don't link a hub.

Checklist for evaluating any monitoring architecture

  • Does it need inbound connectivity to monitored networks?
  • Where are device credentials stored, and who can read them?
  • Can the central component push changes or run commands on sites?
  • What leaves the site, and can you see it?
  • Is every action attributable in an audit log?