How to monitor an office internet link from both ends, so a filtered port and a dead line read differently

The line nobody watches

An office, a shop, a clinic, a warehouse: each has one internet connection that everything inside depends on, and few of them are monitored. The branch office has a router with a blinking light and the ISP's phone number, and a failure is detected when somebody there cannot open their email and calls.

The connection fails in several ways, and they need different people. The line goes down: a cut cable, a modem that lost sync, power out at the site. The ISP has a fault further in, so the modem shows a connection while nothing gets through. A firmware update changed a rule, or the firewall or the ISP started filtering a port that used to be open. On a line without a static address, the ISP handed out a new one, or a backup line took over and the site now appears from a different address. From the internet, several of these look identical. A link monitor tells them apart by watching from both ends.

The external half: reaching the public address

The only thing at a site the internet can see is the public address of its router or gateway. hostnag's link monitor takes that address, or the hostname that resolves to it, and reaches it from the group's locations in one of three ways: a TCP connection to a port, 443 by default, as an uptime monitor makes; an ICMP ping from hostnag's own probes; or both.

A connection needs something listening, such as a VPN gateway on its port or a service the firewall forwards to a machine inside. Pick a port that already answers from the internet rather than opening one for this. A ping needs a gateway that answers echo requests, which many are set not to. With both, the two halves check each other: a port that fails everywhere the ping still answers reads as Inbound blocked rather than Link down.

The rules are the uptime rules. The external half runs on the group's interval, every 5 minutes on the Free plan and every 1 minute on Pro and Business, from up to 5 locations by plan. A failure from a majority of at least two locations is confirmed at once; from a single location it takes 2 runs in a row, so one flapped route is no outage. A latency threshold in milliseconds turns a slow connection into Degraded rather than Up.

On its own, the external half has a blind spot. A refused or dropped connection means the port is not reachable, and nothing more. The line may be dead, or fine behind a firewall rule changed this morning, and both read Down from the internet.

The internal half: a device behind the gateway checks in

Turn on the internal ping and hostnag mints a URL for the link, the same kind a heartbeat uses: https://hostnag.com/api/ping/<token>. Any device at the site calls it on a schedule. The expected interval and grace are the link's own, 5 minutes with 5 minutes of grace by default, and the device is judged the way a heartbeat is: heard within the window, or silent past it. The first window opens when you switch the internal half on, not when the link was created, so enabling it on an old link raises no false silence on the next run.

Each ping also records where it came from: the site's public address as the internet saw it, shown on the monitor page beside the internal cell with the time of the last ping.

Nothing is installed to do this. A machine that is always on, a small server, a NAS, a Raspberry Pi, runs one curl line from cron or a scheduled task. If the site already runs a Beacon, the plain script served at https://hostnag.com/beacon.sh for Linux and macOS and https://hostnag.com/beacon.ps1 for Windows, pick it under Checked by on the link and the box pings for it. The link's page then shows no ping URL at all, since the beacon is handed the token, and the location board draws a cell for each beacon picked. The beacon guide covers the install. hostnag ships no appliance, installer or service for your network.

Five verdicts, one word each

With both halves in place, the link settles on one of five words each run. The external verdict is the confirmed one: a lone failed run from a single location does not change the word until the second.

Up. The external connection succeeds and the internal device, if watched, has been heard within its window or is still in its first one. The line is fine and so is the port.

Degraded. The external connection succeeds, but slowly: the median latency across locations is above the threshold you set. It raises a warning.

Link down. The external connection is confirmed failed and the internal device has not been heard either, or is not watched. Neither end can be reached: the line, the power or the site itself is out. This is the one word that is an outage. It raises a Critical alert, "link is down", naming the locations that could not connect, the last error and the port; reminders follow on the group's down-reminder interval; and when the address answers again from every location a recovery notice says how long the link was down.

Inbound blocked. The external connection fails while the internal device keeps pinging, or, with ping and port both on, the port fails everywhere the ping answers. The site is online, but the port you dial is filtered on the way in. In the alert's words: "Check the firewall or the ISP's CGNAT." A warning, shown as "Inbound blocked" with a "Blocked since" time; nobody is paged for a line that is up.

Internal silent. The external connection still gets through while the internal device has gone quiet past its window. The internet reaches the site, so the line is up; the device that should ping has stopped, been switched off or lost its way out. The alert says to check the device, and the board shows it as "Internal silent" with a "Silent since" time.

Inbound blocked and internal silent are degraded-kind alerts, so they follow the group's degraded switch, which is off until you turn it on. Link down is the only word that raises Down, switch or no switch. The external test alone would page someone for a firewall change; with the second half, only a line dead from both sides reads as an outage.

Both halves by hand

nc -vz 203.0.113.8 443

*/5 * * * * curl -fsS https://hostnag.com/api/ping/<token> >/dev/null

The first line is the external half, run from anywhere on the internet: the same TCP connection hostnag makes to the site's address and port, which connects, is refused, or times out. The second is the internal half, a crontab line on a machine behind the gateway that calls the ping URL every five minutes, with -f so an HTTP error exits non-zero and -sS so cron mails you only on failure. The monitor page prints this line for you.

The port checker makes the first connection from the runner a monitor uses, once, if you are not somewhere outside the office to try it.

A new public address

With the internal half on, hostnag remembers the address the device pings from. When it changes, a Changed alert says the link now pings from the new address and names the old one: "A new lease from the ISP, or failover to a backup line." It follows the group's notify-on-change setting, on by default, and can be switched off per link where the address is meant to move.

The reason to want it is everything pinned to the old address: a DNS record for the site, a VPN peer configured by IP, an allow-list on a server that only accepts the office, a vendor's firewall told your address once. Everything reads Up, the line is fine, and the office cannot reach the one system that checks where it comes from. A change is also how a failover shows itself: the primary dropped, the backup took over, the site is up on a different address, and without the alert nobody knows the primary is down until the backup goes too.

Sites behind carrier-grade NAT, common on consumer and mobile connections, share a public address with other customers and accept no inbound connections at all. There the external half has nothing to dial and reads Inbound blocked for as long as the internal device keeps pinging. A site that exposes no port is better watched with a plain heartbeat from a machine at the site, where silence is the alert.