Admin Guide

Knocknoc can host and operate your server as a managed cloud instance. Use the Instances page to ...

On a Linux host as Root, execute the below command to setup and install your Knocknoc server. You...

Knocknoc licensing and pricing can be found on the Knocknoc website. Once you have obtained your ...

The Orchestration Agent runs on a server to control network access for users on their behalf. Thi...

The Settings page is where administrators configure how Knocknoc behaves across the whole deploym...

Knocknoc server v8.5+ installs with a local installation of PostgreSQL by default. However, you m...

The orchestration agent can be configured to reverse-proxy traffic, simply by enabling this mode ...

A Knocknoc deployment has three parts: the Server (web app), its Database (PostgreSQL), and one o...

Running Knocknoc behind HAProxy could be a great option for people with existing HAProxy deployme...

To gain access to underlying networks and systems, end-users  log in to Knocknoc interactively vi...

Closed beta. The Knocknoc mobile app is currently available to beta testers only and is not yet p...

A Knoc is the access rule your users see. It says who can request access to a resource and under ...

What triggers a grant or revoke The granting and revoking of access by Knocknoc occurs on a numbe...

For additional security and temporal access control, Knocs support a "click to grant" and "click ...

For additional security and identity verification, Knocs support a "Require TOTP code when access...

Users are assigned a default "grant period" (in minutes), either within Knocknoc for local users,...

Knocknoc supports a couple of ways to redirect users to and from Knocknoc, which can be useful fo...

Capturing additional client IP addresses A client may exhibit behavior where multiple IP addresse...

You may want to limit the ability to access a Knoc, depending on where your user is logging in to...

Default deny is the best way to live. However sometimes you need to manually grant access for a n...

Knocknoc can refuse a grant when the connection doesn't meet the rules set for a Knoc. The grant ...

Knocknoc keeps a track of source IP addresses and tries to be kind to users that share IPs. Think...

An integration is one firewall, proxy, cloud platform or on-host enforcement point, plus the agen...

Linux comes equipped with a built-in native firewall which Knocknoc orchestrates via "IPSets". IP...

The Allowlist backend makes a list of active IP address grants available via the Knocknoc server ...

Allowlists or External Dynamic Lists (EDLs) served from Knocknoc require a secret for access, alo...

Microsoft Windows comes equipped with a built-in native firewall which Knocknoc orchestrates to p...

Knocknoc integrates with the PF packet filter to dynamically control network access on a host tha...

Knocknoc orchestrates Fortinet FortiGate firewalls - directly or via FortiManager - to dynamicall...

Knocknoc integrates with Palo Alto firewalls and the Panorama management system to dynamically gr...

Knocknoc orchestrates Palo Alto firewalls - directly or via Panorama - to dynamically control net...

The SonicWall can be orchestrated in three ways, Actively (API call from an Orchestration Agent t...

Knocknoc controls access on Check Point gateways in one of two ways. In Active mode the Knocknoc ...

Knocknoc can orchestrate F5 Networks BigIP and related devices via two mechanisms, including iRul...

The  Cisco Secure Firewall Management Console (formerly known as Firepower) integration allows Kn...

The Sophos SFOS/XGS based devices provide advanced firewall and UTM capabilities. This replaces t...

Overview This integration allows for IP addresses to be dynamically managed within Azure Network ...

Knocknoc integrates with Microsoft Entra ID (formerly Azure AD) to dynamically control which IPs ...

Knocknoc integrates with Okta to dynamically control which IPs are allowed to access apps protect...

Knocknoc can orchestrate Amazon AWS Security Groups, which essentially provide network level fire...

Knocknoc integrates with Google Cloud Platform to dynamically control network access via VPC Fire...

Below is a concise guide for a sysadmin (or developer) to set up and configure AWS WAF with a cus...

Knocknoc can orchestrate Cloudflare IP lists to provide dynamic IP network allowlisting inbound t...

Knocknoc can orchestrate DigitalOcean Cloud Firewalls to provide dynamic IP network allowlisting ...

Knocknoc integrates with Fastly to control which source IPs an edge service lets through. The int...

The Knocknoc orchestration Agent - which is deployed alongside managed infrastructure (not on des...

HAProxy is a fantastic reverse proxy with a massive amount of features. Knocknoc has supported HA...

Sometimes IP address restrictions or IP-based allowlisting is not enough, think: airport lounge, ...

Knocknoc can drive an nginx server's allow/deny list directly from the agent, without a wrapper s...

Knocknoc protects services behind Traefik with the Knocknoc Traefik plugin. The plugin is a middl...

Apache 2.4 and above have slightly different ACL syntax, so this page covers how you can use Knoc...

This is an example that lets you use UFW (https://wiki.ubuntu.com/UncomplicatedFirewall) and IPse...

This is an example that lets you use Shorewall https://shorewall.org/index.html and IPsets to dyn...

IPsets with firewalld On RHEL-family hosts — and any distribution that uses firewalld as its fir...

Knocknoc integrates with nftables to dynamically control network access on a Linux host. When a u...

Knocknoc integrates with OPNsense by managing the contents of a pre-existing firewall alias via t...

Knocknoc integrates with pfSense to dynamically control network access.  The Knocknoc agent maint...

Knocknoc integrates with MikroTik RouterOS to dynamically control network access. The Knocknoc ag...

Knocknoc integrates with Proxmox VE to dynamically control network access using the built-in Prox...

Knocknoc integrates with the Kemp LoadMaster to dynamically control network access. Knocknoc dyna...

Knocknoc integrates with Cisco Meraki to dynamically control which source IPs are allowed through...

Passive, Active or a combination Passive - Knocknoc's Allowlist feature provides a passive integr...

The Sophos UTM device provides firewall and UTM capabilities. Note that this series of devices is...

The "Custom Script" Knoc type is simply a script the agent can execute directly on the Agent mach...

On a Linux host as Root, execute the below command to setup and install a Knocknoc Agent. You wil...

On a Windows machine as an Admin, download and install the Orchestration Agent. It will install a...

The Knocknoc OpenBSD Agent is orchestration software for managing just-in-time network access. It...

API keys can be created to allow just-in-time orchestration Agent registration, which is suitable...

The Knocker utility is a command-line tool for managing various backends or server features with ...

The Sessions tab under Identities is the first thing you see when you open Identities in the admi...

Admins in Knocknoc can log in to /admin on their Knocknoc server, however they can't be granted A...

Users sign in and get access to your infrastructure through the Knocs and groups assigned to them...

Groups in Knocknoc map users to Knocs, and a user can belong to multiple groups. To create a grou...

Knocknoc normally grants access to the single IP a user authenticates from. Agentic Access and Co...

Each Knocknoc user has a limit on how many things can be signed in and holding access at the same...

Invalidating sessions from the admin portal You can sign users or admins out in bulk from the adm...

The Trust Engine sets conditions on network access. For each Knoc you pick which facts about a co...

This page covers the mechanics behind a policy. It explains when access is instant and when it wa...

"IP intelligence is degraded" A banner at the top of the admin pages reads IP intelligence is deg...

The Trust Engine raises these events, delivered through the GELF log destination configured under...

Before the Trust Engine, each Knoc carried its own list of allowed source addresses and an option...

Note: Blocked address lists are a premium add-on. Your Knocknoc license must include them before ...

Knocknoc supports local users in addition to SAML/LDAP. Simply add a user, with a username and pa...

SAML is an in-depth topic, however it represents the best option for securing users, and providin...

Single Sign On using Entra is simple, follow the guide below to configure Knocknoc User and/or Ad...

The following example assumes your Knocknoc instance is located at https://demo.knoc.cloud. Where...

G Suite can be set up as an Identity Provider if you have G Suite Business Starter or above plan....

CyberArk integrates with Knocknoc via the "Web Apps" component, passing through SAML assertions. ...

In this example our authentik instance is hosted at https://auth.example.com/ and is running vers...

Configure 1Kosmos as a SAML identity provider (IdP) for Knocknoc. Once connected, your users auth...

Ping Identity SSO Configure PingOne as a SAML identity provider (IdP) for Knocknoc. Users authent...

Keycloak supports multiple authentication realms, so you must first select the appropriate realm ...

The following example assumes your Knocknoc instance is located at https://demo.knoc.cloud. Where...

The following example assumes your Knocknoc instance is located at https://your-knocknoc.cloud/. ...

Knocknoc can authenticate users to an LDAP server like Active Directory, by attempting to bind as...

The Knocknoc server will need to be able to contact your LDAP server on port 389 or 636. This is ...

User sessions can be created using the API. This is handy for machine to machine authentication, ...

Logging is important - we love logging. Because of this, we have included an easy to find, follow...

Things go wrong from time to time, the best way to understand more detail is to increase the log ...

Default deny is a wonderful thing, the best place to be - except when you lock yourself out. Than...

NTP It's important that ALL the servers within the Knocknoc cluster and agents are synchronized a...

Checking to see if an ACL is present in HAProxy For when you aren't sure if the whole process is ...

Agent Error Codes Palo Alto 200000 - Target Firewall Not Connected to Panorama 200050 - Username ...

The Knocknoc software is managed by your operating system, as such updates can be managed within ...

If you're after the very latest features or changes, and you know what you're doing - below is ho...

Debian distros (Ubuntu etc) If you are getting this error: Failed to fetch https://packages.knock...

This document outlines database and application level backups which may be considered ahead of ch...

If you installed Knocknoc Server before version 8.5 (September 2025), your instance is likely usi...

You can run the Knocknoc database on a pair of PostgreSQL servers. If one server fails, you switc...