I'm going through the list of hosts unreachable by prometheus servers in eqiad and all labvirt* labnodepool* labnet* can't be reached on tcp/9100 (node-exporter port). I'm guessing it is the production/labs ACLs that prevent this, can we punch a hole in the firewall for this?
In terms of tcp connections what doesn't work is e.g. 10.64.32.198 -> 10.64.20.25:9100
Technically now prometheus hosts are "monitoring hosts", namely prometheus100[12] in eqiad and prometheus200[12] in codfw, if that makes a difference!