Skip to main content

Predefined IP sources

A knoc normally grants the IP address the user logged in from. Predefined sources change that: instead of the user's own address, the knoc grants a fixed list of addresses or networks whenever it is triggered. A user logs in, clicks the knoc, and the addresses you nominated are what reach the firewall.

That is how you open outbound access for a whole subnet, or grant a set of servers, off the back of a person logging in.

Setting Predefined Sources

On the knoc, under Grant access to, choose Predefined IPs instead of the user's IP address. Then list what you want granted.

Each entry is an IP address or a network in CIDR form:

  • 203.0.113.42 grants that one host. The form fills it out to 203.0.113.42/32 when you leave the field, which is the same thing written explicitly
  • 192.168.100.48/29 grants the whole eight-address network

A knoc holds up to five entries. That limit matches API key source restrictions, and the form stops offering another row once you reach it.

Named Networks

A source can also be a named network: a reusable list of CIDRs kept under Identities > Trusted sources and picked by name. The same network can be used by a knoc's sources, API key and allowlist secret sources, a trust policy's known networks, and admin sign-in sources, so a range you allow in several places is written down once. A named network counts as one of the knoc's five entries.

A named network can be set to expire after 7, 30 or 90 days, or never. Grants made from it are revoked when it expires, and editing it to drop a range revokes the live grants on that range straight away. An edit that would take a knoc past five entries, or overlap another of its sources, is refused and names the knoc. Deleting a network is refused while anything still uses it, and the network's own page lists what does.

What Gets Rejected

Knocknoc refuses a source list that cannot mean what it looks like:

  • More than five entries
  • Two entries that overlap, including one that contains another. 10.0.0.0/8 alongside 10.1.2.0/24 is refused, because the first already covers the second
  • 0.0.0.0/0 or ::/0, which would grant every address on a single click
  • An empty list, when the knoc is set to predefined sources

A network is stored as the network it covers, so 192.168.100.50/29 is saved and pushed as 192.168.100.48/29. Reopen the knoc after saving and you will see the value that will actually be enforced.

Letting the User Choose

Let the user choose turns the knoc's source list into a choice. On a click-to-grant knoc the user sees the sources by name and ticks the ones they want opened, rather than getting all of them. An automatic grant still takes every source, since there is nobody there to pick.

Revoking

A grant remembers the network it was made with. If you edit the knoc's source list while somebody holds a grant, their revoke still withdraws what was granted, not whatever the knoc says now. Changing the list affects the next grant, not one already in flight.

Which Backends Enforce a Network

Most backends push the network as configured: nftables, ipset (on a hash:net set), pf, AWS, GCP, DigitalOcean, MikroTik, Azure, Cloudflare Lists, Okta, Entra, Meraki, F5, Kemp, OPNsense, pfSense (on a network alias), Proxmox, Windows Firewall, Firepower, SonicWall, Sophos UTM and SFOS, FortiGate and FortiManager, PAN-OS address groups, and the allowlist feed.

Some vendor features cannot hold onewhat addressyou pertyped. entryThe knoc form states each integration's rule as you edit, and have nowhere to put a netmask.save Ratherthat breaks it is refused, so you find out while editing rather than grant part ofon the rangefirst and report success, the agent refuses the grant and tells you what to use instead:grant:

  • Check Point Identity Awareness maps one address per identity
  • PAN-OS User-ID mappings and registered-IP tags take a single address. Use an address group knoc for a network
  • A pfSense host alias holds addresses. The network alias type is the one that holds CIDR
  • An ipset hash:ip or bitmap:ip set stores single addresses. Use a hash:net set, or an nftables set with flags interval
Cisco Meraki takes IPv4 only Cloudflare Lists take IPv4 /8 to /32 and IPv6 /12 to /128 An agent on an older version cannot grant a whole network. Upgrade it, or use single addresses

Each of those raises an agent error code with its own page under Agent Error Codes.

A Custom Script knoc with Pass CIDR off is a warning rather than a refusal: the script still runs, but it receives a single address instead of the whole network.

Not the Same as Discovering Extra Client Addresses

Predefined sources replace the user's own address with a list you nominate. If what you want instead is to grant more of the user's addresses, for example an internal RFC1918 address alongside their external one, that is a different feature: see Additional client IP addresses.