Skip to main content

Predefined IP sources

A knoc normally grants the IP address the user logged in from. Predefined sources change that: instead of the user's own address, the knoc grants a fixed list of addresses or networks whenever it is triggered. A user logs in, clicks the knoc, and the addresses you nominated are what reach the firewall.

That is how you open outbound access for a whole subnet, or grant a set of servers, off the back of a person logging in.

Setting Predefined Sources

On the knoc, under Grant access to, choose Predefined IPs instead of the user's IP address. Then list what you want granted.

Each entry is an IP address or a network in CIDR form:

  • 203.0.113.42 grants that one host. The form fills it out to 203.0.113.42/32 when you leave the field, which is the same thing written explicitly
  • 192.168.100.48/29 grants the whole eight-address network

A knoc holds up to five entries. That limit matches API key source restrictions, and the form stops offering another row once you reach it.

What Gets Rejected

Knocknoc refuses a source list that cannot mean what it looks like:

  • More than five entries
  • Two entries that overlap, including one that contains another. 10.0.0.0/8 alongside 10.1.2.0/24 is refused, because the first already covers the second
  • 0.0.0.0/0 or ::/0, which would grant every address on a single click
  • An empty list, when the knoc is set to predefined sources

A network is stored as the network it covers, so 192.168.100.50/29 is saved and pushed as 192.168.100.48/29. Reopen the knoc after saving and you will see the value that will actually be enforced.

Revoking

A grant remembers the network it was made with. If you edit the knoc's source list while somebody holds a grant, their revoke still withdraws what was granted, not whatever the knoc says now. Changing the list affects the next grant, not one already in flight.

Which Backends Enforce a Network

Most backends push the network as configured: nftables, ipset (on a hash:net set), pf, AWS, GCP, DigitalOcean, MikroTik, Azure, Cloudflare Lists, Okta, Entra, Meraki, F5, Kemp, OPNsense, pfSense (on a network alias), Proxmox, Windows Firewall, Firepower, SonicWall, Sophos UTM and SFOS, FortiGate and FortiManager, PAN-OS address groups, and the allowlist feed.

Some vendor features hold one address per entry and have nowhere to put a netmask. Rather than grant part of the range and report success, the agent refuses the grant and tells you what to use instead:

  • Check Point Identity Awareness maps one address per identity
  • PAN-OS User-ID mappings and registered-IP tags take a single address. Use an address group knoc for a network
  • A pfSense host alias holds addresses. The network alias type is the one that holds CIDR
  • An ipset hash:ip or bitmap:ip set stores single addresses. Use a hash:net set

Each of those raises an agent error code with its own page under Agent Error Codes.

Not the Same as Discovering Extra Client Addresses

Predefined sources replace the user's own address with a list you nominate. If what you want instead is to grant more of the user's addresses, for example an internal RFC1918 address alongside their external one, that is a different feature: see Additional client IP addresses.