Monitoring Firezone WireGuard VPN Platform with Vigilmon

Firezone is an open-source WireGuard-based VPN and Zero Trust network access platform built on Elixir/Phoenix. It gives teams a self-hosted alternative to Tailscale and Cisco AnyConnect — a web admin UI for managing VPN users, devices, firewall rules, and SSO/SAML/OIDC identity integration, without per-user SaaS costs.

When Firezone goes down, your remote team loses access to internal services immediately. The admin portal failure prevents new connections from being authorised, WireGuard gateway downtime drops all active VPN sessions, and a broken database connection means no user can authenticate. Vigilmon lets you monitor all three layers and catch issues before they become support tickets.

What You'll Set Up

• HTTP monitor for the Firezone web admin portal
• REST API ping check confirming the Phoenix application is responsive
• TCP port monitor for the WireGuard VPN gateway
• SSL certificate expiry alerts for the HTTPS admin portal
• Heartbeat monitor verifying the user and device database is accessible for VPN authentication

Prerequisites

• Firezone running (Docker Compose or OCI container install)
• Admin portal accessible at http://YOUR_HOST:13000 or a public HTTPS domain
• Firezone API token for the /v0/users heartbeat check
• A free Vigilmon account

Step 1: Monitor the Firezone Admin Portal

The Firezone web admin portal runs on port 13000 by default. This is where you manage VPN users, issue device configurations, set firewall rules, and configure SSO. If it's unreachable, your admin team can't onboard new users or respond to connectivity incidents.

1. Log in to vigilmon.online and click Add Monitor.
2. Set Type to HTTP / HTTPS.
3. Enter the URL: http://YOUR_HOST:13000/admin (the admin login page; replace with your public domain if using HTTPS).
4. Set Check interval to 2 minutes.
5. Set Expected HTTP status to 200.
6. Click Save.

The /admin login page serves successfully even when no user is logged in — a 200 response confirms the Phoenix application is serving requests and the admin UI is intact.

Step 2: Check the Firezone API Ping Endpoint

Firezone exposes a /v0/ping REST API endpoint that returns a JSON "pong" response. This is an unauthenticated health ping that confirms the Phoenix application is up without requiring credentials — making it ideal for external health checks.

In Vigilmon:

1. Add Monitor → HTTP / HTTPS.
2. URL: http://YOUR_HOST:13000/v0/ping
3. Set Expected HTTP status to 200.
4. Under Advanced, add an Expected body contains check: pong.
5. Set Check interval to 1 minute.
6. Click Save.

The /v0/ping endpoint is the most reliable Firezone liveness indicator. It directly exercises the Phoenix router and returns quickly. A failure here means the Elixir application has crashed, the container has exited, or the node is under severe resource pressure.

Step 3: Monitor the WireGuard VPN Gateway Port

Firezone's WireGuard interface listens on UDP port 51820. A TCP check on this port from Vigilmon confirms the port is open on your server's firewall and that Firezone's WireGuard interface is bound. If this check fails, VPN clients cannot establish new tunnels and existing sessions may fail to renegotiate.

1. Add Monitor → TCP Port.
2. Host: YOUR_HOST_IP (or public hostname).
3. Port: 51820.
4. Set Check interval to 2 minutes.
5. Click Save.

Note: WireGuard uses UDP, so this TCP probe tests firewall reachability rather than the WireGuard handshake itself. Pair it with the heartbeat in Step 5 for a complete picture of VPN connectivity health.

Step 4: SSL Certificate Expiry Alerts

Firezone admin portal deployments commonly use HTTPS with a Let's Encrypt or custom certificate. A certificate expiry on the admin portal doesn't just look bad — modern browsers will block access entirely, locking your admin team out of the management UI during an incident.

On the HTTPS HTTP monitor created in Step 1:

1. Open the monitor in Vigilmon.
2. Enable Monitor SSL certificate under the SSL section.
3. Set Alert when certificate expires in less than 14 days.
4. Click Save.

If Firezone is deployed behind a reverse proxy (nginx, Caddy, Traefik), also add a Vigilmon SSL monitor for the proxied admin domain so certificate issues anywhere in the chain are caught early.

Step 5: Heartbeat Monitor for VPN User and Device Database Health

Firezone's VPN authentication depends on its user and device database — if that database becomes inaccessible, no user can authenticate and new WireGuard sessions cannot be authorised. A heartbeat monitor that periodically queries the /v0/users API confirms the database is accessible and Firezone's authentication stack is functional.

Create a script on your Firezone host:

#!/bin/bash
# firezone-health-check.sh
# Confirms Firezone API and user database are accessible

FIREZONE_API="http://localhost:13000/v0"
API_TOKEN="YOUR_FIREZONE_API_TOKEN"
HEARTBEAT_URL="https://vigilmon.online/api/heartbeat/YOUR_HEARTBEAT_ID"

# Check the ping endpoint first
ping_code=$(curl -s -o /dev/null -w "%{http_code}" \
  "$FIREZONE_API/ping" --max-time 5)

if [ "$ping_code" != "200" ]; then
  echo "$(date): Firezone ping failed (HTTP $ping_code)"
  exit 1
fi

# Check the users API — confirms database is accessible
users_code=$(curl -s -o /dev/null -w "%{http_code}" \
  -H "Authorization: Bearer $API_TOKEN" \
  "$FIREZONE_API/users" --max-time 10)

if [ "$users_code" != "200" ]; then
  echo "$(date): Firezone users API returned HTTP $users_code — database may be down"
  exit 1
fi

# All checks passed — ping heartbeat
curl -s "$HEARTBEAT_URL" --max-time 10 --retry 2
echo "$(date): Firezone health OK — heartbeat sent"

Make executable and schedule:

chmod +x /opt/scripts/firezone-health-check.sh
crontab -e

*/5 * * * * /opt/scripts/firezone-health-check.sh >> /var/log/firezone-monitor.log 2>&1

Set up the heartbeat in Vigilmon:

1. Monitors → New Monitor → Heartbeat
2. Name: Firezone VPN Auth Stack
3. Interval: 10 minutes
4. Grace period: 5 minutes
5. Click Save and copy the heartbeat URL into the script above.

If the Firezone database becomes inaccessible, the API token expires, or the users endpoint returns an error, the heartbeat stops and Vigilmon alerts — giving you a heads-up before users start reporting that they can't connect to the VPN.

Step 6: Alert Channels and Escalation

A Firezone outage has immediate impact on remote workers. Configure alerts to reach the right responders fast:

1. Alert Channels → Add Channel → connect Slack (#vpn-ops), PagerDuty, or email.
2. For the /v0/ping API check, set Consecutive failures before alert to 1 — this is the primary liveness indicator and should alert immediately.
3. For the WireGuard port check, also alert on first failure — a closed port means zero VPN connectivity.
4. For the admin portal monitor, set Consecutive failures before alert to 2 — brief Phoenix reboots during updates are expected.

Summary

| Monitor | Target | What It Catches | |---|---|---| | Admin portal | :13000/admin | Phoenix crash, container exit | | API ping | :13000/v0/ping | Application unresponsive, Elixir crash | | TCP VPN port | :51820 | WireGuard interface down, firewall change | | SSL certificate | Admin HTTPS domain | Certificate expiry, renewal failure | | VPN auth heartbeat | /v0/users | Database inaccessible, auth stack broken |

Firezone's value as a self-hosted VPN platform is that it puts you in control — but that also means you're responsible for keeping it up. With Vigilmon monitoring the admin portal, the Phoenix API, the WireGuard gateway, and the authentication database, you'll catch Firezone failures before your remote team discovers they're locked out.

Start monitoring your Firezone VPN platform today at vigilmon.online — free, no credit card required.