Documentationbreadcrumb arrow Grafana Cloudbreadcrumb arrow Observe and actbreadcrumb arrow Test and validatebreadcrumb arrow Synthetic Monitoringbreadcrumb arrow Set upbreadcrumb arrow Private probesbreadcrumb arrow Network and resource requirements
Grafana Cloud
Last reviewed: October 22, 2026

Network and resource requirements

Before setting up a Synthetic Monitoring private probe, review the connections it needs and estimate CPU and memory for your checks. Use these requirements to prepare the host or container environment and its firewall rules.

Firewall configuration

Private probes initiate connections to Synthetic Monitoring services and monitored targets. Configure the probe host’s firewall to allow the outbound connections in the following sections. If a monitored target has its own firewall, configure that firewall separately to allow inbound connections from the probe host.

Synthetic Monitoring services

  • Allow outbound connections from the probe host to the addresses in the “API server URL” column of the regional endpoint table.
  • Allow outbound connections from the probe host to the addresses in the “Secrets proxy” column of the regional endpoint table.

Prometheus and Loki instances

Allow outbound connections from the probe host to the Prometheus server URL and the Loki URL:

  1. Log in to Grafana Cloud and open your stack.
  2. Navigate to Home > Testing & synthetics > Synthetics > Config.
  3. Under the General tab, scroll down to Data sources.
  4. For the Prometheus server URL:
    1. Click the Prometheus data source. For example: grafanacloud-STACK_NAME-prom.
    2. Copy the Prometheus server URL under the Settings tab -> Connection.
  5. For the Loki URL:
    1. Click the Loki data source. For example: grafanacloud-STACK_NAME-logs.
    2. Copy the URL under the Settings tab -> Connection.
  6. Update the probe host’s firewall rules with both URLs.

External script imports

  • If you use k6 scripts that import external modules, for example, k6 modules from jslib.k6.io, allow outbound connections from the probe host to the module hosts.

Note

MultiHTTP test executions make outbound connections to jslib.k6.io when run. If you run MultiHTTP checks on private probes behind a firewall, allow outbound connections from the probe host to jslib.k6.io.

Monitored targets

Allow outbound connections from the probe host to each monitored target. The required protocol depends on the check type. For example:

  • ICMP: for ping and traceroute checks.
  • UDP or TCP: for DNS checks.
  • TCP: for HTTP and MultiHTTP checks.

If a target’s firewall blocks these connections, configure the target’s firewall, not the probe host’s firewall, to allow inbound connections from the probe host over the required protocol.

Calculate resource requirements

Resources used by private probes may vary based on the targets being monitored, so it can be hard to predict them in advance. Below, we provide a rough estimate to get you started.

The baseline CPU and memory resources, if you want to run:

  • API endpoint checks: 50m/64Mi.
  • The above, plus multi-step checks, scripted checks, or both: 200m/256Mi.
  • The above, plus browser checks: 1000m/1024Mi.

Then, for each check per minute of the following types, add:

  • API endpoint (HTTP, Ping, DNS, TCP, Traceroute): 5m/2Mi.
  • Multi-step or scripted checks: 20m/32Mi
  • Browser checks: 100m/256Mi.

As mentioned above, keep in mind that these are ballpark estimates. Monitor the resource usage of your probe, and stay on the lookout for CPU throttling and OOM events to see if you need to adjust any resources.

Next steps

Continue with Set up a private probe to register a probe, or install the agent if you already have a probe authentication token.