# Securing Netdata Agents By default, the Agent exposes its **local dashboard** on port `19999`. If the node has a public IP address, the dashboard and metrics are accessible to anyone at `http://NODE:19999`. Protect your Agents by implementing any of these security measures: **Recommended**: - [Disable the local dashboard](#disable-the-local-dashboard): Best for users who monitor their systems through Netdata Cloud dashboards. - [Use Netdata Parents as Web Application Firewalls](#use-netdata-parents-as-web-application-firewalls): Deploy Parent nodes as border gateways to isolate production systems from direct internet exposure, even when using Netdata Cloud. **Alternative Approaches**: - [Restrict dashboard access to private LAN](#restrict-dashboard-access-to-private-lan): Suitable for accessing the local dashboard via a LAN connection. - [Configure granular access control](#configure-granular-access-control): Limit local dashboard access to specific IP addresses, such as trusted static IPs or management LAN connections. - [Deploy a reverse proxy](#deploy-a-reverse-proxy): Secure your dashboard with password protection and TLS encryption. ## Disable the local dashboard Secure your nodes by disabling local dashboard access while maintaining Cloud monitoring capabilities: - Eliminates public exposure of metrics and system information. - Maintains secure metrics viewing through Netdata Cloud via [ACLK](/src/aclk/README.md). Edit the `[web]` section in `netdata.conf` using the [`edit-config`](/docs/netdata-agent/configuration/README.md#edit-a-configuration-file-using-edit-config) script: ```text [web] mode = none ``` Restart your Agent to apply changes. After restart, the local dashboard (http://NODE:19999) will no longer be accessible, but all metrics remain available through Netdata Cloud. > **Note** > > For Docker deployments, set `NETDATA_HEALTHCHECK_TARGET=cli` in your environment variables. ## Use Netdata Parents as Web Application Firewalls Enhance security by deploying Parent nodes as border gateways, eliminating the need for direct internet access from production Agents. Parent nodes: - Act as application firewalls. - Receive metrics from Child Agents securely. - Serve dashboard requests using local data. - Maintain Netdata Cloud connectivity through encrypted connection. For more information, see [Observability Centralization Points](/docs/observability-centralization-points/README.md). ## Restrict dashboard access to private LAN Enhance security by binding the Agent to your organization's private management network interface. This limits dashboard access to your administrative LAN only. Edit the `[web]` section in `netdata.conf` using the [`edit-config`](/docs/netdata-agent/configuration/README.md#edit-a-configuration-file-using-edit-config) script: ```text [web] bind to = 10.1.1.1:19999 localhost:19999 ``` The Agent supports binding to multiple IPs and ports. When using hostnames, all resolved IPs will be used (for example, `localhost` typically resolves to both `127.0.0.1` and `::1`).
More info for cloud-based installations For cloud environments without private LAN capabilities or multi-cloud deployments, you can create a virtual management network using mesh VPN tools like `tincd` or `gvpe`. These tools enable secure, private communication between servers while allowing administration stations to access management functions across your cloud infrastructure. For `gvpe` specifically, we maintain a [deployment tool](https://github.com/netdata/netdata-demo-site/tree/master/gvpe) that includes: - Pre-compiled binaries for Linux and FreeBSD. - macOS compilation script. - Configuration templates. We use this tool to manage our Netdata demo sites across multiple hosting providers.
## Configure granular access control Restrict access to your local dashboard while maintaining Netdata Cloud connectivity by using [access lists](/src/web/server/README.md#access-lists). Edit the `[web]` section in `netdata.conf` using the [`edit-config`](/docs/netdata-agent/configuration/README.md#edit-a-configuration-file-using-edit-config) script. Use the `allow connections from` setting to permit specific IP addresses or hostnames: ```text [web] # Allow only localhost connections allow connections from = localhost # Allow only from management LAN running on `10.X.X.X` allow connections from = 10.* # Allow connections only from a specific FQDN/hostname allow connections from = example* ``` The default setting `localhost *` allows both localhost and all external connections. You can customize this using Netdata's [simple patterns](/src/libnetdata/simple_pattern/README.md). While `allow connections from` globally controls access to all Netdata services, you can set specific permissions for individual features: ```text [web] allow connections from = localhost * allow dashboard from = localhost * allow badges from = * allow streaming from = * allow netdata.conf from = localhost fd* 10.* 192.168.* 172.16.* 172.17.* 172.18.* 172.19.* 172.20.* 172.21.* 172.22.* 172.23.* 172.24.* 172.25.* 172.26.* 172.27.* 172.28.* 172.29.* 172.30.* 172.31.* allow management from = localhost ``` For additional security: - Review detailed access list options in the [Web Server documentation](/src/web/server/README.md#access-lists). - Consider [enabling SSL](/src/web/server/README.md#enable-httpstls-support) to encrypt local dashboard traffic (Netdata Cloud connections are always TLS-encrypted). ## Deploy a reverse proxy Secure multiple Agents using a single authenticating web server as a reverse proxy. This provides: - Unified access through URLs like `http://{HOST}/netdata/{NETDATA_HOSTNAME}/`. - Single sign-on across all Agents. - Optional TLS encryption. We provide detailed configuration guides for popular web servers: - [nginx](/docs/netdata-agent/configuration/running-the-netdata-agent-behind-a-reverse-proxy/Running-behind-nginx.md) - [HAProxy](/docs/netdata-agent/configuration/running-the-netdata-agent-behind-a-reverse-proxy/Running-behind-haproxy.md) - [Apache](/docs/netdata-agent/configuration/running-the-netdata-agent-behind-a-reverse-proxy/Running-behind-apache.md) - [Lighttpd](/docs/netdata-agent/configuration/running-the-netdata-agent-behind-a-reverse-proxy/Running-behind-lighttpd.md) - [Caddy](/docs/netdata-agent/configuration/running-the-netdata-agent-behind-a-reverse-proxy/Running-behind-caddy.md) - [H2O](/docs/netdata-agent/configuration/running-the-netdata-agent-behind-a-reverse-proxy/Running-behind-h2o.md)