iTechGuides is reader-supported. When you buy through links on our site, we may earn an affiliate commission. As an Amazon Associate I earn from qualifying purchases. Learn more
Need a server to try this on? Antihost offers Linux VPS plans with NVMe storage, full root access and a 14-day free trial.
Install Zabbix as a central server and web frontend on a supported Unix-like host, add the official repository packages, then deploy an agent or proxy at each remote location. For a secure deployment, choose active checks or a proxy when inbound access is undesirable, restrict TCP 10050 and 10051 to known addresses, enable TLS with certificates or pre-shared keys, and protect the separate browser-to-frontend connection with HTTPS.
The reliable order is: build the server stack, install agents, decide the traffic direction, create matching hosts in the frontend, apply narrowly scoped firewall rules, configure encryption, and verify fresh item data. The choices below explain what to install and how to avoid exposing monitoring services to the internet.
What a secure Zabbix installation contains
Zabbix is not a single package. A normal deployment has a Zabbix server, a supported database, a web server and PHP for the frontend, and one or more data collectors. Collectors can be the Zabbix agent, Agent 2, or a Zabbix proxy. The server evaluates triggers and stores history; the frontend presents configuration and results; agents read local metrics; and proxies collect at remote sites before forwarding data.
| Component | Where it runs | Purpose | Security boundary |
|---|---|---|---|
| Zabbix server | Central Unix-like host | Schedules checks, evaluates triggers and receives forwarded data | Allow only administration and collector traffic that you actually use |
| Database | Same host for a small installation or a separate host for isolation and scale | Stores configuration, history, trends and events | Permit database access only from Zabbix components |
| Frontend | Web server with PHP and the selected database extension | Host configuration, dashboards and alerts | Protect browser traffic with HTTPS at the web server or reverse proxy |
| Agent or Agent 2 | Each monitored server | Collects operating-system and application metrics | Use active mode or restrict passive access to the server or proxy |
| Proxy | Remote site or network segment | Collects locally, buffers data and forwards it centrally | Reduces cross-site exposure and tolerates intermittent links |
Choose the traffic model before opening a firewall
Your choice determines which side initiates connections and therefore which firewall rules are safe.
#1 Best Overall
- Powerful Turbo Fan:CAGIWIRU Electric Air Duster have reached speed up to 130000RPM,Can efficient remove dust and debris.With LED light and Three Adjustable Speed to meet with different cleaning tasks.
- With Attached USB C Fasting Charging cable.Charing 3 hours,Enjoy up to 240 minutes of use on the lowest setting, For third speed can use for 25mins.with four charging options to meet with your needs.
- Wide Application: attached 5 different nozzles,making it suitable for a variety of scenes, such as car,pet, pc, keyboards, and other electronic devices. It also serves for office and home clean duster.
- Handy Design & Portable:Cordless air duster electric nozzle is Light weight and small size, design and comfortable to hold and space saving, convenient to carry around. You can put it in your room or inside the car without taking up space.
- Economical &Reusable: Built durable materials with a long-lasting battery,our CAGIWIRU air duster it's a sustainable alternative to disposable air cans.
Active agent checks
An active agent initiates the connection to the Zabbix server and requests its active-check list. The monitored server therefore needs outbound reachability to the server or proxy, while the central system does not need to connect inbound to the agent for those checks. This is usually the least disruptive option for servers behind NAT or a restrictive perimeter firewall. Configure the agent’s active-server setting with the address of the server or proxy, and make the host definition use the same identity and name.
Passive agent checks
For passive checks, the Zabbix server or a proxy connects to the agent and requests each item. This is straightforward on a trusted, routed network, but it requires inbound TCP 10050 on the monitored host. Restrict that rule to the exact server or proxy addresses; never make the agent port generally reachable.
Recommended Free Tools
Proxy collection
A proxy is appropriate when a branch, cloud network or isolated segment contains many hosts, when links are intermittent, or when you want only one controlled connection across a site boundary. Agents communicate with the local proxy, which buffers and forwards results to the central server. A proxy also provides site-level isolation: the central server does not need direct reachability to every endpoint. It still needs a protected connection to the proxy, and the proxy must be sized and monitored as infrastructure.
| Requirement | Active agent | Passive agent | Proxy design |
|---|---|---|---|
| Connection initiator | Agent | Server or proxy | Agents connect to proxy; proxy connects to server |
| Typical inbound rule on monitored host | None for agent checks | TCP 10050 from the approved server or proxy | TCP 10050 from the local proxy when passive checks are used |
| Typical central rule | TCP 10051 to the server | TCP 10050 to the agent and TCP 10051 to the server | TCP 10051 between proxy and server, plus local agent rules |
| Main advantage | Outbound-only monitoring path | Simple polling on a reachable network | Local buffering and fewer cross-site paths |
Prepare supported hosts and dependencies
Run the Zabbix server and frontend on a supported Unix-like platform. Zabbix publishes packages for Red Hat Enterprise Linux, CentOS, Oracle Linux, Ubuntu, Debian, SUSE Linux Enterprise Server and Raspbian. Windows is supported for agents and Agent 2, not as the normal Zabbix server platform. Agent 2’s documented minimum Windows baseline is Windows 10 or Windows Server 2016, reflecting its supported Go toolchain.
Rank #2
- Screen Cleaner is Your Screen’s New Bestfriend! - EVEO is proud to present a screen cleaner that’s perfectly suited for your TV. Meet your new screen cleaner, computer screen cleaner, laptop cleaner, iPad cleaner, Macbook,tv cleaner or any other electronic device. Our screen cleaner spray and wipe along with the included plush microfiber cloth, easily removes dust, fingerprints & other smudges on the screen’s surface. Clean effectively for a streak-free screen
- Gentle on your Screens - Our screen cleaner spray and wipes is compatible to be used even for the most sensitive LCD, LED, CRT, and OLED screens in proper use. Be at ease knowing that this product is compatible with all the major brands: LG, SONY, Samsung, Sharp, iPad, iPhone, Android screens, Kindle, PC monitors - we’ve got you covered! Can be used as LCD screen cleaner, tv cleaner, smart tv screen cleaner, and more
- Premium Super Soft Plush Microfiber Cloth - Included in this efficient screen cleaning kit. This screen cleaner spray and wipe has our signature plush microfiber cloth specially designed to comply with screens and monitors and leave them streak-free. Has been shown to effectively absorbs stubborn stains, zero streaks, and no fiber shedding. Always use this together with our screen cleaner for the best results
- Easy-to-Use Screen Cleaner Kit + microfiber cleaning cloth - The EVEO Screen Cleaning Kit will easily be your new favorite tool when it comes to taking care of the things you love most, quick and easy solution for a streak-free screen. Simply screw on the sprayer gun on the screen cleaner bottle. Spray the cleaning liquid onto the microfiber cloth, then wipe the screen until desired cleanliness & shine is achieved.
- Quality Screen Care Kit Worth Purchasing - Enjoy a convenient Screen Cleaner anytime, anywhere you need it. Your satisfaction is our top priority. We stand behind the quality of our products and that’s why, you shouldn’t be worrying at all. We manufacture the Best Screen Cleaner. and can be used for laptop cleaning kit, laptop screen cleaner, tv screen cleaner for smart tv. MacBook screen cleaner, monitor cleaner or screen cleaner spray for electronic devices with microfiber cleaning cloth
Select the database before installing the server. Supported combinations include MySQL or Percona, MariaDB, PostgreSQL, Oracle and combinations supported by TimescaleDB. Install the PHP extension that matches the chosen database; a frontend can fail even when the database itself is healthy if that extension is missing. Use a supported long-term-support database release where one is available for production.
Plan capacity instead of guessing storage
Storage is driven by item count, polling interval, history and trend retention, and event volume. A deployment with thousands of one-minute items produces a very different database workload from one with a few hundred five-minute items. Estimate those dimensions, allow room for indexes and growth, and place database storage on reliable, monitored disks. For larger installations, a separate database host can provide isolation and scaling; a single host reduces setup complexity for a small deployment.
The Tool Desk
Outbyte Driver Updater FREEScan for outdated or missing drivers - takes under a minuteDriver Scan →Outbyte PC Repair FREERepair Windows errors before they cause bigger problemsFix Now →- Use synchronized clocks on the server, database, proxies and agents so timestamps and trigger evaluation are meaningful.
- Keep administrative access separate from monitoring traffic and apply operating-system updates before exposing the frontend.
- Record the server, proxy and agent versions you deploy so repository upgrades can be tested consistently.
Install the Zabbix server and frontend
- Add the official repository for your exact distribution and release. The repository supplies supported server, frontend, agent and Agent 2 packages. Do not mix packages built for another distribution family or release.
- Install the database server and initialize it. Create a dedicated database and account for Zabbix, apply the required schema supplied with the server packages, and restrict database login to the Zabbix components. Do not reuse a broad administrative database account.
- Install the Zabbix server and frontend packages. Select the package variant matching your database, then install the web server and PHP modules required by that frontend. Match the PHP database extension to MySQL-compatible, PostgreSQL, Oracle or another selected backend.
- Configure the server to reach the database. Store database credentials with permissions that prevent ordinary users from reading them. Enable and start the server, database and web services using your operating system’s service manager.
- Publish the frontend through HTTPS. Zabbix’s component encryption does not protect traffic between a browser and the frontend. Terminate HTTPS in the web server or a reverse proxy, redirect plain HTTP, and restrict administrative access to trusted networks or an authenticated access layer.
- Complete the frontend setup. Open the frontend over its HTTPS address, select the database connection, and sign in with the administrative account created during setup. Change default administrative credentials and create named accounts with the least privilege required.
Exact package names and service commands vary by distribution and Zabbix release, so use the installation instructions shipped for the repository release you selected rather than copying a command for a different version.
Install an agent on every monitored server
Linux and other Unix-like systems
On each monitored host, add the same official repository family used for that operating system, then install either the classic Zabbix agent or Agent 2. Keep the package version compatible with the server and proxy policy. Enable the service and configure the settings that correspond to your chosen traffic model:
Rank #3
- 【Large size】：Measuring 800 x 300 mm/ 31. 5×12 inches, which is wider and taller than others. Large mouse pad can perfectly fit your keyboard and mouse of any size, and there is also ample space for peripherals such as phones, tablets, etc.
- 【LED backlight mouse pad】：Blade Hawks RGB mouse pad provides 7 static modes and 7 dynamic modes will give you the options you are looking for. Power-off memory function remembers the last lighting mode you selected. The super glow fiber Chroma will give you a colorful gaming setup that you want.
- 【Anti-slip rubber base】：Made from Natural rubber, this gaming mousepad will firmly grip your desktop, allowing you to enjoy the ultimate precision in the games you are most passionate about. It also comes with a texture that enhances this ability even further.
- 【Smooth and waterproof surface】: Micro-textured cloth surface, for extremely precise mouse control and a smooth movement. When liquid splashes on the gaming mouse pad, it forms water droplets and slides down. Will not delay your work or gameplay.
- 【Plug and play】: This mouse and keyboard pad is powered by USB, plug and play, no driver required. One button control light modes. Press one time to change the lighting mode, press twice to change the brightness, press and hold about 3 seconds turn ON/OFF.
- Server: the server or proxy addresses permitted to make passive requests. This is also an allow-list; it is not merely a routing hint.
- ActiveServer: the server or proxy to which the agent initiates active checks.
- Hostname: the exact host identity used by the frontend. A mismatch prevents active checks from receiving the intended configuration.
- TLSConnect and TLSAccept: the outgoing and incoming encryption policies. Set them deliberately instead of leaving a mode that accepts unencrypted traffic.
Restart the agent after changing its configuration and protect the configuration and key files with operating-system permissions. If you use passive checks, bind the agent to the appropriate interface and allow TCP 10050 only from the approved server or proxy.
Windows servers
Install the Windows agent or Agent 2 package supported for the operating-system baseline. Apply the same hostname, server or active-server identity, and TLS policy used in the frontend. Create a Windows Firewall rule limited to the Zabbix server or proxy if passive checks are required; active checks can use an outbound rule instead.
Free tools Windows power users keep installed
One-click scans. No signup required.
Create the host in the Zabbix frontend
- Open Data collection, then Hosts, and choose Create host.
- Enter a host name that exactly matches the agent’s configured hostname when active checks are used. Add the host to an appropriate host group.
- Attach the operating-system template that matches the server. Templates provide items, triggers and discovery rules; review inherited items before enabling checks on sensitive systems.
- Under Interfaces, add an Agent interface with the private IP address or DNS name reachable from the server or proxy. Do not enter a public address merely because it resolves from the internet.
- Set the host’s encryption options to match the agent or proxy. If the host accepts only certificate or PSK connections, the frontend definition must select the same mode and credentials.
- Save the host, then inspect the availability icon and the latest data view. A green availability state and fresh timestamps show that the selected path is working; they do not prove that every item is correctly secured, so review the encryption mode and firewall logs as well.
Apply the minimum firewall rules
The official requirements identify TCP 10050 for passive agent checks and TCP 10051 for server, proxy and active-agent flows. Open only the ports used by components you actually run, and restrict every rule to known source addresses. Never expose Zabbix ports directly to the public internet.
| Port | Used by | Direction to permit | Safer scope |
|---|---|---|---|
| TCP 10050 | Agent passive checks | Server or proxy to agent | Only the specific server or proxy IP addresses |
| TCP 10051 | Zabbix server and proxy service; active-agent destination | Agent or proxy to server, and proxy to server | Only managed network ranges or named proxy and agent addresses |
| HTTPS port chosen for the frontend | Browser to web server or reverse proxy | Administrator workstation to frontend | VPN, management network or an authenticated edge; never rely on Zabbix TLS for this path |
| Database listener | Zabbix server or frontend components | Zabbix components to database | Private interface and component allow-list only |
Apply network rules after deciding whether traffic is active, passive or proxied. Test from the real source address, because a rule that works from an administrator’s workstation may still block the server or proxy. Keep operating-system firewalls, cloud security groups and network firewalls consistent, and log denied connections during rollout.
Rank #4
- 【Softer and More Comfortable】Vaydeer wrist rest has unique diamond pattern, which is the combination of softness and aesthetics. The materials of wrist rest are improved into higher quality memory foam and covered with silky smooth lycra. The computer wrist rest makes you as comfortable and cushiony as like rest your wrists on clouds.
- 【Ergonomic Wrist Saver】The wrist rests for keyboard and mouse comes with a 17.32×3.15×0.83 inch keyboard wrist pad and a 5.94×3.15×0.83 inch mouse wrist support. Based on ergonomic design, the unique concave shape is the perfect fit for your wrist joints. The wrist rest pad fits most computer keyboards and laptops, improve hand and wrist posture, release your wrist and arm stress.
- 【Non-Slip Rubber Bottom】Featuring an anti-skid silicone base on the bottom, this wrist keyboard support stays firmly in place on your desk, preventing the padding from sliding around, ensuring stable and consistent wrist support during extended computer sessions.
- 【Better Experience & Pain Relief】Our keyboard arm rest is beneficial to alleviate the soreness caused by direct contact and friction between your arm and a hard desk surface, reducing the risk of wrist fatigue or carpal tunnel. The soft texture of memory foam can evenly distribute the pressure around your wrists and provide good support with just enough give.
- 【Helpful in Multiple Scenarios】Whether you're working, studying, writing, typing, gaming, this keyboard and mouse rest combo is an essential accessory to add comfort and support to your hands and wrists. It’s also a great gift for men, women, family, friend, coworker, gamer, teacher, etc.
Enable TLS between Zabbix components
Zabbix supports encrypted communication between components using TLS 1.2 and TLS 1.3, depending on the cryptographic library. Encryption uses the existing daemon listening ports; it does not require a second monitoring port.
Choose certificates or pre-shared keys
Certificate-based encryption provides certificate identity and a lifecycle suited to larger environments, but requires a trust chain, issuance, renewal and revocation process. PSK encryption is simpler to onboard because each connection uses a shared secret, but secret distribution and rotation become your responsibility. Use one unique PSK per host or tightly controlled connection rather than copying one secret everywhere.
Quick wins for a faster PC:
Scan for outdated or missing drivers - takes under a minuteDriver Scan →Repair Windows errors before they cause bigger problemsFix Now →Fix the driver behind crashes, sound loss and screen glitchesFind Drivers →Align the connection policies
TLSConnect controls encryption for outgoing connections. TLSAccept controls the connection types an agent, proxy or server accepts. Configure both ends explicitly: an agent set to accept only PSK cannot communicate with a server attempting an unencrypted or certificate connection. During migration, avoid broad acceptance settings that silently permit plaintext; move hosts to the final policy and then remove transitional modes.
Protect keys and secrets
Private keys are read from files when Zabbix components start, so file ownership and permissions must prevent ordinary users from reading them. PSKs are stored in the Zabbix database in plain text. Restrict database administrators and backups, encrypt backup storage, limit frontend privileges, and document a rotation procedure. Rotate a secret by preparing the new value, changing both endpoints in a controlled window, verifying fresh data, and then revoking the old value.
Best Value
- 【No Drill Mounted】Cable management tray can be assembled in as little as 3 minutes or less-simply. Side clips easily clampe the edge of desk, pass through the holes on the sides, and secure excess cables with baskets. Desk cable management supports inward or outward installation to meet your needs in different scenarios, and provides you with great convenience when collecting and organizing wires.
- 【Rubber Pad Protects Desk】Wire organizer under desk built-in soft rubber pads on the clamp protect your desk from scratches, so you will not damage your furniture or office.
- 【Sturdy and Beautiful】Cord management under desk is made of high-quality carbon steel and holds about 15 lbs. The wire basket has 2 holes on each side of the tray to enable your cables to pass freely. Cable baskets are suitable for desk thickness use from 0.4" to 2.4".
- 【Space Saving & Keep Organized】Desk cable management tray holds all your power cords, outlet strips, USB hubs and computer transformers hidden from your feet, and the data cables will not enter the vacuum cleaner to keep your desk clean and tidy. Desk wire organizer is also suitable for use in the kitchen and outdoors.
- 【Reduce Safety Risks】Cable tray under desk keeps all plugs away from your kids, no more worry about tripping. Using 2 holes wire tray saves extra space, helps you easily cabling and wire protection. The mesh design is not easy to accumulate dust, but avoids safety accidents caused by messy wires.
TLS adds connection-setup overhead. If encrypted checks or remote scripts begin timing out, increase the relevant Zabbix timeouts conservatively after confirming that CPU, network latency and the remote command itself are healthy. Do not solve slow checks by opening broader firewall access.
Use a proxy for remote sites
Deploy a proxy inside a remote network when direct server-to-agent reachability would require many firewall exceptions, when the site has unreliable connectivity, or when local collection is preferable for policy reasons. Permit local agents to reach the proxy, permit the proxy to reach the central server on the protected server port, and configure the proxy’s identity and TLS credentials in the frontend. Assign remote hosts to that proxy so checks are not accidentally attempted from the central server.
Windows Errors? Fix Them Before They Spread
Repair common Windows errors and clear accumulated junk for a smoother, more stable PC - no reinstall needed.Free scan · no reinstallCrashes, No Sound, or Screen Glitches?
Random freezes, missing sound and display glitches usually trace back to one bad driver. Find and replace yours safely.Free scan · under a minuteMonitor the proxy itself: its queue, process health, disk space and last-seen time. A proxy can buffer data during a link outage, but it cannot compensate for an undersized disk or a permanently unavailable central server. Keep proxy and server versions within the compatibility policy for your release, and treat proxy configuration and keys as production secrets.
Verify operation and troubleshoot failures
No availability or connection refused
- Confirm the agent or proxy service is running and listening on the expected interface.
- Check that TCP 10050 or 10051 is allowed in every intervening firewall and that the rule names the actual source address.
- For passive checks, compare the frontend interface address with the address reachable from the server or proxy.
- For active checks, verify the agent’s active-server setting and exact hostname.
Active checks show no data
An active agent can connect successfully yet receive no items when its hostname does not exactly match the frontend host. Correct the identity on one side, restart the agent, and watch for a new active-check request. Confirm that the host is assigned to the intended proxy if a proxy is used.
TLS handshake errors
- Ensure both ends select the same certificate or PSK mode.
- For certificates, check trust, subject names, validity dates and private-key readability by the service account.
- For PSKs, verify the identity string and secret without exposing them in logs or shell history.
- Review
TLSConnecton the initiator andTLSAccepton the receiver; they govern different directions.
Freshness and timeout problems
Use the frontend’s latest-data timestamps and availability indicators to distinguish transport failure from a slow item. Encrypted connections and remote scripts may need longer timeouts, but increasing them indiscriminately can hide overloaded hosts. Check proxy queues, database latency, item intervals and event volume before changing limits.
Operational hardening checklist
- Keep the frontend behind HTTPS and restrict administrative access to a management network or VPN.
- Open only TCP 10050 and 10051 paths required by your selected model; never publish them to the internet.
- Use active checks or a proxy when inbound access to remote servers is not acceptable.
- Allow-list server and proxy addresses in agent configuration as well as in network firewalls.
- Use certificates or unique PSKs and make every host’s encryption mode explicit.
- Protect private-key files, database credentials, PSKs and backups with separate access controls.
- Patch the operating system, database, web server, Zabbix server, proxies and agents through the supported repository path.
- Review templates and remote-script permissions before enabling them on sensitive systems.
- Alert on stale data, proxy queues, database capacity, certificate expiry and agent availability.
- Document the traffic model, port matrix, host identities and secret-rotation owner for each site.
With those controls in place, Zabbix can monitor remote servers without turning the monitoring plane into an exposed management service: outbound active checks minimize inbound reachability, proxies contain site traffic, and TLS protects component-to-component communication while HTTPS protects the administrator’s browser session.
What’s actually slowing this PC down?
Pick the symptom - the matching free tool is one click away.
Quick Recap
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
