PushProx is a client and proxy that allows Prometheus to scrape metrics from targets behind NAT and other network barriers while maintaining the pull model.
Prometheus normally scrapes targets by making direct HTTP requests, which fails when targets are behind NAT, firewalls, or otherwise unreachable from the monitoring server. PushProx inverts the connection pattern: clients run on target machines and poll the proxy for scrape requests, then execute those requests locally and return results. The proxy sits in a network location accessible to both Prometheus and the clients, routing scrape requests from Prometheus to the appropriate client based on the target's fully qualified domain name, and returning metrics back through the same channel.
PushProx suits environments where targets cannot accept inbound connections from Prometheus but can make outbound connections to a central proxy. It works with standard Prometheus configuration by specifying the proxy as a proxy_url. The tool includes a service discovery endpoint that lists registered clients in file_sd_configs format, allowing dynamic target discovery. One limitation to note: only the default HTTP scheme works with the proxy; HTTPS targets require a workaround using a custom header instead of the standard scheme configuration. The project explicitly states it has no built-in authentication or authorization, so a reverse proxy should be placed in front for security in production environments.
The project is described as reasonably robust in practice but acknowledged as a work in progress. Development activity shows regular maintenance with continuous integration testing in place. The codebase is written in Go and remains actively managed within the Prometheus community ecosystem.
