Talk to usFree access
Public probe network

Let monitoring in. Keep the rest of your server closed.

If your firewall, CDN or WAF blocks unknown sources, allow only the three UPnator addresses and only on the monitored service port.

View IPv4 addresses ↓Add monitor →
3independent hosts
2/3default quorum
IPv4stable sources
UPnator2 of 3 quorum
GermanyFrankfurt
Polandpublic region
CanadaToronto
Canonical list

Public source IPv4 addresses.

Allow all three. Missing one region can prevent quorum and leave a run in the unknown state.

TXTJSON
01public probe

Germany

Frankfurt

57.129.40.251
02public probe

Poland

Country location

51.38.134.159
03public probe

Canada

Toronto

209.15.246.235
List updated
User-AgentUPnator-Probe/0.26.3 (+https://upnator.com)For version-independent matching use the prefix UPnator-Probe/
Machine-readable feedshttps://upnator.com/network/ips.txthttps://upnator.com/network/ips.json
Least access

Allow the monitored target, not your administration plane.

The examples below assume HTTPS monitoring on port 443. For TCP checks, replace it with the intentionally selected monitor port.

UFW · HTTPS 443

Three separate sources, one destination port.

sudo ufw allow proto tcp from 57.129.40.251 to any port 443
sudo ufw allow proto tcp from 51.38.134.159 to any port 443
sudo ufw allow proto tcp from 209.15.246.235 to any port 443
Nginx · allow / deny

Use only in the monitored endpoint location or virtual host.

allow 57.129.40.251;
allow 51.38.134.159;
allow 209.15.246.235;
deny all;
WAF / CDN

Build one rule with all three addresses.

  • Action: allow or skip only for the monitored endpoint.
  • Source: the three IPv4 addresses from the canonical list.
  • Do not globally disable rate limits, authentication or bot protection.
Do not expose SSH, databases, Docker or administration panels.

The exception is an explicitly selected TCP check target whose exposure has been separately reviewed.

Configuration check

Confirm access from every region.

Saving a firewall rule is not proof that monitoring works.

  1. 1
    Allow three addresses

    Limit the rule to the target port and protocol.

  2. 2
    Create a monitor

    Select the public probe group and expected result.

  3. 3
    Run a check

    The first run is scheduled after saving.

  4. 4
    Review regional votes

    Expect three results; 403 and timeout usually indicate a WAF or firewall rule.

Still not receiving successful results?

Compare the response code and timing from each region. A Private Agent is the right solution for resources you do not want to expose publicly.

Add monitorTroubleshooting
Private Agent

A private network does not need a public allowlist.

The agent initiates an outbound-only connection and runs checks from your LAN, VPN, MPLS or private VPC.

View architecture →