How to monitor an office internet link from both ends: a connection from outside, a ping from inside, five verdicts

The line nobody watches

An office, a shop, a clinic, a warehouse: each has one internet connection that everything inside depends on, and few of them are monitored. The branch office has a router with a blinking light and the ISP's phone number, and a failure is detected when somebody there cannot open their email and calls.

The connection fails in several ways, and they need different people. The line goes down: a cut cable, a modem that lost sync, power out at the site. The ISP has a fault further in, so the modem shows a connection while nothing gets through. A firmware update changed a rule, or the firewall or the ISP started filtering a port that used to be open. On a line without a static address, the ISP handed out a new one, or a backup line took over and the site now appears from a different address. From outside, several of these look identical. A link monitor tells them apart by watching from both ends.

The outside half: a connection to the public address

The only thing at a site the internet can see is the public address of its router or gateway. hostnag's link monitor takes that address, or the hostname that resolves to it, and a port, 443 by default, and makes a TCP connection to it from the group's locations, as an uptime monitor does. hostnag never sends ICMP, so "ping" here means a connection, and a connection needs something listening: a VPN gateway on its port, a service the firewall forwards to a machine inside. Pick a port that already answers from the internet rather than opening one for this.

The rules are the uptime rules. The connect runs on the group's interval, every 5 minutes on the Free plan and every 1 minute on Pro and Business, from up to 4 locations by plan. A failure from a majority of at least two locations is confirmed at once; from a single location it takes 2 runs in a row, so one flapped route is no outage. A latency threshold in milliseconds turns a slow connection into Degraded rather than Up.

On its own, the outside half has a blind spot. A refused or dropped connection means the port is not reachable, and nothing more: the line may be dead, or fine behind a firewall rule changed this morning. Both read Down from outside.

The inside half: a device behind the gateway checks in

Turn on the inside ping and hostnag mints a URL for the link, the same kind a heartbeat uses: https://hostnag.com/api/ping/<token>. Any device inside the site calls it on a schedule. The expected interval and grace are the link's own, 5 minutes with 5 minutes of grace by default, and the device is judged the way a heartbeat is: heard within the window, or silent past it. The first window opens when you switch the inside half on, not when the link was created, so enabling it on an old link raises no false silence on the next run.

Each ping also records where it came from: the site's public address as the internet saw it, shown on the monitor page beside the inside cell with the time of the last ping.

Nothing is installed to do this. A machine that is always on, a small server, a NAS, a Raspberry Pi, runs one curl line from cron or a scheduled task. If the site has several things to report, the Beacon, a plain script served at https://hostnag.com/beacon.sh for Linux and macOS and https://hostnag.com/beacon.ps1 for Windows, reads a config with one ping <token> line per monitor and calls each URL; the Beacon dialog on the group page writes that config and its "Heard from" table shows the first ping land. The script is unsigned, readable end to end, and removed by deleting two files. hostnag ships no appliance, installer or service for your network; the inside half is a URL your own device calls.

Five verdicts, one word each

With both halves in place, the link settles on one of five words each run. The outside verdict is the confirmed one: a lone failed run from a single location does not change the word until the second.

Up. The outside connection succeeds and the inside device, if watched, has been heard within its window or is still in its first one. The line is fine and so is the port.

Degraded. The outside connection succeeds, but slowly: the median latency across locations is above the threshold you set. Slow is a warning, not an outage.

Link down. The outside connection is confirmed failed and the inside device has not been heard either, or is not watched. Neither end can be reached: the line, the power or the site itself is out. This is the one word that is an outage. It raises a Critical alert, "link is down", naming the locations that could not connect, the last error and the port; reminders follow on the group's down-reminder interval; and when the address answers again from every location a recovery notice says how long the link was down.

Inbound blocked. The outside connection fails while the inside device keeps pinging. The site is online, since a machine inside reaches the internet, but the port you dial is filtered from outside. In the alert's words: "Check the firewall or the ISP's CGNAT." A warning, shown as "Inbound blocked" with a "Blocked since" time; nobody is paged for a line that is up.

Inside silent. The outside connection still gets through while the inside device has gone quiet past its window. The internet reaches the site, so the line is up; the device that should ping has stopped, been switched off or lost its way out. "The box, not the line," as the alert puts it; shown as "Inside silent" with a "Silent since" time.

Inbound blocked and inside silent are degraded-kind alerts, so they follow the group's degraded switch, which is off until you turn it on. Link down is the only word that raises Down, switch or no switch. That is the point of the second half: the outside test alone would page someone for a firewall change; with the inside ping, only a line dead from both sides reads as an outage.

A new public address

With the inside half on, hostnag remembers the address the device pings from. When it changes, a Changed alert says the link now pings from the new address and names the old one: "A new lease from the ISP, or failover to a backup line." It follows the group's notify-on-change setting, on by default, and can be switched off per link where the address is meant to move.

The reason to want it is everything pinned to the old address: a DNS record for the site, a VPN peer configured by IP, an allow-list on a server that only accepts the office, a vendor's firewall told your address once. Everything reads Up, the line is fine, and the office cannot reach the one system that checks where it comes from. A change is also how a failover shows itself: the primary dropped, the backup took over, the site is up on a different address, and without the alert nobody knows the primary is down until the backup goes too.

Sites behind carrier-grade NAT, common on consumer and mobile connections, share a public address with other customers and accept no inbound connections at all. There the outside half has nothing to dial and reads Inbound blocked for as long as the device inside keeps pinging. A site that exposes no port is better watched with a plain heartbeat from a machine inside, where silence is the alert.

Check one by hand

nc -vz 203.0.113.8 443

*/5 * * * * curl -fsS https://hostnag.com/api/ping/<token> >/dev/null

The first line is the outside half, run from anywhere on the internet: the same TCP connection hostnag makes to the site's address and port, which connects, is refused, or times out. The second is the inside half, a crontab line on a machine behind the gateway that calls the ping URL every five minutes, with -f so an HTTP error exits non-zero and -sS so cron mails you only on failure. The monitor page prints this line for you.

Check it now, then watch it

Check it now: put the site's public address and port into the port checker to see whether a connection reaches it from the internet, once, from the runner a monitor uses.

Watch it for good: link monitoring dials the site from the group's locations on its schedule, adds the inside ping so a filtered port and a dead line stop looking alike, and tells you when the public address moves. Where no port is open, heartbeat monitoring watches the inside half alone.