Search Results

Knocknoc can refuse a grant when threat intelligence flags the connecting IP address. When that happens the grant is recorded as blocked rather than granted, and the user is told their access was refused. An administrator who trusts the connection can override...

Knocknoc integrates with Proxmox VE to dynamically control network access using the built-in Proxmox firewall. The Knocknoc agent maintains a Proxmox firewall ipset. As users authenticate and grants expire, the agent adds and removes IP entries in the ipset ov...

Agent error code #PROX000 indicates that Proxmox VE rejected the API token provided by the agent. The cluster returned HTTP 401 (Unauthorized). This error is distinct from authorization failures (#PROX001), which occur when the token is valid but lacks the req...

Agent error code #PROX001 indicates that the Proxmox API authenticated the token successfully but rejected the requested action with HTTP 403 (Forbidden). The token lacks the privileges needed to read or modify the configured firewall ipset. This error is dist...

Agent error code #PROX002 indicates that the agent connected to Proxmox VE but the cluster did not return a response before the request timed out. Common causes include: The Proxmox host is under heavy load and is slow to answer API requests A firewall or net...

Agent error code #PROX003 indicates that the agent could not establish a trusted TLS connection to Proxmox VE. The certificate presented by the cluster could not be verified. By default Proxmox VE uses a self-signed certificate, which the agent will not trust ...

Agent error code #PROX004 indicates that the agent reached the Proxmox host but the connection to the API port was actively refused. Nothing was listening on the address and port in the backend URL. Common causes include: The backend URL points at the wrong p...

Agent error code #PROX005 indicates that the agent could not resolve the Proxmox hostname in the backend URL to an IP address via DNS. Common causes include: A typo in the hostname configured in the Knocknoc backend The hostname is internal-only and the agent...

Agent error code #PROX006 indicates that a request to the Proxmox VE API failed at the network layer for a reason the agent could not classify more specifically. This is the catch-all transport error for Proxmox. If the agent could identify the cause it would ...

Agent error code #PROX100 indicates that the ipset configured in the Knocknoc ACL does not exist on the Proxmox VE cluster (or on the configured VM, for per-VM scope). The cluster returned HTTP 404 when the agent looked it up. This error is distinct from autho...

Agent error code #PROX101 indicates that the agent reached Proxmox VE and the ipset lookup did not fail with a not-found or permission error, but the response could not be used to read the current ipset contents. This is distinct from #PROX100 (the ipset does ...

Agent error code #PROX102 indicates that the agent tried to add an IP address to the configured Proxmox VE ipset and Proxmox rejected the operation. The agent only adds and removes ipset entries. It does not create the ipset itself. If the ipset is missing the...

Agent error code #PROX103 indicates that the agent tried to remove an IP address from the configured Proxmox VE ipset and Proxmox rejected the operation. The agent only adds and removes ipset entries. If the ipset is missing the agent returns #PROX100 instead....

Agent error code #PROX104 indicates that, for a per-VM (qemu) scoped Knoc, Proxmox VE could not find the node or VM the agent was directed to. This applies only to per-VM scope. For cluster-scoped Knocs the agent does not target a node or VM, and a missing ips...

Agent error code #PROX400 indicates that the agent received a response from Proxmox VE that it could not parse as the expected ipset data. The request reached Proxmox, but the body was not in the form the agent expected. Common causes include: The backend URL...

Configure 1Kosmos as a SAML identity provider (IdP) for Knocknoc. Once connected, your users authenticate against 1Kosmos — including its biometric and passwordless factors — and Knocknoc maps their group membership to access entitlements. This example assumes...

Ping Identity SSO Configure PingOne as a SAML identity provider (IdP) for Knocknoc. Users authenticate against Ping, and Knocknoc maps their group membership to access entitlements. This example assumes your Knocknoc instance is at https://<tenant>.knoc.cloud....

IPsets with firewalld On RHEL-family hosts — and any distribution that uses firewalld as its firewall front-end — Knocknoc does not talk to firewalld directly. As with the main IPSet backend, Knocknoc orchestrates the kernel's native IPSets, and firewalld simp...