Zabbix Proxy Responding with Public IP

[continuouscloud]

Looking for help...

I have installed a Zabbix Server instance on a cloud VM, and have a proxy located in a remote location. These two instances are able to communicate via SSH tunnel, and I have confirmed that they can connect to one another on Zabbix's assigned ports.

Problem I am running into is when I add the remote instance as a Proxy in my primary Zabbix Server, it is responding with the public IP address and not the VM's address.

From the Zabbix Server instance I am seeing this in the logs

cannot accept connection from proxy "zabbix-proxy-mysql" at "<<redacted public IP address>>", allowed address: "<<redacted private IP address>>": connection is not allowed

On the Zabbix proxy instance it's the same, just without the IP info

cannot send proxy data to server at "zabbix-server": connection is not allowed

If I change the proxy address to the public IP it says it's responding but then it pulls no data from the proxy. Does anyone have any ideas? Or has anyone seen this behavior before?

I've set up two instances, both in the cloud, previously using the same configuration and they are able to talk to one another with no issues. Would normally think this is a firewall issue but I've confirmed I can telnet to one another on Zabbix ports (10051 for server, 10071 for proxy)

These are running in Docker using the provided docker-compose files on zabbix-community github.

Any help is appreciated, thanks!

[tomijs]

Whenever traffic leaves from your network it is going to use the public IP address, local IP addresses are exactly that - local addresses. Your best choice is to Port forward the port that your proxy uses to send data. This port forwarding needs to be done on your edge router (the router that communicates with the outside internet) and if there are any other routers in between the zabbix proxy and edge router, perform port forwarding there too. Then you need to accept data on your Zabbix server from that public IP, and since you have port forwarded, zabbix proxy can send data using the public IP and same port.

[continuouscloud]

Thanks Tomijs, great information. I had it talking to the wrong IP for the Zabbix server, it was talking to the public IP, hence why it was responding with that external address and not the address I had defined for the proxy. Updated the Zabbix server connection info from the proxy server to the internal address and everything seems good now.

[Markku]

What's the use for an SSH tunnel?

If you are unsure how is the communication doing between the Zabbix components (you are saying that the proxy connects but cannot send "data"), you can always do a packet capture on the server and see how the traffic looks like. An example is at https://majornetwork.net/2023/01/dat...-zabbix-proxy/, except that I don't know how your SSH tunnel and docker setup details should be considered.

Markku

[cyber]

Have you set SourceIP and ListenIP for your proxy? Otherwise it would not use correct one to communicate...