# Network requirements What the InfraNest agent connects to, so you can allow it through a firewall. In short: **one outbound HTTPS connection, to `ingest.infranest.io`, and nothing inbound, ever.** The agent opens no port and takes no instructions. Installing and upgrading it also downloads from `get.infranest.io`. ## What it connects to | Host | Port | When | What for | |---|---|---|---| | `ingest.infranest.io` | TCP 443 (HTTPS) | Every interval, 60 seconds by default | Sends readings to `POST /api/metrics/push` | | `get.infranest.io` | TCP 443 (HTTPS) | Only while you install or upgrade | The installer and the agent itself | | `github.com` and the download host it redirects to | TCP 443 (HTTPS) | Only while you install or upgrade, and only if `get.infranest.io` cannot be reached | The installer's fallback: the same release files | | Your DNS resolver | 53 | When it looks up the names above | Name resolution, as for any program | That is the whole list. The agent sends nothing to analytics, error reporting or a CDN, and contacts no other host. Its only other connection is local: on Linux it reads services and containers from the systemd D-Bus socket on the same machine. - **Encrypted, always.** The agent refuses an `INFRANEST_URL` that is not `https://`, and refuses one with a username or password in it. - **IPv4 and IPv6.** `ingest.infranest.io` has both an IPv4 and an IPv6 address, and the agent uses whichever your network gives it, so an IPv6-only server works. `get.infranest.io` serves over both too. GitHub has no IPv6 address, which is why the installer tries `get.infranest.io` first. - **Allow it by name, not by address.** The addresses behind `ingest.infranest.io` can change without notice. If your firewall only takes addresses, use a proxy that allows by name (below). - **It follows no HTTP redirect.** A push response can move the agent to another ingest host, but only over HTTPS and only to a host under `infranest.io`. Anyone who manages to answer one push cannot point your servers somewhere else. A move to a different domain needs the installer run again, and would be announced first. - **Your own address.** Self-hosted installations set `INFRANEST_URL` to their own host; the same rules apply. ## Nothing inbound InfraNest never connects to your server. There is no listening port, no remote shell and no command channel: the agent only sends. You do not need to open anything in a firewall or a cloud security group. ## Behind a proxy The agent uses the standard `HTTPS_PROXY` and `NO_PROXY` environment variables. With the systemd service, add them to `/etc/infranest/agent.conf`, which the service loads as its environment, and restart it: ```sh echo 'HTTPS_PROXY=http://proxy.example.com:3128' | sudo tee -a /etc/infranest/agent.conf sudo systemctl restart infranest-agent ``` A proxy that inspects TLS needs its certificate authority in the machine's trust store, which the agent reads. On Windows, and with the OpenRC and runit services, the agent does not load `agent.conf` as its environment. Set the variable for the agent's process another way, or use a proxy that needs no setting. ## When it cannot reach InfraNest Nothing is lost while the connection is down, for up to about eight hours: - Readings are still taken on time, and kept on disk in `/var/lib/infranest-agent` until InfraNest confirms it stored them. A request that merely completed, such as an error page from a proxy, does not count. - The agent tries again after 30 seconds, then waits twice as long each time, up to 15 minutes. - When the connection is back, it sends what it kept, oldest first, in batches of up to 60 readings. - It keeps at most 500 readings, about eight hours at the default interval, and drops the oldest after that so it never fills your disk. - InfraNest accepts readings up to 24 hours old. A reading more than 300 seconds ahead of InfraNest's clock is refused, so keep the server's clock in sync. If InfraNest refuses the token, because it was deleted or the server was removed, the agent tries again every 15 minutes rather than every few seconds. `sudo infranest-agent status` says what is happening without reaching the network. ## A firewall rule to copy Outbound only. With a proxy or firewall that allows by host name: ```text # InfraNest agent: outbound HTTPS only, nothing inbound allow tcp/443 to ingest.infranest.io # readings, all the time allow tcp/443 to get.infranest.io # install and upgrade only ``` Add `github.com` only if `get.infranest.io` is blocked where you install. To check the connection from the server, send a push without a token: ```sh curl -sS -o /dev/null -w '%{http_code}\n' -X POST https://ingest.infranest.io/api/metrics/push ``` `401` means the connection works and only the token is missing. A timeout or a TLS error means something blocks it. ## Related - [What it sends](what-it-sends.md): every field, how often, and how long it is kept. - [Install the agent on many servers](install-on-many-servers.md). - The agent's source and README: .