Central monitoring across all clients – without VPN. What are you using?
Solo MSP in Germany, SMB clients. I’m looking for a single dashboard that shows me the state of everything across all my customers, and I keep hitting the same wall: no site-to-site VPN. Most of my clients don’t have one, and I don’t want to build tunnels…
Solo MSP in Germany, SMB clients. I’m looking for a single dashboard that shows me the state of everything across all my customers, and I keep hitting the same wall: no site-to-site VPN. Most of my clients don’t have one, and I don’t want to build tunnels just for monitoring. What I would like to have: - Proxmox hosts (Monitor Backup, System Usage) - Synology NAS (did the backup and snapshot jobs actually run, and did they succeed, Disk Usage) - Windows endpoints (disk usage, pending updates, basic health) - switches, printers Im Currently using Action1 for patch management and remote access on endpoints. Works well, but the monitoring is time consuimg. Backup monitoring is still email-based: the NAS sends a mail if it fails. Otherwise im Checking all Client Systems once a Month manually anywa
Collected discussion
Because S2S VPNs with all your clients is an unnecessary risk.
ActiveInsights is really nice. $25 a year is basically nothing that you can bury somewhere else. I wish it had remote GUI capabilities though. Centralizing updates without having to manually verify is a labor cost savings anyway.
i already use action1 for Windows Clients
seems pretty neat, i will look into that
And we thank you!
If the website is anything to go by, this has been vibe coded. Not that that's a bad thing if the post-Vibe coding securitization work has been done. But has it?
They are Technicians... the website is definitely. I guess you can ask them every question. As far as I know, it's ISO27001 certified, multiple times penetration tested, etc.
I actually built my own monitoring tooling for exactly this use case. The tooling out there just didn't do the 'central + no-VPN + multiple devices + printers + UPS'. Actually considering putting it out to private beta if you are interested.
I would definitely like to test it
Bingo. This is what we use.
Any RMM should be able to this with NMS. For Synology use Active Insight integrations for alerting. It costs something but you can make that the clients problem.
Prtg. Sure it's made in Germany, support stuff made at home lol
Try taking a look at netlock rmm. They're also from Germany and seems a good fit for you.
Is this a job for zabbix, we don’t use it but others have mentioned it.
hey i'm keith — just started terabits ai (still testing). getting clients is rough. we're trying to build ai systems for acquisition like outreach/lead gen and we run them ourselves. still early. if you want help on a small pilot (only pay if results show), message me.
Your RMM should be able to do most this. Synology also has their Active Insights platform that may help you there too.
Grafana SaaS use the alloy agent or forward logs using syslog-ng over SSL.
There is a new solution provider... maybe they are what you're searching for... sereal.at. These are near Germany.
You don't expose client service to the public internet. Any worhwhile tool however will run it's own SSL encrpyted tunnel or IPSEC one. RMMs namely.
Zabbix+grafana+wazuh, not plug and play and with a reasonable maintenance overhead, but license free, private and stable.
Have you ever heard of Nebula? https://slack.engineering/introducing-nebula-the-open-source-global-overlay-network-from-slack/ Once there, the monitor is just a suite of your choice, such as Wazuh, whole shebang $0.00
Action1 https://action1.com/
Why don‘t you have S2S connections to your clients? We are a Fortinet shop so we are running a FortiGate VM (IONOS Cloud) and all customers connect to there. I have a IP scheme to deploy a small /29 mgmt subnet to each customer. The local FortiGate listens to the first IP and then we have a mini PC with Devolutions Gateway, Zabbix etc. All connections to each customer are brokered through Devolutions Gateway and the connection back to the IONOS Cloud is completely secured. You could do a similar setup with open source firewalls but also something like Tailscale, Netbird… Edit: I am not connecting every customer LAN to one flat MSP network. Each customer has a dedicated tunnel and management subnet, and the VPN only carries explicitly permitted flows. Customer-to-customer traffic is denied, and technician devices do not receive general routed access to customer production networks. Remote access is brokered through a customer-local Devolutions Gateway. Devolutions Server authorizes a short-lived session for a specific target and protocol, and the Gateway then connects locally. The Gateway itself is restricted by firewall rules to the exact systems and ports it needs. A compromise would still be serious, but the blast radius is intended to remain limited to that customer and those permitted paths. That is not fundamentally different from trusting an RMM, jump host, reverse proxy, mTLS gateway, or vendor cloud. All of them create a privileged access path. The relevant questions are what the component can reach, what authority it has, where credentials live, and whether one compromise can cross customer boundaries.