VPN Monitoring: Site-to-Site Tunnels and Client-VPN Applications

VPN monitoring is the continuous, synthetic testing of virtual private network tunnels and the applications that depend on them. It answers three questions on a schedule: Is the tunnel up? Is it fast enough? And can the services behind it actually be reached from the users and locations that need them? Modern VPN monitoring combines ICMP and TCP probes for tunnel reachability, SNMP polling of firewall and VPN-concentrator metrics, and HTTPS / browser-level checks against internal applications — all executed from inside the network by a Private Agent, or from across the public internet by distributed monitoring locations.

Because VPNs are almost always on the critical path for remote work, branch connectivity, and hybrid-cloud traffic — and because they fail silently. A site-to-site tunnel can stay “up” in the firewall UI while dropping packets, re-keying constantly, or routing over a degraded ISP. A client VPN can authenticate users successfully while the intranet app behind it returns 500s. Without dedicated VPN monitoring, these failures are only discovered when users complain. Continuous synthetic VPN monitoring surfaces tunnel drops, latency regressions, certificate expirations, split-horizon DNS drift, and internal-application outages in seconds — before they become support tickets or SLA breaches.

You monitor a VPN connection by placing a monitoring probe on each side of the tunnel — or at least on one side with a known test target on the other — and running scheduled checks end-to-end. With Dotcom-Monitor: (1) install a Private Agent inside the network (Windows or Linux, ~5 minutes), (2) create ServerView tasks for ICMP ping, TCP port checks, and traceroute across the tunnel, (3) add HTTPS or BrowserView tasks against an internal application to validate end-to-end usability, and (4) optionally add MetricsView SNMP polling against the VPN concentrator for tunnel counters and throughput. Results stream back over a single outbound HTTPS connection — no inbound firewall rules required.

Combine four layers: reachability (ICMP ping to a stable host on the far-side LAN every 60 seconds), path validation (traceroute confirming the route traverses the tunnel and not a fallback internet path), service checks (TCP port or HTTPS probes against a real service on the remote subnet), and device telemetry (SNMP polling of the VPN gateway for tunnel state, packets in/out, CPU, and session count). Alert on both hard failures and trend thresholds — a tunnel whose latency has doubled over 24 hours is just as actionable as one that went down. Dotcom-Monitor delivers all four from one agent, one UI, and one set of alerts.

The metrics that correlate with actual user impact are: tunnel up/down state, round-trip latency (ms), jitter (variation in latency), packet loss percentage, tunnel re-key frequency, throughput in/out, active session count, HTTPS response time for internal applications, TLS certificate days-until-expiry for internal certs, and DNS resolution time against internal resolvers. Dotcom-Monitor captures all of these natively through ServerView (reachability), MetricsView (SNMP), and BrowserView (application-level).

Dotcom-Monitor pricing is based on the number of monitored targets and check frequency, not the number of VPN tunnels, Private Agents, or monitoring locations. Private Agents are unlimited on all paid plans, so you can deploy one per site, VPC, or cloud region without additional cost. A 30-day full-access free trial with no credit card is available, which lets you monitor real tunnels and internal apps end-to-end before committing. For a precise quote tied to your tunnel and app inventory, request a demo.

You can get partial coverage, but not end-to-end coverage. SNMP tells you what the VPN gateway thinks is happening (tunnel up, sessions active, bytes transferred) — which is valuable but misleading when the device is healthy while packets are being black-holed downstream. Nagios and other self-hosted tools can run ICMP and HTTP checks, but require you to build, host, patch, and scale the monitoring infrastructure yourself, and rarely include browser-level or multi-step transaction testing. Dotcom-Monitor combines SNMP, ICMP, TCP, HTTPS, and real-browser checks in one SaaS platform, with 30+ external monitoring locations plus unlimited Private Agents — so you see both what the gateway reports and what users actually experience.

A Private Agent is a lightweight Windows or Linux service that runs inside your trusted network. It receives monitoring jobs from the Dotcom-Monitor platform over a single outbound HTTPS connection, executes them from inside the perimeter, and streams results back. You need one whenever the target isn’t reachable from the public internet — which covers most site-to-site VPN endpoints and virtually every client-VPN-protected application. No inbound firewall rules required.

The most reliable pattern is to place a Private Agent on each side of the tunnel (or at least on one side with a known test IP on the remote side) and configure ServerView tasks: ICMP Ping to the far-side LAN, TCP port checks to a service on the remote subnet, traceroute to confirm the path traverses the tunnel, and SNMP polling on the firewall / VPN concentrator via MetricsView. Add an HTTPS check against a known internal endpoint on the far side as a functional end-to-end test. Alert when any of these fail or when latency / loss exceeds your baseline.

Deploy a Private Agent on a host that either sits inside the network the client VPN routes into, or holds a persistent client VPN session itself (for example, a Linux VM running OpenVPN or WireGuard as a client). The agent will execute HTTPS, BrowserView, UserView, and ServerView tasks against the internal application exactly as a remote user would see it — including SSO, MFA, split-horizon DNS, and internal SSL certificates.

Yes. Dotcom-Monitor is VPN-technology-agnostic — it monitors the result of the tunnel, not the tunnel’s control plane. It works with IPsec (site-to-site, route-based, policy-based), GRE, DMVPN, MPLS with IPsec, WireGuard, Tailscale and other ZTNA overlays, OpenVPN, Cisco AnyConnect, Palo Alto GlobalProtect, Fortinet FortiClient, and all the major cloud VPN gateways (AWS Site-to-Site, Azure VPN Gateway, Google Cloud VPN).

Yes — ICMP Ping tasks in ServerView report round-trip time, jitter, and packet loss percentage for every check run. You can also pull higher-fidelity metrics (tunnel session counts, throughput, CPU) directly from your firewall or VPN concentrator via SNMP using MetricsView. Both are visualized in dashboards, alerted on, and available through the XML Reporting Service for export to Grafana or Power BI.

Dotcom-Monitor handles both. HTTPS monitors running on a Private Agent will validate internal certificates (CA-issued or self-signed, with the root installed on the agent host) and alert on days-until-expiry. DNS tasks can target your internal resolvers specifically, so you can confirm that an internal hostname resolves correctly from the VPN side and detect split-horizon drift between external and internal answers.

No — Private Agents are unlimited on all paid plans. Deploy one per site, data center, VPC, or cloud region as your topology requires. Dotcom-Monitor pricing is based on the number of monitors you run, not the number of agents or locations you run them from.

As often as every 60 seconds on most platforms, and as tight as 1 minute for ServerView tunnel checks. High-frequency monitoring gives you sub-minute detection of tunnel drops and brownouts. For less critical services you can run checks every 5, 15, or 30 minutes to conserve check quota.

Every device can route to one or more alert groups. Supported channels include email, SMS, voice call, Slack, Microsoft Teams, PagerDuty, OpsGenie, ServiceNow, Jira, and arbitrary webhooks. Alert groups support on-call rotation, escalation policies, quiet hours, and filtering — so a flapping tunnel at 3 AM pages the right person, not the whole team.

Yes. Every object in the platform — devices, tasks, groups, schedules, alerts, locations, Private Agents — is manageable via the Dotcom-Monitor Web API. Teams commonly wire it into Terraform, Pulumi, Jenkins, GitHub Actions, Azure DevOps, and GitLab CI so that monitors for a new tunnel or internal app are provisioned the moment the infrastructure is.

Public uptime checks can only see what’s on the public internet. They can’t see a dropped site-to-site tunnel, a slow intranet, an expired internal cert, or a broken SSO flow on a VPN-protected app. Dotcom-Monitor is unique in combining the public-internet perspective (30+ monitoring locations worldwide) with the insider perspective (unlimited Private Agents) in a single platform, a single UI, and a single reporting pipeline.

Most customers go from account creation to first alert in under an hour. Installing the Private Agent is a standard Windows service or Linux package install. Configuring monitors is done in the UI or via the REST API. The platform is fully SaaS — no servers to stand up, no back-end to maintain, no license keys to reconcile.