What Prometheus component would you use if targets are running behind a Firewall/NAT?

PushProx is a specialized component designed to allow Prometheus to scrape targets that are not directly reachable, such as those behind a firewall or NAT. It works by having a pushprox-client on the target's network initiate a long-lived outbound connection to a pushprox-proxy. The Prometheus server, which can reach the proxy, sends its scrape request to the proxy. The proxy then forwards this request over the pre-established connection to the client, which collects the metrics from the target and sends them back. This effectively reverses the connection initiation direction, enabling the standard pull model across restrictive network boundaries.

A. Pull Proxy: This is a generic term, not a specific, officially named Prometheus component designed to solve the problem of traversing firewalls.

B. Pull Gateway: The component for a push-based model is the Pushgateway, not "Pull Gateway". It is designed for ephemeral or batch jobs, not for network traversal.

C. HA Proxy: This is a general-purpose load balancer and proxy server. While it can be used in a monitoring stack, it is not the specific tool designed for this Prometheus use case.

1. Prometheus Community - PushProx Repository: The official README for the PushProx project explicitly states its purpose.

Source: Prometheus GitHub Organization, pushprox repository.

Reference: "PushProx is a client and proxy that allows Prometheus to scrape targets that are behind a firewall or in a different network." (From the main README.md file, first paragraph).

Link: https://github.com/prometheus/pushprox

2. Prometheus Documentation - When to use the Pushgateway: The official Prometheus documentation clarifies the use case for the Pushgateway, distinguishing it from the problem PushProx solves.

Source: Official Prometheus Documentation.

Reference: "The Pushgateway is an intermediary service which allows you to push metrics from jobs that cannot be scraped... We only recommend using the Pushgateway in certain limited cases... for service-level metrics, the Pushgateway is not a good fit." This highlights its purpose for ephemeral jobs, not network traversal.

Link: https://prometheus.io/docs/practices/pushing/