Please help with complex network configuration

[ddpana]

Hello,

I have the following configuration:

Zabbix Server (behind nat, external IP 1.1.1.1, private IP 192.168.0.1

Zabbix Proxy (behind nat, external IP 2.2.2.2, private IP 10.0.0.1)
Zabbix Agent (behind nat, external IP 2.2.2.2, private IP 10.0.0.1) - the agent is installed on the same machine as the proxy - for testing purposes only.

Please note that proxy and agent are on a different private network than zabbix server.

I would like to monitor the Zabbix Agent host, through the Zabbix Proxy, for active and passive checks.

I have defined the Proxy as Zabbix Proxy (with mode Active and IP 2.2.2.2).
I have defined a host Zabbix Agent, which I set on the interface 2.2.2.2 and port 10050.

The proxy is Online, but the Agent says:
Get value from agent failed: cannot connect to [[2.2.2.2]:10050]: [4] Interrupted system call

In the agent config I have set:
Server=127.0.0.1,2.2.2.2,1.1.1.1
ServerActive=127.0.0.1,2.2.2.2

Need to mention that the ports 10050 and 10051 are opened from proxy / agent to and from the zabbix server (any telnet to the public IP's will work, no matter in which dirrection).
The thing is the only flow that doesn't work is telnet on ports 10050 and 10051 FROM the proxy/agent itself, because it needs to go through the router, and I know I would simply add a DNAT rule to make it work, but I do not want all the traffic from my local network (maybe more than 100 servers with agents installed) to go through the router while they are on the same private network with the proxy.

Could someone point me in the right direction please ?

Thanks,
Daniel

[sludge3000]

Hello ddpana,

Firstly, welcome to the Zabbix forums.

I'm only getting started with Zabbix and haven't played witht the proxy yet but I have a lot of experience with networks so I can give you some pointers there.

1) As all of the servers will be reporting to the proxy, why do you think they will also send traffic directly to the server?
2) You should be able to configure your firewall and NAT rules so that only the traffic from the proxy to the server will be NAT'd/allowed while traffic from any other source is denied.

sludge3000