Zabbix Ports
You set up zabbix ports by opening specific TCP paths between your server and agents. These network rules let the server poll agents or receive metrics from them. Most teams open these paths across whole subnets to speed up deployment. Broad firewall rules expose hosts and databases when someone uses an admin role. How zabbix ports work across servers and agents A monitoring setup has a central server, a backend database, a web app, and remote agents. Each part talks over its own network path
Ports: the complete guide
Architecture patterns, implementation strategies, and security best practices. Delivered to your inbox.
You set up zabbix ports by opening specific TCP paths between your server and agents. These network rules let the server poll agents or receive metrics from them. Most teams open these paths across whole subnets to speed up deployment. Broad firewall rules expose hosts and databases when someone uses an admin role.
How zabbix ports work across servers and agents
A monitoring setup has a central server, a backend database, a web app, and remote agents. Each part talks over its own network path. You must match your firewall rules to the check mode you pick.
Passive checks start at the central server. The server reaches out to the agent to ask for a metric. In this mode, the remote host must accept inbound connections from the server. The agent reads the request, runs the check, and sends the result back.
Active checks reverse the traffic flow. The agent starts the talk with the central server. It asks the server for a list of checks to run. Then the agent sends metric data back to the server on a schedule. Here, the central server must accept inbound traffic from every active agent.
Collector nodes also sit between the main server and remote zones. In active mode, the collector node talks to the main server. In passive mode, the main server reaches out to the collector node. The web app also needs network access to the central server and the database.
Securing agent and database traffic in transit
Plain network rules only choose which IP addresses can talk to each other. They do not protect the data moving across the wire. Anyone on the local network could read unencrypted host metrics. You must turn on encryption between the server, collector nodes, and agents.
Teams use pre-shared keys or TLS certificates to lock down this traffic. You set up these keys in the agent files and the web app. Once active, the agent rejects requests from unknown servers. The central server also drops data from unverified agents.
Ports: architecture patterns and best practices
Continue reading? Get the full guide.
Free. No spam. Unsubscribe anytime.
The backend database needs strict network rules as well. Both the central server and the web app read and write to this database. You should restrict the database port so only those two hosts can reach it. Never open the database port to user networks or agent subnets.
Where native network rules and roles fall short
Opening the right network paths and setting up TLS solves host-to-host trust. The monitoring server and the agents can now exchange metrics safely. Role settings in the web app also limit which dashboards a user sees. Still, network ports and app roles only decide who can log in.
These controls do not check what an engineer does during a live session. Sometimes an alert fires and an engineer must fix a broken host or database. The engineer logs into the host over SSH or opens a database client. Native firewall rules cannot inspect individual commands or SQL statements in flight.
A user with valid credentials can run a bad query or read raw tables. Standard network ports also do not mask sensitive fields in query results. If a table holds emails, phone numbers, or card numbers, the raw values appear. Teams need a way to inspect commands and rewrite sensitive fields like national IDs.
Check database and API queries on the wire
Identity tools, roles, and network rules decide who opens a session. Setup alone cannot check what each query does or mask sensitive values in a response once a session starts. When workflows touch Postgres, MySQL, SQL Server, MongoDB, ClickHouse, Kubernetes APIs, SSH, or internal HTTP APIs, hoop.dev sits inline in the wire protocol beside those services as an open-source proxy, a sidecar for your Postgres or API. On every query an AI agent or engineer runs against production, hoop.dev decides to pass, mask, block, or hold it for human review.
Your login details and client tools stay as they are while hoop.dev guardrails refuse bad deletes or drops before they run, and hoop.dev data masking rewrites matched sensitive values in responses in memory. Furthermore, hoop.dev holds SOC 2 Type II, is MIT licensed, and writes every query and decision to an audit trail that generates evidence for HIPAA, GDPR, and PCI DSS. See the source on GitHub.
Frequently asked questions
What is the difference between active and passive agent checks?
In passive checks, the central server connects to the agent to pull data. In active checks, the agent connects to the server to push data. Your firewall rules depend on which side starts the network talk.
Do active checks require inbound ports open on the monitored host?
No, pure active checks do not need inbound ports open on the remote host. The agent reaches out to the listening port on the central server instead. This makes active checks popular for hosts behind strict firewalls.
How should teams restrict access to the monitoring database port?
Only the central server and the web app need direct network paths to the database. Block all agent subnets from reaching the database port through local firewall rules. Engineers who run manual queries should use controlled sessions that mask emails and card numbers.