How to organize monitoring for an on-premise environment with restricted access (only port 443)?

For monitoring an on-premise environment with restricted access, where only port 443 (HTTPS) is open, an approach using agents installed on servers that send metrics and logs to a central monitoring server via HTTPS can be used.

Main options:

• Agent-based monitoring: Install an agent on each server (e.g., Prometheus Node Exporter + pushgateway, Telegraf, or Zabbix/Datadog agents) that collects metrics and sends them via HTTPS to the central server.

• Using a push model: Since incoming connections are limited, the monitoring server cannot query agents directly. Instead, agents periodically send data (push) to the server via HTTPS.

• VPN or proxy: If possible, set up a VPN or HTTPS proxy to ensure a secure monitoring channel.

• Logs and metrics via HTTPS API: Configure log and metric collection using tools that support sending data over HTTPS (e.g., Elastic Beats, Fluentd).

Example with Prometheus pushgateway:

# On the server with restricted access, start the pushgateway
# Agents send metrics there
# The central Prometheus collects metrics from the pushgateway, accessible via HTTPS

Thus, monitoring is built on agents that initiate connections on the open port 443, aligning with network restrictions.