Knocknoc

No entries match these filters. Clear filters

1. docs update Oct 29, 2026 · issue 124

   Knocknoc adds IPFilter integration, predefined networks, and structured action logging to its agent and orchestration layer⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

   • Knocknoc's agent now integrates with IPFilter to dynamically control network access on the host it runs on.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
   • Knocknoc adds predefined networks — named lists of networks defined once and reused across multiple places in configuration.
   • Knocknoc now writes a structured log line for every notable action and forwards them to configured destinations.

   3 details in Everything

2. v26.10 seen Oct 29, 2026 · issue 124

   Knocknoc adds Spur and IPinfo threat intelligence, native Splunk, Cribl, and Microsoft Sentinel integrations, and predefined network management in v26.10⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

   • Adds Spur and IPinfo threat intelligence integrations to the Trust Engine to assess connection risk — including residential proxies, commercial VPNsVPNsA virtual private network, an encrypted tunnel between devices or networks. It carries traffic across another network as though the endpoints had a private connection., and Tor exit nodes — after authentication but before network access opens, with support for BYOKBYOKBring Your Own Key — a cloud deployment model where the customer supplies and controls the encryption keys rather than the provider, so sensitive data stays under the customer's cryptographic authority. (bring-your-own credentials) or Knocknoc-provided options, and sends Knocknoc security and access events directly to Splunk, Splunk Cloud, Cribl, and Microsoft Sentinel without additional log collectors or storage pipelines, supporting multiple simultaneous destinations and a new SIEMSIEMSecurity information and event management, collecting logs from many systems and correlating events to find suspicious activity. Analysts use it to investigate alerts and incidents. integration view showing delivery status and failure details.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
   • Adds predefined networks that can be defined once and reused across access configurations and security policies, with controls to decide whether active access ends immediately or expires naturally when a network range is removed, and lets users select specific network sources rather than opening access to all available sources, where predefined networks are configured to allow this.
   • Improves device integrations: generates Palo Alto and Panorama device API keys directly within the Knocknoc setup workflow; processes access changes independently per device so a slow or unreachable firewall no longer holds up grants on healthy devices; adds network-range grant support across MikroTik, SonicWall, Sophos, Cisco Firepower, Azure, Cloudflare, Fortinet, nftables, and ipset; improves batching for F5 and Cloudflare to reduce repetitive device writes during bursts of access activity; and moves pfSense to network-compatible alias types for new configurations while existing configurations continue working.
   • Adds a unified view of system and orchestration agent health — including certificate, licensing, threat-intelligence, agent compatibility, and server consistency issues — with historical performance data and links to troubleshooting guidance, and lets users save frequently used portal views and personalise layouts to return quickly to the information that matters most.
   • Configuration audit log now captures richer before-and-after change information, and sessions can be followed into the audit log with exportable identity and session detail.

   +1 more show less

   • Adds the ability to terminate administrator sessions on demand, in addition to the existing user-session termination feature, restricts where administrators can sign in, and applies smarter protection against account lockouts.
   • Adds Spur and IPinfo threat intelligence integrations to the Trust Engine to assess connection risk — including residential proxies, commercial VPNsVPNsA virtual private network, an encrypted tunnel between devices or networks. It carries traffic across another network as though the endpoints had a private connection., and Tor exit nodes — after authentication but before network access opens, with support for BYOKBYOKBring Your Own Key — a cloud deployment model where the customer supplies and controls the encryption keys rather than the provider, so sensitive data stays under the customer's cryptographic authority. (bring-your-own credentials) or Knocknoc-provided options, and sends Knocknoc security and access events directly to Splunk, Splunk Cloud, Cribl, and Microsoft Sentinel without additional log collectors or storage pipelines, supporting multiple simultaneous destinations and a new SIEMSIEMSecurity information and event management, collecting logs from many systems and correlating events to find suspicious activity. Analysts use it to investigate alerts and incidents. integration view showing delivery status and failure details.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
   • Adds predefined networks that can be defined once and reused across access configurations and security policies, with controls to decide whether active access ends immediately or expires naturally when a network range is removed, and lets users select specific network sources rather than opening access to all available sources, where predefined networks are configured to allow this.
   • Adds a unified view of system and orchestration agent health — including certificate, licensing, threat-intelligence, agent compatibility, and server consistency issues — with historical performance data and links to troubleshooting guidance, and lets users save frequently used portal views and personalise layouts to return quickly to the information that matters most.

   3 more in Everything

3. docs update Oct 21, 2026 · issue 115

   Knocknoc adds Predefined IP sources, letting admins grant access based on fixed IPs rather than the user's login address.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

   • Adds Predefined IP sources to knocs, allowing access grants to be tied to fixed IP addresses instead of the IP the user logged in from.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

   1 detail in Everything

4. docs update Oct 6, 2026 · issue 096

   Knocknoc adds Cisco Firepower and EDLEDLExternal Dynamic List — a plain-text URL-hosted feed of IPs, domains, or URLs that a firewall or cyber tool polls on a schedule to keep block or allow lists current without manual updates. (Passive) knoc types for just-in-time network access control via Firepower management console or a self-hosted EDL.

   • New integrationAdds Cisco Firepower knoc type that connects to a Firepower management console via URL, API username/password, and a network group object UUIDUUIDA universally unique identifier, usually a 128-bit value used to identify an object across systems. It is designed to make independently generated identifiers unlikely to collide. to control access.
   • New integrationAdds EDL (Passive) knoc type that publishes an allowlist as an External Dynamic List served by Knocknoc itself, requiring no agent.
   • Supports an Insecure option on the Cisco Firepower integration for consoles whose certificates are not signed by a trusted CA.

   3 details in Everything

5. docs update Oct 6, 2026 · issue 096

   Knocknoc adds F5 BIG-IP inline integration, letting knocs write access rules directly to F5 Data Groups.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

   └──▷ HOW TO FIND IT
   Create a new F5 BIG-IP inline knoc that writes allowed IPs to a specific Data Group and Partition — useful when one F5 device serves multiple access policies.
   📍1. Open Knocs and select Create new knoc. 2. Select F5 BIG-IP under Inline. 3. On the Integration step, provide the management interface URL, Username, and Password (or reuse an existing F5 integration). 4. Pick the agent that will reach the device. 5. On Configure Settings, enter the Data Group name and the Partition (if not Common). 6. Select users or link a SAML group, then set description, grant duration, and trust policy. 7. On Review, confirm the connection check passes, then select Create Knoc.
   • Adds F5 BIG-IP as an Inline knoc type, with a dedicated integration that stores management-interface URL, username, and password once and is shared across all knocs targeting the same device.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
   • Supports per-knoc Data Group and Partition configuration so two knocs sharing one F5 BIG-IP can write to different data groups independently.
   • Adds a connection-validation step (Review) during knoc creation that checks the F5 integration before the knoc is saved.

   3 details in Everything

6. docs update Oct 6, 2026 · issue 096

   Knocknoc adds Passive mode for FortiGate: device polls a Knocknoc-hosted EDLEDLExternal Dynamic List — a plain-text URL-hosted feed of IPs, domains, or URLs that a firewall or cyber tool polls on a schedule to keep block or allow lists current without manual updates. allowlist without any firewall API calls or agent push.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

   └──▷ HOW TO FIND IT
   Set up a Passive FortiGate integration so the firewall polls Knocknoc's EDL without requiring API access from Knocknoc to the device.
   📍1. Go to Knocs › New, pick the FortiGate card. 2. In Configure Settings, set Application Type to Passive. 3. Copy the EDL URL from the Knoc's Integration Info panel. 4. On the FortiGate, create an External Dynamic List threat feed and set its URL to the copied EDL URL. 5. Reference that feed in a firewall policy to allow only authenticated Knocknoc user IPs.
   • Adds Passive mode for FortiGate integrations, where the firewall polls a Knocknoc-hosted External Dynamic List (EDL) of authenticated user IPs — Knocknoc never calls the firewall API and nothing is pushed to the device.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
   • Sets Application Type to Passive on the FortiGate card via Configure Settings; a Passive Knoc carries no device fields, only description and display options.
   • Exposes an EDL URL in the Knoc's Integration Info panel that is set as the External Dynamic List URL on the FortiGate.
   • Supports a VDOM field in Configure Settings for FortiGate and FortiManager Passive+ integrations, where it identifies the VDOM on each FortiGate that holds the external feed.
   • Supports FortiManager with three distinct integration modes: Active (single FortiGate), FortiManager Active (managing multiple FortiGates), and FortiManager Passive+ (EDL-based, with an External Feed Name field Knocknoc uses to locate and refresh the connector).

   5 details in Everything

7. docs update Oct 6, 2026 · issue 096

   Knocknoc adds shared credential management across Knocs, per-integration activity visibility, tabbed integration views, and a duplicate-merge workflow.

   • Adds shared integrations so multiple Knocs protecting services behind the same firewall can reuse one set of credentials — enter or rotate them once and every Knoc picks up the change.
   • Adds a per-integration activity page showing which Knocs use the integration, who has been connecting, grant volumes, average wait times, and failures — with a path from a failed user back to the enforcing system.
   • New integrationAdds an Inline / proxy tab and an On host tab to the integrations view, where the On host tab shows one row per agent and enforcement type.
   • Adds a duplicate-integration merge workflow: agents compare integrations they hold, surface ones that match (same type, same address, held by the same agent), and allow merging each set into one shared integration while keeping every Knoc's assignment.

   4 details in Everything

8. docs update Oct 6, 2026 · issue 096

   Knocknoc adds Traefik middleware plugin, Palo Alto/Panorama firewall orchestration, firewalldfirewalldA Linux firewall management daemon maintained by Red Hat that provides a dynamic interface over nftables or iptables, letting cyber tools adjust firewall rules at runtime without restarting the entire ruleset. host enforcement, and secret-authenticated EDLEDLExternal Dynamic List — a plain-text URL-hosted feed of IPs, domains, or URLs that a firewall or cyber tool polls on a schedule to keep block or allow lists current without manual updates. allowlists.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

   • Adds Palo Alto firewall orchestration — directly or via Panorama — to dynamically control network access.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
   • Adds a Knocknoc Traefik plugin (middleware) to protect services running behind Traefik.
   • Adds firewalld-based on-host enforcement for RHELRHELRed Hat Enterprise Linux, a commercially supported Linux distribution maintained by Red Hat, chosen by cyber tools for its long support lifecycle, certified hardware compatibility, and enterprise deployment prevalence.-family distributions.

   3 details in Everything

9. docs update Oct 6, 2026 · issue 096

   Knocknoc adds blocked-grant overrides with mandatory audit comments and full Trust Engine policy visibility in grant history.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

   └──▷ HOW TO FIND IT
   When a legitimate user is blocked by a trust policy (e.g. connecting from an unrecognised network), override that single grant without loosening the policy for everyone.
   📍1. Go to https://<your-server>/admin 2. Open the Knoc where the grant was blocked. 3. In the grant history, locate the blocked (red) grant row. 4. Click Grant Anyway. 5. In the 'Override blocked grant?' dialog, review the matched policy and restrictions, then enter a comment explaining why the override is justified. 6. Click Confirm — Knocknoc applies the grant for the normal grant duration and logs the override under Admin grants in the audit log.
   Investigate why a user was blocked and who, if anyone, overrode it — without leaving the admin console.
   📍1. Go to Admin › Trust Engine › Activity. 2. Use the outcome, policy, user, address, or Knoc filters to narrow results. 3. For sessions still active, go to Admin › Identities › Sessions › the session › Trust policy, then open the Access this session tab to expand individual blocked rows and see the full Trust Engine finding.
   • Adds a Grant Anyway override flow for blocked grants, requiring a mandatory comment before confirmation, so administrators can bypass a trust-policy block on a single grant without changing the underlying policy.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
   • Records every override as an Admin overrode blocked grant audit-log entry under the Admin grants category, capturing the administrator, justification comment, user, IP address, requesting IP, Knoc, user agent, and timestamp.
   • Expands blocked grant rows in a Knoc's grant history to show the full Trust Engine finding — which policy decided, which restrictions matched, and what each was set to at the time of the connection.
   • Shows per-session trust-policy results under Admin > Identities > Sessions > the session > Trust policy, with blocked rows on the Access this session tab expanding to the same finding detail.
   • Distinguishes a Challenge hold (shown as Verification needed with a Verify button in the user portal) from an outright block, keeping challenged grants out of grant history until the user verifies.

   +1 more show less

   • Marks overridden grants in history as (overridden) on the original blocked entry and creates a new Admin Override grant entry showing the admin's name and comment.

   6 details in Everything

10. docs update Oct 6, 2026 · issue 096

    Knocknoc adds manual access grants — give any IP a 20-minute access window without changing your default-deny policy.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

    └──▷ HOW TO FIND IT
    Grant emergency 20-minute access to a specific IP through a Knoc when you're already on the Knoc edit page.
    📍1. Navigate to https://<your-server>/admin 2. Open the target Knoc. 3. Scroll to the Manual access section. 4. Enter the IP address (internal or external) to allow. 5. Choose a duration and apply — that IP now has 20 minutes of access through that Knoc.
    Quickly grant a 20-minute IP access window from the Knocs list without opening the full editor — useful for fast triage or testing.
    📍1. Open the Knocs list in the Admin console. 2. Locate the target Knoc. 3. Click its vertical-ellipsis menu. 4. Select Manual access. 5. Enter the IP address and save — the IP receives a 20-minute access window.
    • Adds a Manual access section inside individual Knoc edit pages, letting admins grant a specific IP (internal or external) a 20-minute access window directly while editing that Knoc.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
    • Adds a Manual access option in the Knocs list view via the vertical-ellipsis menu, so admins can grant a 20-minute IP access window without opening the full Knoc editor.

    2 details in Everything

11. docs update Oct 6, 2026 · issue 096

    Knocknoc adds per-Knoc additional client IP discovery with IPv4/IPv6IPv6The current version of the Internet Protocol, standardized by the IETF, using 128-bit addresses to replace the exhausted IPv4 space. Cyber tools target it because modern networks run dual-stack or IPv6-only. family controls and RFC1918RFC1918IETF standard that reserves three IPv4 address ranges (10.x, 172.16–31.x, 192.168.x) for private networks, never routed on the public internet, giving tools a reliable way to identify internal traffic. filtering⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

    └──▷ HOW TO FIND IT
    Enable additional IP discovery for a Knoc that protects an internal resource, granting only RFC1918 addresses so public IPs are never added to the ACLACLAn access control list, a set of rules allowing or denying operations for particular users, services or network addresses. It decides who can use a resource..
    📍In the Knocknoc Admin panel, go to Settings and switch on Client IP discovery. Then open the target Knoc, tick Discover additional IP addresses, set Which discovered addresses to add to Add RFC1918 only, and set Which address families to add to Add V4 only.
    Force IPv4-only address capture for users on a dual-stack connection so the discovered IP is always a routable IPv4 address.
    copy

    $ curl https://v4.myip.knoc.io

    • Enables Discover additional IP addresses per-Knoc option (requires Client IP discovery enabled in Settings) to add extra observed client addresses to the grant list.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
    • Adds https://v4.myip.knoc.io and https://v6.myip.knoc.io endpoints to capture IPv4-only or IPv6-only addresses, supplementing the default myip.knoc.io dual-stack URL.
    • Per-Knoc Which discovered addresses to add control offers three modes: Add all IPs (default), Add RFC1918 only (includes fc00::/7 IPv6 unique-local), and Add non-RFC1918.
    • Per-Knoc Which address families to add control offers Add V4 and V6 (default), Add V4 only, or Add V6 only to avoid granting unusable addresses to dual-stack users.
    • Per-Knoc Do not add the user's own IP address, only discovered ones option grants only discovered addresses, excluding the server-observed source IP.

    +1 more show less

    • Supports custom self-hosted IP-discovery microservices (e.g., .NET, Java, Node, Go, PHP) as a drop-in replacement for myip.knoc.io.

    6 details in Everything

12. docs update Oct 6, 2026 · issue 096

    Knocknoc adds referrer-based redirects, per-Knoc SAMLSAMLA standard for passing signed identity assertions between a sign-in provider and an application. It lets a user sign in through their organization's identity provider. enforcement, auto-browse, and instant redirect options for frictionless user access flows.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

    └──▷ USE IT
    Embed this on an access-denied page of a reverse proxy so users are automatically sent to Knocknoc and returned to the exact path they requested after authenticating.
    text copy

    <script>
    const baseUrl = 'knocknoc.mycompany.com';
    setTimeout(() => {
      const currentUrl = document.URL;
      if (!currentUrl || !baseUrl) return;
      try {
        let normalizedBase = baseUrl.trim();
        if (!/^https?:\/\//i.test(normalizedBase)) {
          normalizedBase = 'https://' + normalizedBase;
        }
        const redirectUrl = normalizedBase + '?referrer=' + encodeURIComponent(currentUrl);
        const url = new URL(redirectUrl);
        window.location.href = url.toString();
      } catch (err) {
        console.error('Invalid redirect URL:', err);
      }
    }, 3000);
    </script>

    Enable invisible Knocknoc access for a specific app — users hit the protected resource, pass through SAML, and land back without ever seeing the Knocknoc UI.
    📍1. In the Knoc Options for the target Knoc, enable Always redirect to SAML login. 2. In the Knoc Options for the same Knoc, enable Instant redirects. 3. Under site settings, enable Disable local user login. 4. Add the referrer JavaScript snippet to the resource's access-denied page, setting baseUrl to your Knocknoc instance hostname. 5. Confirm the Knoc URL base matches the referrer URL that will be passed by the snippet.
    • Adds referrer query parameter support on the Knocknoc login URL (e.g.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠ https://my.example.knocknoc.com?referrer=https://my.website.com) to redirect authenticated users back to their originating resource.
    • Adds a per-Knoc Always redirect to SAML login option in the Knoc Options section, sending unauthenticated visitors straight to SAML login without showing the local login page — scoped per Knoc rather than site-wide.
    • Adds a per-Knoc Auto-browse option in Knoc configuration that automatically forwards a user after login directly to the Knoc when it is the only one available to them, and can trigger automatic launch of non-browser protocols (e.g. sftp, SAP).
    • Adds a per-Knoc Instant redirects setting in Knoc Options that performs auto-browse and referrer URL redirects immediately rather than showing a countdown box.
    • Adds site-wide Disable local user login option that forces all logins through SAML and enables automatic redirection into the SAML process on any login-page visit.

    +1 more show less

    • Provides a JavaScript snippet for reverse proxies and websites that redirects unauthenticated users to Knocknoc with a referrer parameter encoding the full current URL, redirecting the user back to the original URL after authentication.

    6 details in Everything

13. docs update Oct 6, 2026 · issue 096

    Knocknoc adds per-Knoc TOTPTOTPA one-time password algorithm (RFC 6238) that generates short-lived codes from a shared secret and the current time, giving cyber tools phishing-resistant second-factor authentication without a server round-trip. enforcement, requiring a 6-digit authenticator code before each access grant is processed.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

    └──▷ HOW TO FIND IT
    Protect against phished Entra MFAMFAMulti-factor authentication, requiring proof from different categories, such as a password and a hardware key, to sign in. It reduces reliance on a password alone. tokens or stolen browser refresh tokensrefresh tokensA credential used to obtain a new access token without signing in again. It is sent to the authorization service rather than used directly to call the protected API. by requiring a live TOTP code before each grant on a sensitive Knoc.
    📍In the Knocknoc admin console, open the target Knoc › Knoc Options › enable Require TOTP code when accessing grant, then save. Users without 2FA enrolled will be prompted to scan the QR code or copy the setup key into their authenticator app on next access.
    • Adds a Require TOTP code when accessing grant option in the Knoc Options area, enforcing a 6-digit authenticator code before each grant is processed — independent of and in addition to any SSOSSOSingle sign-on, using one identity provider to sign in to multiple applications. It reduces separate passwords and centralizes account and access management./MFA session (e.g.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠ Entra MFA).
    • TOTP entry is rate-limited per grant, and users who have not yet enrolled are prompted to scan a QR code or copy a setup key to register their authenticator app before access is allowed.

    2 details in Everything

14. docs update Oct 6, 2026 · issue 096

    Knocknoc adds click to grant and click to revoke interactive access control buttons to Knocs for temporal access workflows.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

    └──▷ HOW TO FIND IT
    Enable click-to-grant/revoke on a Knoc so users must explicitly confirm access requests — useful when you want interactive approval before granting network access.
    📍In the Knocknoc admin console, open the Knoc you want to configure, navigate to the Knoc Option area, and enable the click to grant and click to revoke options.
    • Adds click to grant and click to revoke buttons to Knocs, requiring users to manually trigger each access grant or revocation after logging in for an additional interactive security layer.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
    • Logs grant and revoke button clicks as specific events in Knocknoc's audit logging system.
    • Combines click-to-grant/revoke with shorter grant periods for tighter temporal access control.
    • Adds click to grant and click to revoke buttons to Knocs, requiring users to manually trigger each access grant or revocation after logging in for an additional interactive security layer.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

    2 more in Everything

15. docs update Oct 6, 2026 · issue 096

    Knocknoc documents grant/revoke lifecycle, Knoc pause behavior on unreachable devices, and grant history filtering in the admin UI.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

    └──▷ HOW TO FIND IT
    Spot grants that failed to revoke — meaning the address may still have access on the device — by filtering the Knoc grant history to show only error rows.
    📍In the Knoc's admin page, open the grant history list and set the Status filter to Errors. Rows with status revoke failed appear first; the Agent error code beside each row links to resolution steps.
    Confirm the Agent host can reach a device's management address after a #299003 pause, so held-back revokes are applied on the next change.
    copy

    $ curl <device-api-url>

    • Adds revoke failed status and Errors status filter in each Knoc's grant history view, surfacing grants whose revokes could not be applied to the underlying device.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
    • Introduces automatic Knoc pause-and-backoff logic: after two consecutive connection failures, the Agent pauses that Knoc for two minutes, doubling on each retry up to a fifteen-minute cap.
    • Documents agent error #299003 (Device is unreachable) as the signal for held-back revokes, with a dedicated troubleshooting page at 299003 - Device Is Unreachable.
    • Each Knoc's admin page now lists recent grants and revocations, filterable by Status (Live, Revoked, Blocked) and IP type, with sortable columns showing grantee, IP address, status, and grant/revoke timestamps.

    4 details in Everything

16. docs update Oct 6, 2026 · issue 096

    New guide shows how to run Knocknoc behind HAProxy with HTTP/2, WebSocketWebSocketA protocol that upgrades an HTTP connection into a persistent, full-duplex channel, letting a server push data to a client without repeated polling. Cyber tools use it for real-time event streaming and live command output., and TrustedForwarders support.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

    └──▷ USE IT
    Wire HAProxy to Knocknoc as a backend, preserving real client IPs, when you already manage TLS termination in HAProxy.
    /etc/haproxy/haproxy.cfg copy

    frontend Sol1-Frontend
      bind 0.0.0.0:443 ssl crt /etc/ssl/private/star.mydomain.com alpn h2
      bind 0.0.0.0:80
      mode http
      option forwardfor
      acl hdr_knocknoc hdr(host) -m beg -i knocknoc.mydomain.com
      http-request set-header X-Forwarded-Proto https if { ssl_fc }
      http-request redirect scheme https unless { ssl_fc }
      use_backend knocknoc if hdr_knocknoc
      default_backend access_denied
    
    backend knocknoc
      mode http
      balance roundrobin
      option forwardfor
      server knocknoc 127.0.0.1:8756 check ssl verify none

    • Adds a sample HAProxy frontend/backend configuration for Knocknoc, covering HTTP/2 (alpn h2), HTTP-to-HTTPSHTTPSHTTP carried over an encrypted TLS connection. It protects traffic in transit and lets a browser verify the server's certificate. redirect, WebSocket support (required by knocknoc-agent), and a custom 403 error page served from /var/www/403.http.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

    1 detail in Everything

17. docs update Oct 6, 2026 · issue 096

    Docs now cover SaaSSaaSSoftware delivered over the internet and run on the provider's infrastructure, so the buyer pays a subscription instead of installing or operating anything locally. and self-hosted deployment, high availability, agent installation, Knoc access-rule configuration, Sessions view, and API Keys.

    • Documents SaaS and self-hosted server deployment options, including database setup and high-availability configuration.
    • Introduces the Knoc access-rule model — defining who can request access to a resource and how grants are revoked.
    • Covers agent installation and registration for applying access changes on firewalls, proxies, and other enforcement points.
    • Documents the Sessions tab under Identities for monitoring active access sessions in the admin console.
    • Outlines API Keys management and database/application-level backup procedures.

    5 details in Everything

    • New integration Palo Alto / Panorama firewall integration
    • New integration Traefik reverse-proxy integration via Knocknoc Traefik plugin
    • New supported platform RHEL-family / firewalld host enforcement
18. docs update Oct 6, 2026 · issue 096
    • New integration Palo Alto / Panorama firewall integration
    • New integration Traefik middleware plugin integration
    • New supported platform RHEL-family / firewalld host support
19. docs update Sep 29, 2026 · issue 089

    Knocknoc adds an Okta integration that dynamically manages an Okta IP Zone as users authenticate and grants expire.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

    └──▷ HOW TO FIND IT
    Wire up a new Okta Knoc in Knocknoc by selecting the Okta vendor and supplying your org domain and API token — so the agent can begin managing your IP Zone immediately.
    📍In the Knocknoc wizard: 1. Go to Firewall -> Active and choose Knoc type. 2. Set Vendor to Okta. 3. Under Backend, set Okta Domain to your org hostname (e.g., acme.okta.com) — no scheme, no trailing slash. 4. Paste the API token generated from the Okta admin console (Security › API › Tokens) into the API Token field. 5. Under ACL, set Network Zone ID to the nzo... ID copied from your Okta IP Zone. 6. Save and assign users/groups to the Knoc.
    Pre-create the Okta IP Zone Knocknoc will manage, so you can copy its ID before configuring the ACLACLAn access control list, a set of rules allowing or denying operations for particular users, services or network addresses. It decides who can use a resource. in Knocknoc.
    📍In the Okta admin console: 1. Go to Security › Networks. 2. Click Add Zone › IP Zone. 3. Set Name to Knocknoc Authenticated Users. 4. Add a sentinel CIDR (e.g., 192.0.2.0/32) under Gateway IPs so the zone is not empty. 5. Leave Proxy IPs blank. 6. Click Save, then copy the Network Zone ID (nzo...) from the zone detail page.
    Enforce Knocknoc-managed IP membership in an Okta authentication policy so only users with a current grant can sign in to a protected app.
    📍In the Okta admin console: 1. Go to Security › Authentication Policies › Show authentication steps › App sign-in. 2. Select the policy protecting your target app. 3. Edit or create a rule: set the IF condition to 'User's IP is in any of the following zones' and select the Knocknoc-managed zone. 4. Set the THEN action to Allowed when in zone, Denied otherwise. 5. Save the policy.
    • Adds Okta as a supported vendor in the Knocknoc agent, using an Okta API Token and Network Zone ID (nzo...) to dynamically rewrite an Okta IP Zone's gateways list as users authenticate and grants expire.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
    • Enables Okta sign-on policy enforcement by User's IP is in any of the following zones conditions that reference the Knocknoc-managed zone, gating app access to currently authenticated IPs.
    • Exposes structured error codes from the Knocknoc agent when Okta API operations fail, with resolution details linked from the admin guide.

    3 details in Everything

20. docs update Sep 29, 2026 · issue 089

    Knocknoc now orchestrates DigitalOcean Cloud Firewalls for just-in-time IP allowlisting on Droplets, Load Balancers, and Kubernetes Clusters.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

    └──▷ HOW TO FIND IT
    Configure a new Knoc to grant just-in-time inbound TCPTCPA network protocol that delivers a reliable, ordered stream of bytes between two endpoints. It detects lost data and retransmits it./22 access to a DigitalOcean Droplet — users' IPs are added on login and removed on logout.
    📍1. Log in to Knocknoc as an Admin (/admin) 2. Select Knoc › Create new 3. Select Firewalls/Appliances 4. Select Active, then DigitalOcean 5. Paste your DigitalOcean Personal Access Token (needs Firewall: Read+Update, Tag: Create+Read, Droplet: Read) 6. Paste the Firewall ID (UUID from https://cloud.digitalocean.com/networking/firewalls/<id>) 7. Set Direction: Inbound 8. Set Protocol: TCP 9. Set Port Range: 22
    • Supports configurable Direction (Inbound or Outbound), Protocol (TCP, UDPUDPA network protocol that sends individual messages without guaranteeing delivery or order. Applications trade built-in reliability for less overhead and can add their own recovery., or ICMP), and Port Range (single port, range such as 8000-9000, or all) per Knoc ACLACLAn access control list, a set of rules allowing or denying operations for particular users, services or network addresses. It decides who can use a resource. configuration for DigitalOcean Firewall rules.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
    • Uses a knocknoc tag on DigitalOcean firewall rule sources or destinations to isolate Knocknoc-managed rules, leaving all untagged manually-created rules untouched.

    2 details in Everything

21. docs update Sep 29, 2026 · issue 089

    Knocknoc now orchestrates Cloudflare IP lists for dynamic network allowlisting into Cloudflare WAFWAFA reverse proxy that inspects HTTP/HTTPS traffic and blocks requests matching known attack patterns such as SQL injection or XSS, sitting between clients and a web application to filter malicious input before it reaches the server. and filtering services.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

    └──▷ HOW TO FIND IT
    Configure a Knocknoc Knoc to dynamically manage a Cloudflare account-level IP allowlist so only authenticated Knocknoc users can pass Cloudflare WAF rules.
    📍1. In Knocknoc admin (/admin), select Knoc › Create new. 2. Select Firewalls/Appliances. 3. Select Active, then Cloudflare. 4. Enter your Cloudflare Account ID. 5. Enter the Cloudflare API token (with Account Filter Lists › Edit permission). 6. Enter the list name matching the Identifier set in Cloudflare › Configurations › Lists.
    • Adds Cloudflare as an Active orchestration target under Firewalls/Appliances in the Knocknoc admin UI, enabling dynamic management of Cloudflare account-level IP lists for WAF and network allowlisting (requires agent version 26.01+).⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
    • Includes a JavaScript redirect snippet that sends unauthenticated users to the Knocknoc login portal via a ?referrer= parameter before returning them to the protected Cloudflare-fronted asset.

    2 details in Everything

22. docs update Sep 29, 2026 · issue 089

    Knocknoc adds GCP integration: dynamically manage VPC Firewall RulesVPC Firewall RulesPer-network access-control policies in Google Cloud that allow or deny traffic to VM instances based on protocol, port, and source or destination, enforced at the hypervisor level before packets reach the OS. and Cloud Armor Security PoliciesCloud Armor Security PoliciesGoogle Cloud's layer-7 firewall rules that sit in front of load balancers to filter traffic by IP, geo, or request attributes, giving cyber tools a managed WAF and DDoS-mitigation layer without running their own proxy. on user auth/logout.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

    └──▷ HOW TO FIND IT
    Lock down SSH to GCP VMs so only authenticated Knocknoc users can reach them — using a least-privilege custom IAMIAMIdentity and Access Management — a framework of policies and services for controlling who can authenticate to systems and what resources they are authorized to use, letting cyber tools enforce least-privilege and audit access. role instead of the broad predefined role.
    📍In the GCP Console: 1. Go to IAM & Admin › Roles, click Create Role, name it Knocknoc VPC Firewall, and add permissions: compute.firewalls.get, compute.firewalls.update. 2. Go to VPC Network › Firewall, click Create Firewall Rule: set Direction to Ingress, Source IP ranges to 198.51.100.0/32, Protocols/ports to TCP:22, and note the rule name (e.g. knocknoc-allow-ssh). 3. In Knocknoc, create a Cloud/SaaS Knoc, choose Google Cloud Platform, set GCP Project ID to your project (e.g. my-project-123456), paste the JSON service account key, then in ACL set GCP Mode to VPC Firewall Rule, Firewall Rule Name to knocknoc-allow-ssh, Direction to Ingress.
    Protect a Cloud Load Balancer-fronted service so only authenticated Knocknoc users are allowed through Cloud Armor, with no long-lived key material on GCP.
    📍In the GCP Console: 1. Go to Network Security › Cloud Armor, create a policy named knocknoc-policy with default rule action Deny, attach it to your backend service. 2. Add a rule: Mode Basic, Match 198.51.100.0/32, Action Allow, Priority 1000. Note the policy name and priority. 3. Attach the Knocknoc agent service account to the Compute Engine VM running the agent (ADC — no JSON key needed). 4. In Knocknoc, create a Cloud/SaaS Knoc, choose Google Cloud Platform, set GCP Project ID, leave Service Account Key (JSON) empty, then in ACL set GCP Mode to Cloud Armor Security Policy, Security Policy Name to knocknoc-policy, Rule Priority to 1000, Action to Allow.
    • Adds GCP Project ID and Service Account Key (JSON) backend fields in the Knocknoc wizard to authenticate against the GCP Compute Engine API using either a JSON service account key or Application Default Credentials (ADC).⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
    • Adds GCP Mode: VPC Firewall Rule ACLACLAn access control list, a set of rules allowing or denying operations for particular users, services or network addresses. It decides who can use a resource. option with Firewall Rule Name and Direction (Ingress/Egress) fields, enabling Knocknoc to dynamically add/remove authenticated user IPs from VPCVPCA logically isolated virtual network inside a public cloud provider's infrastructure, letting tools deploy resources with private addressing, controlled routing, and firewall rules without managing physical hardware. firewall rule source or destination ranges.
    • Adds GCP Mode: Cloud Armor Security Policy ACL option with Security Policy Name, Rule Priority, and Action fields, enabling Knocknoc to dynamically add/remove authenticated user IPs from Cloud Armor security policy rules protecting services behind a Google Cloud Load Balancer.
    • Supports Application Default Credentials (ADC) with Workload Identity Federation for agents running on GCP (Compute Engine VM or GKEGKEGoogle Kubernetes Engine, Google's managed Kubernetes service, which lets cyber tools run containerized workloads without managing the underlying cluster infrastructure. pod), avoiding long-lived key material by leaving the Service Account Key field empty.
    • Integrates with Google Cloud Platform to dynamically control network access for VMs, GKE nodes, and Cloud Load Balancer-protected services upon user authentication, with IP removal on logout or grant expiry.

    5 details in Everything

23. docs update Sep 29, 2026 · issue 089

    Knocknoc adds AWS WAFWAFA reverse proxy that inspects HTTP/HTTPS traffic and blocks requests matching known attack patterns such as SQL injection or XSS, sitting between clients and a web application to filter malicious input before it reaches the server. IP set integration, dynamically granting/revoking ALBALBAWS Application Load Balancer, a managed Layer 7 load balancer from Amazon that routes HTTP/HTTPS traffic by host, path, or header, giving tools flexible ingress control without managing their own proxy. access by updating WAF IP sets via a bundled script.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

    └──▷ TRY IT
    Activate the AWS WAF integration on a Knocknoc agent so the agent can call the AWS API to manage IP sets.
    copy

    $ /opt/knocknoc-agent/knocker/knocker enable aws

    Manually add or remove a specific IP from an AWS WAF IP set — useful for testing the integration before wiring it into a Knocknoc group.
    copy

    $ /opt/knocknoc-agent/scripts/update-aws-waf-ipset.sh add KnocknocWebACL 203.0.113.42

    • Enables the aws integration via /opt/knocknoc-agent/knocker/knocker enable aws, which activates the update-aws-waf-ipset.sh script for dynamic AWS WAF IP set management.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
    • Adds update-aws-waf-ipset.sh (at /opt/knocknoc-agent/scripts/update-aws-waf-ipset.sh) accepting <ACTION> <ACL_NAME_OR_ID> <IP_ADDRESS> arguments to add or remove IPs from an AWS WAF IP set in real time.
    • Supports configuring a Knocknoc Backend pointing to update-aws-waf-ipset.sh and mapping WAF IP set IDs to Backends via ACLsACLsAn access control list, a set of rules allowing or denying operations for particular users, services or network addresses. It decides who can use a resource. in the Knocknoc Admin panel.
    • Supports a custom HTML 403 response body in AWS WAF so users hitting the ALB without access see a branded 'Access Denied / You must Knoc before you enter' page.
    • Requires minimal IAMIAMIdentity and Access Management — a framework of policies and services for controlling who can authenticate to systems and what resources they are authorized to use, letting cyber tools enforce least-privilege and audit access. permissions (wafv2:ListIPSets, wafv2:GetIPSet, wafv2:UpdateIPSet) scoped to the specific IP set ARN for the Knocknoc agent identity.

    5 details in Everything

24. docs update Sep 29, 2026 · issue 089

    Knocknoc adds just-in-time orchestration of Amazon AWS EC2EC2Amazon's cloud virtual-machine service, letting tools run on-demand servers without managing physical hardware. Security Groups, dynamically granting and revoking IP-level access tied to your IDPIDPA service that authenticates users and supplies identity information to other applications. It is the sign-in authority behind many single sign-on systems..⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

    └──▷ USE IT
    Create the minimal IAMIAMIdentity and Access Management — a framework of policies and services for controlling who can authenticate to systems and what resources they are authorized to use, letting cyber tools enforce least-privilege and audit access. policy granting the Knocknoc orchestration agent rights to add/remove IP rules on EC2 Security Groups.
    json copy

    {
      "Sid": "VisualEditor0",
      "Effect": "Allow",
      "Action": [
        "ec2:RevokeSecurityGroupIngress",
        "ec2:AuthorizeSecurityGroupEgress",
        "ec2:AuthorizeSecurityGroupIngress",
        "ec2:CreateTags",
        "ec2:RevokeSecurityGroupEgress",
        "ec2:DescribeSecurityGroups"
      ],
      "Resource": "*"
    }

    Install the AWS CLI on the Knocknoc orchestration agent (Debian/Ubuntu) so the agent can call AWS APIs to manage Security Group rules.
    copy

    $ sudo apt-get install awscli

    Wire up a new just-in-time RDPRDPA Microsoft protocol that lets a user view and control a remote Windows desktop over a network, giving cyber tools a standard channel to audit, attack-simulate, or monitor Windows systems remotely. Knoc backed by an AWS EC2 Security Group so authenticated users are granted IP-level access on demand.
    📍Admin UI: Knocs -> Create new Knoc -> Firewalls -> Active -> Amazon AWS Access Key: <your-iam-access-key> Secret Access Key: <your-iam-secret-access-key> Region: us-east-1 Security Group ID: sg-0abc123456789def0 Port: 3389 Description: Just-in-time RDP access URL: rdp://<host>
    • Adds support for orchestrating Amazon AWS EC2 Security Groups as a firewall target, enabling just-in-time network exposure for authenticated users without AWS IAMAWS IAMAWS Identity and Access Management is Amazon's service for controlling who and what can call AWS APIs, by attaching policies that allow or deny actions on resources. Cyber tools use it to scope credentials to least privilege. or AWS console access.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
    • Requires the AWS CLI (awscli) on the orchestration agent host (Linux: sudo apt-get install awscli or yum install awscli; Windows: installer from AWS) to manage Security Group rules.
    • Configures a Knoc via Admin UI under Firewalls -> Active -> Amazon AWS, supplying AWS Access Key, Secret Access Key, Region, Security Group ID (sg-xxxxx), Port, Description, and URL (e.g. rdp:// or ssh://).

    3 details in Everything

25. docs update Sep 29, 2026 · issue 089

    Knocknoc adds Microsoft Entra IDEntra IDMicrosoft's cloud-based identity and access management service, formerly Azure Active Directory, used by cyber tools to authenticate users and enforce access policies in Microsoft 365 and Azure environments. (Named Location) integration to dynamically gate Conditional AccessConditional AccessA policy enforcement framework, most commonly Microsoft's in Entra ID, that grants or blocks resource access based on signals like user identity, device state, and location — letting cyber tools trigger step-up auth or deny risky sessions. sign-ins by user IP via Microsoft Graph APIMicrosoft Graph APIA unified REST API maintained by Microsoft that exposes data and actions across Microsoft 365 services, letting cyber tools query users, emails, files, and sign-in logs through a single authenticated endpoint..⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

    └──▷ TRY IT
    Verify that Knocknoc's agent credentials can reach the Named Location API and that the correct IPs are listed after a test user authenticates.
    copy

    $ curl -s -X GET 'https://graph.microsoft.com/v1.0/identity/conditionalAccess/namedLocations/<Named-Location-ID>' -H 'Authorization: Bearer <access_token>' | jq '.ipRanges'

    Set up the Knocknoc Microsoft Entra ID Knoc via UI after obtaining your app registration values.
    📍1. In Knocknoc, go to Knocs › Add Knoc and select the Cloud / SaaS Knoc type. 2. Set Vendor to Microsoft Entra ID. 3. Under Backend, enter your Tenant ID (Directory tenant GUID), Client ID (Application client GUID), and Client Secret (the Value from Certificates & secrets). 4. Under ACL, paste the Named Location ID (GUID from the Azure portal URL for the IP Named Location). 5. Assign users and save.
    • Adds a Cloud / SaaS Knoc type with Microsoft Entra ID as a selectable Vendor, enabling dynamic IP-based Conditional Access control via Microsoft GraphMicrosoft GraphMicrosoft's unified REST API for accessing data and services across Microsoft 365, Azure AD, and related cloud products, giving cyber tools a single authenticated endpoint to query users, emails, files, and sign-in logs. Named Locations.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
    • Requires the Policy.Read.All and Policy.ReadWrite.ConditionalAccess Microsoft Graph application permissions on the app registration for the Knocknoc agent.
    • Exposes Tenant ID, Client ID, and Client Secret backend configuration fields for the Entra integration, using the OAuth 2.0OAuth 2.0An open authorization framework (IETF RFC 6749) that lets a service grant limited API access to a third party without sharing credentials, giving cyber tools a standard way to authenticate against external platforms. client-credentials flow against login.microsoftonline.com.
    • Introduces structured agent error codes (ENTRA001, ENTRA002, ENTRA005, ENTRA052, ENTRA053) for diagnosing Entra Named Location operation failures.

    4 details in Everything

26. docs update Sep 29, 2026 · issue 089

    Knocknoc adds dynamic IP management for Azure Network Security Groups via a new Azure NSG integration.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

    └──▷ USE IT
    Set up the Azure service principal with the minimal permissions Knocknoc needs to read and write NSG security rules.
    json copy

    {
      "properties": {
        "roleName": "Knocknoc NSG edit",
        "description": "",
        "permissions": [
          {
            "actions": [
              "Microsoft.Network/networkSecurityGroups/read",
              "Microsoft.Network/networkSecurityGroups/securityRules/read",
              "Microsoft.Network/networkSecurityGroups/securityRules/write",
              "Microsoft.Network/networkSecurityGroups/securityRules/delete"
            ],
            "notActions": [],
            "dataActions": [],
            "notDataActions": []
          }
        ]
      }
    }

    Install the Azure CLI on the Knocknoc Agent machine (Debian) so the Azure NSG integration can authenticate and manage rules.
    copy

    $ curl -sL https://aka.ms/InstallAzureCLIDeb | sudo bash

    Configure the Azure NSG Knoc with credential and target details, and enable No cache to prevent Azure CLI tokens from persisting on the Agent.
    📍In the Knocknoc Admin panel, go to Firewalls › Active › Azure NSG. Enter: Client-ID (service principal Application client ID), Client Secret, Tenant ID, Resource Group, NSG Name, Port, Protocol, and Direction (Inbound or Outbound). Enable No cache to clear tokens from /opt/knocknoc-agent/var/ after each execution.
    • Adds Azure NSG integration to dynamically grant and revoke IP-based access rules in Azure Network Security Groups, configured via Firewalls -> Active -> Azure NSG in the Knocknoc Admin panel.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
    • Supports a No cache option that removes Azure CLI session tokens and secrets from the Agent's /opt/knocknoc-agent/var/ directory after each grant/revoke, trading performance for reduced credential exposure on the Agent OS.
    • Creates NSG rules starting at priority 500 (up to Azure's built-in maximum of 4096), automatically working around pre-existing rules at or above priority 500.
    • Disables deduplication for the Azure NSG integration, meaning multiple users connecting from the same source IP each receive individual named rules for per-username attribution.

    4 details in Everything

27. docs update Sep 29, 2026 · issue 089

    Knocknoc adds Sophos UTM support via the knocker enable sophos command and a new Firewalls/Appliances Knoc configuration type.

    • Adds sophos as a supported device type in the knocker enable subcommand (/opt/knocknoc-agent/knocker/knocker enable sophos), with interactive prompts for device IP:port, API key, and network group reference.
    • New integrationIntroduces Sophos UTM as a selectable device type in the Knocknoc Firewalls / Appliances Knoc configuration, with fields for device URL, API key, network group reference, and an Insecure toggle for self-signed certificates.

    2 details in Everything

28. docs update Sep 29, 2026 · issue 089

    Knocknoc adds native integration with Sophos SFOS/XGS firewalls, managing IP host groups via least-privilege API access.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

    └──▷ HOW TO FIND IT
    Configure a Sophos SFOS/XGS firewall as a Knoc target so Knocknoc can gate access by dynamically managing membership of an IP Host Group.
    📍In the Knocknoc admin UI, go to Firewalls / Appliances Knoc configuration, set status to Active, select Sophos SFOS, enter the device URL (e.g. https://1.2.3.4:4444/), provide the API username and password, enter the IPv4 Group Name and IPv6 Group Name created on the Sophos device, then assign the Knoc to a user or group.
    Set up the least-privilege API user profile on Sophos SFOS/XGS so Knocknoc can manage host groups without broader firewall access.
    📍On the Sophos device: go to System -> Profiles -> Device access, click Add, name the profile (e.g. api-user-knocknoc), set all permissions to none, set System -> Objects to Read-write, save. Then go to Configure -> Authentication -> Users, click Add, set User-type to Administrator, select the api-user-knocknoc profile, set sign in restriction to Selected nodes with the Knocknoc Agent IP addresses, and save.
    • Adds Sophos SFOS/XGS as a supported firewall/appliance integration, allowing Knocknoc to dynamically add/remove IP addresses in a Sophos IP Host Group via the Sophos REST APIREST APIA web API design style where clients interact with resources over HTTP using standard methods like GET, POST, and DELETE, giving cyber tools a predictable, language-agnostic way to integrate with external services..⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
    • Supports separate IPv4 and IPv6IPv6The current version of the Internet Protocol, standardized by the IETF, using 128-bit addresses to replace the exhausted IPv4 space. Cyber tools target it because modern networks run dual-stack or IPv6-only. IP Host Groups on Sophos SFOS/XGS, configurable independently in the Knoc settings.
    • Supports Insecure HTTPSHTTPSHTTP carried over an encrypted TLS connection. It protects traffic in transit and lets a browser verify the server's certificate. mode for Sophos SFOS/XGS connections where the device certificate is not CA-signed, reducing MITM risk when the Knocknoc Agent is co-located on the same network segment.

    3 details in Everything

29. docs update Sep 29, 2026 · issue 089

    Knocknoc adds Cisco SFMC/Firepower support with active API orchestration (agent 1.6.0+, Object-edit-only perms) and passive EDLEDLExternal Dynamic List — a plain-text URL-hosted feed of IPs, domains, or URLs that a firewall or cyber tool polls on a schedule to keep block or allow lists current without manual updates./AllowList publishing.

    • New integrationAdds active Cisco SFMC/Firepower orchestration via the Cisco REST APIREST APIA web API design style where clients interact with resources over HTTP using standard methods like GET, POST, and DELETE, giving cyber tools a predictable, language-agnostic way to integrate with external services., dynamically inserting and removing user source IPs from a named Network Object Group — requires agent version 1.6.0+ and Object-edit-only permissions (no admin required).
    • Adds passive Cisco SFMC/Firepower integration via Knocknoc's Allowlist feature, publishing an External Dynamic List (EDL) that Cisco polls on a configurable refresh rate (minimum 30 seconds with Dynamic Attributes Connectors).
    • Supports Insecure mode for Cisco Firewall URI configuration when the firewall is not signed by a trusted CA.
    • Exposes an EDL secret (viewable via the EDL Security section of a Knoc) used as the Password field in Cisco FMC's External Attributes configuration, with apikey as the username.

    4 details in Everything

30. docs update Sep 29, 2026 · issue 089

    Knocknoc adds F5 Networks BigIP orchestration via iRulesiRulesA Tcl-based scripting language built into F5 BIG-IP load balancers that lets operators intercept and manipulate traffic flows with fine-grained, event-driven logic at the data plane. Data Group List and AFM, enabling JITJITA runtime compilation strategy where code is translated from an intermediate form to native machine instructions at execution time, giving tools the speed of compiled code without sacrificing dynamic flexibility. network access control⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

    └──▷ TRY IT
    Gate access to a sensitive path like /wp-admin on F5 BigIP — redirect unauthenticated users to Knocknoc and let them through only after SSOSSOSingle sign-on, using one identity provider to sign in to multiple applications. It reduces separate passwords and centralizes account and access management..
    copy

    $ when HTTP_REQUEST priority 1 {
      # Gate: redirect unauthorized /wp-admin hits
      if { [string tolower [HTTP::path]] starts_with "/wp-admin"
        && not [class match [IP::client_addr] equals knocknoc-jit-vip45] } {
        HTTP::redirect "https://yourknocknocserver.example.com/?referrer=[URI::encode "https://[HTTP::host][HTTP::uri]"]"
        return
      }
    }

    Create an F5 BigIP Knoc in the Knocknoc admin console to begin orchestrating JIT IP access via an iRules Data Group List.
    📍1. Log in to Knocknoc as an Admin (/admin) 2. Select Knoc › Create new 3. Select Firewalls/Appliances 4. Select Active, then F5 Big-IP 5. Provide the URL to the F5 management interface 6. Provide the Username and Password of the iRule Manager role user (eg: knocknoc-api-user) 7. Enter a description and other Knoc components 8. Link or create a user or SAML group
    • Adds F5 BigIP iRule orchestration type in the Knocknoc admin UI under Knocs > Firewalls/Appliances > F5 Big-IP, enabling JIT IP allowlisting via iRules Data Group List.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
    • Supports layer-7 path-based gating via F5 iRules (e.g. /wp-admin), redirecting unauthenticated users to Knocknoc and auto-forwarding them after SSO authentication.
    • Uses a batching-window approach to coalesce Data Group List updates into a single F5 API call per window; default window is 1 second, configurable in the Agent configuration file.
    • Requires server version 26.06.2+ and agent version 26.06.2+ for F5 BigIP orchestration.

    4 details in Everything

31. docs update Sep 29, 2026 · issue 089

    Knocknoc adds Check Point gateway integration in Active (API push) and Passive (EDLEDLExternal Dynamic List — a plain-text URL-hosted feed of IPs, domains, or URLs that a firewall or cyber tool polls on a schedule to keep block or allow lists current without manual updates./Network Feed poll) modes⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

    └──▷ TRY IT
    Automate Check Point Identity Web API setup on R82.10 via mgmt_cli — useful in CI pipelines or when SmartConsole access is unavailable.
    copy

    $ mgmt_cli -r true add host name "knocknoc-agent" ip-address "<agent-source-ip>"
    mgmt_cli -r true set-simple-gateway name <gateway-object-name> \
      identity-awareness-settings.identity-web-api true \
      identity-awareness-settings.identity-web-api-settings.authorized-clients.1.client "knocknoc-agent" \
      identity-awareness-settings.identity-web-api-settings.authorized-clients.1.client-secret "<shared secret>"
    mgmt_cli -r true set-simple-gateway name <gateway-object-name> \
      identity-awareness-settings.identity-web-api-settings.client-access-permissions.accessibility.allow-access-from "ALL_INTERFACES"
    mgmt_cli -r true add access-role name knocknoc-users networks.1 any users.1 any-user machines.1 any-machine
    mgmt_cli -r true add access-rule layer "Network" position top name "Knocknoc - allow access role" \
      source.1 knocknoc-users destination.1 <destination-object> service.1 <service-object> action accept track.type Log
    mgmt_cli -r true publish
    mgmt_cli -r true install-policy policy-package "Standard" targets.1 <gateway-object-name>

    Create a Passive (EDL) Knoc with secret-based auth so a Check Point Network Feed object can poll the live allow-list — no agent deployment needed.
    📍1. In Knocknoc, create a new Knoc and choose the EDL (Passive) type. 2. Under EDL Security, select Secret-based. 3. Save the Knoc and copy its EDL URL (form: https://<knocknoc-server>/api/v1/allowlists/<acl-id>/<token>.txt). 4. In SmartConsole, create a Network Feed object pointing to that URL; set credentials to username apiuser and the generated secret as the password. 5. Set the poll interval (minimum 1 minute; default 60 minutes) to no longer than your shortest expected grant lifetime. 6. Reference the Network Feed object in your firewall rule Source field and install policy.
    Verify an Active Check Point Knoc can reach the gateway and authenticate before going live — catches misconfigured secrets or source-IP allow-list mismatches early.
    📍1. In the Knocknoc UI, open the Knoc configured under Firewalls/Appliances › Active › Check Point. 2. Set Gateway Hostname to the gateway or cluster VIP (e.g. gw.example.com or gw.example.com:4434 for non-standard ports). 3. Set Shared Secret to the Client Secret created in the Identity Web API client, and Access Role to the exact case-sensitive role name (e.g. knocknoc-users). 4. Click Validate connection — confirm all four probes (Config sanity, Reachable, Auth, Access Role) pass or are reported as skip (Access Role is always skip by design).
    • Adds Active (API) mode for Check Point gateways: the Knocknoc agent pushes authenticated user IPs to the gateway via the Identity Web API, assigning a pre-existing Access Role, with grant and revoke latency of ~1 second.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
    • Adds mgmt_cli alternative path for Check Point setup, using identity-awareness-settings.identity-web-api (boolean) and identity-awareness-settings.identity-web-api-settings.authorized-clients.N.{client, client-secret} schema on R82.10.
    • Adds identity-awareness-settings.identity-web-api-settings.client-access-permissions.accessibility.allow-access-from setting to control which interfaces the Web API listener accepts connections on (default INTERNAL_INTERFACES).
    • Adds Passive (Network Feed / EDL) mode for Check Point gateways: Knocknoc publishes authenticated IPs as an External Dynamic List (EDL) at https://<knocknoc-server>/api/v1/allowlists/<acl-id>/<token>.txt, polled by a Check Point Network Feed object; no agent required.
    • Adds EDL Security option to Passive Knoc configuration, supporting Secret-based (HTTP Basic Auth with username apiuser) and IP-based (source-IP restriction, no credentials) authentication modes for gateway EDL polling.

    +4 more show less

    • Supports Check Point gateways R80.40 or later for Passive mode (Network Feed objects) and R80.10 or later for Active mode, verified against R81.10–R82.10.
    • Adds Validate connection probe in the Knoc UI that runs four sequential checks — config sanity, reachability, auth (shared secret + source-IP allow-list), and Access Role — stopping at first failure.
    • Adds Firewalls/Appliances Knoc type with an Active tab and Check Point vendor option, configurable with Gateway Hostname, Insecure, Shared Secret, and Access Role fields.
    • Supports HA cluster targeting by pointing the Gateway Hostname field at the cluster VIPVIPA Virtual IP address — a single IP shared across multiple hosts or services, commonly used for load balancing or failover so traffic can be rerouted without changing the client-facing address. (format host:port).

    9 details in Everything

32. docs update Sep 29, 2026 · issue 089

    Knocknoc adds SonicWall orchestration support via Active API, Passive DEAG polling, and Passive+ hybrid modes⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

    └──▷ HOW TO FIND IT
    Set up Passive DEAG polling so your SonicWall automatically pulls the current Knocknoc authenticated-user IP list every 5 minutes without deploying an orchestration agent.
    📍In Knocknoc: Knocs › Create new › Firewalls › Passive › select IP-based for EDL Security › enter source IP addresses › Save › copy the Allowlist URI. In SonicWall: Object › Match Objects › Dynamic Group › +Add › Type: Address Group › Zone: WAN › enable Enable Periodic Download (5 min) › HTTPS › paste Allowlist URI › Save › click Download to verify connectivity.
    Enable Active SonicWall orchestration so Knocknoc inserts and removes user IPs from a firewall address-group in near-real-time on login/logout events.
    📍In SonicWall: Object › Match Objects › Addresses › +Add › name knocknoc_baseline4, Zone WAN, Type Host, IP 127.0.0.1 › Save. Object › Address Groups › +Add › name e.g. kk_rdp › add knocknoc_baseline4 baseline entry › Save. Device › Settings › Administration › SonicOS API › enable RFC-2617 HTTP Basic Access authentication › Accept. In Knocknoc: Firewalls / Appliances › Knoc configuration › select Active › follow prompts to enter SonicWall API credentials and assign orchestration agent.
    • Adds Active SonicWall orchestration via the SonicWall API, inserting and removing IP addresses from address-groups in near-real-time as users log in and out of Knocknoc — requires Agent version 25.12+.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
    • Adds Passive SonicWall integration using SonicWall Dynamic External Address Groups (DEAGs), polling the Knocknoc Allowlist URI every 5 minutes to maintain a live authenticated-user IP list.
    • Adds Passive+ mode combining DEAG polling with an active API call to trigger an immediate DEAG refresh, reducing the effective polling window from 5 minutes to near-instantaneous for large IP address lists.
    • Supports non-admin API credentials for SonicWall orchestration, requiring Members go straight to the management UI on web login enabled on the SonicWall Administrators group and Multiple Admin Roles enabled under SonicWall --> Device --> Settings --> Administration --> Login / Multiple Administrators.

    4 details in Everything

33. docs update Sep 29, 2026 · issue 089

    Knocknoc adds Palo Alto/Panorama integration with three modes: Active (real-time DAGDAGA directed acyclic graph — a data structure of nodes connected by one-way edges with no cycles — used by tools to model task pipelines or data flows where execution order and dependencies must be enforced without loops.), Passive+ (EDLEDLExternal Dynamic List — a plain-text URL-hosted feed of IPs, domains, or URLs that a firewall or cyber tool polls on a schedule to keep block or allow lists current without manual updates. + refresh signal), and Passive (EDL polling).⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

    └──▷ TRY IT
    Generate a PAN-OS API key from the Orchestration Agent when setting up Active or Passive+ mode for the first time.
    copy

    $ /opt/knocknoc-agent/knocker/knocker enable panos

    Tune EDL refresh retries in Passive+ mode when firewalls are slow to consume EDL updates — increase retries and shorten wait time to match your environment.
    ini copy

    PanosRetry = 16
    PanosWait = 2

    Use the PAN-OS keygen API directly to generate an API key when the Orchestration Agent is not yet installed.
    copy

    $ curl -H "Content-Type: application/x-www-form-urlencoded" -X POST \
      "https://<firewall-or-panorama>/api/?type=keygen" \
      -d 'user=<user>&password=<password>'

    • Adds knocker enable panos subcommand on the Orchestration Agent to generate a base64-encoded PAN-OS API key for Active and Passive+ integration modes.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
    • Adds PanosRetry and PanosWait agent config keys to tune EDL refresh retry behavior in Passive+ mode (defaults: 16 retries, 2-second wait).
    • Adds Active integration mode for Palo Alto/Panorama: real-time IP tagging via Dynamic Address Groups (DAG) with no firewall commit required, supporting VSys, Device Group, Tag Name, Serial Numbers, and optional Map User (User-ID) settings in the Knoc Application.
    • Adds Passive+ integration mode for Palo Alto/Panorama: combines EDL polling with an active refresh signal to reduce access latency from ~5 minutes to ~2 seconds, configurable via EDL Name, API Key, VSys, Serial Numbers, and optional Map User fields.
    • Adds Passive integration mode for Palo Alto/Panorama: agentless EDL polling at the firewall's standard ~5-minute interval, suitable for data-diode environments.

    +3 more show less

    • Adds HA Failover configuration for direct-to-firewall Active deployments, with Secondary Firewall URL, Secondary API Key, and Skip TLS verification fields; agent checks primary HA state before each grant/revoke/extend operation and falls back to the secondary automatically.
    • Adds EDL secret and IP allowlisting configuration in the Knocknoc admin portal to restrict which source addresses can retrieve the EDL for Passive+ and Passive modes.
    • Adds Published and Read status indicators in Knocknoc to track EDL delivery: Published means the IP has been sent to the EDL; Read means the firewall has retrieved and accepted the entry.

    8 details in Everything

34. docs update Sep 29, 2026 · issue 089

    Knocknoc adds Fortinet FortiGate/FortiManager integration with Active, Passive+, and Trusted-Hosts orchestration modes⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

    └──▷ HOW TO FIND IT
    Configure a Passive+ Knoc for a FortiManager-managed environment, scoping push to specific FortiGates in a named ADOM for near real-time IP allowlist updates.
    📍In the Knocknoc admin UI, go to Firewalls / Appliances › Create Knoc: Application Type: Passive+ Vendor: Fortinet I am using a FortiManager: Checked FortiManager URL: https://fmg.example.com Authorization token: <api-key-from-step-3> ADOM: prod-adom External Connector Name: knocknoc-allowlist Device Targets: FGT1234567890, FGT0987654321
    Configure a Passive+ Knoc for a standalone FortiGate (no FortiManager), pointing the FortiGate External Feed at the Knocknoc-provided EDLEDLExternal Dynamic List — a plain-text URL-hosted feed of IPs, domains, or URLs that a firewall or cyber tool polls on a schedule to keep block or allow lists current without manual updates. URL with HTTP basic auth.
    📍In the Knocknoc admin UI, go to Firewalls / Appliances › Create Knoc: Application Type: Passive+ Vendor: Fortinet I am using a FortiManager: Unchecked FortiGate URL: https://fw.example.com Authorization token: <api-key> External Connector Name: knocknoc-allowlist Then on FortiGate: Security Fabric › External Connectors › Create New › IP Address › External Feed Name: knocknoc-allowlist Resource URI: <Knocknoc-provided EDL URL> Username: <EDL username> Password (EDL Secret): <EDL secret>
    Set up an Active mode Knoc for direct FortiGate orchestration with a custom address object prefix and a specific VDOM.
    📍In the Knocknoc admin UI, go to Firewalls / Appliances › Create Knoc: Application Type: Active FortiGate URL: https://fw.example.com Insecure: Unchecked Authorization token: <api-key> Address group: knocknoc-allowed Prefix: kk_ VDOM: dmz-vdom
    • Adds Active mode orchestration for Fortinet FortiGate firewalls, where a Knocknoc Orchestration Agent directly manages IP address lists via the FortiGate REST APIREST APIA web API design style where clients interact with resources over HTTP using standard methods like GET, POST, and DELETE, giving cyber tools a predictable, language-agnostic way to integrate with external services., enabling near real-time access propagation on user login/logout.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
    • Adds Passive+ mode for Fortinet environments, combining an EDL (External Dynamic List) allowlist with real-time dynamic IP entry push via FortiManager or FortiGate, achieving 1–2 second propagation without requiring the agent to reach every individual FortiGate.
    • Supports Fortinet FortiManager as an orchestration target in Passive+ mode, with ADOM and Device Targets (serial numbers) fields to scope push operations across multi-FortiGate environments.
    • Adds a Trusted-Hosts mode as a third integration option, restricting FortiGate admin access by dynamically updating trusted host IP restrictions tied to user sessions.
    • Adds External Connector Name as a required Knoc configuration field (must exactly match the External Feed name configured on FortiGates) and Authorization token for API key authentication in both Active and Passive+ modes.

    +3 more show less

    • Adds Insecure toggle in Knoc configuration to allow connections to FortiGate/FortiManager devices whose TLS/SSLSSLA cryptographic protocol for encrypting network connections, now deprecated in favor of TLS but whose name persists colloquially. Cyber tools reference it when handling HTTPS or other encrypted-channel inspection and termination. certificates are not signed by a trusted CA.
    • Adds address object Prefix field (default: kk_) and optional VDOM field to Active mode Knoc configuration for FortiGate direct orchestration.
    • Supports Fortinet Passive+ mode with HTTP basic authentication (Username and Password (EDL Secret)) on the EDL Resource URI provided by Knocknoc, with a configurable polling interval for fallback reconciliation.

    8 details in Everything

35. docs update Sep 29, 2026 · issue 089

    Knocknoc adds a local PF (Packet Filter) backend so agents dynamically manage PF tables via pfctlpfctlThe command-line utility for managing OpenBSD's pf packet filter, used on BSD systems to load rulesets, inspect state tables, and control traffic; cyber tools use it to programmatically manipulate firewall rules at runtime. on BSD, macOS, and Solaris hosts.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

    └──▷ USE IT
    Declare a persistent PF table and a pass/block rule pair in pf.conf to gate SSH access to only Knocknoc-granted users.
    /etc/pf.conf copy

    table <knoc_ssh_allowed> persist
    pass in quick proto tcp from <knoc_ssh_allowed> to port 22
    block drop in quick proto tcp to port 22

    Validate and reload pf.conf after adding the Knocknoc table and rules, then verify a granted user's IP appears in the table.
    copy

    $ pfctl -nf /etc/pf.conf && pfctl -f /etc/pf.conf && pfctl -e
    pfctl -t knoc_ssh_allowed -T show

    Wire up the PF backend in the Knocknoc UI to point the agent at your declared table.
    📍1. In the Knocknoc admin console, create a new Local firewall Knoc. 2. Select the agent running on the PF host. 3. For backend type, choose PF (BSD/macOS/Solaris). 4. In the ACL step, select or type the table name (e.g., knoc_ssh_allowed) — it must match a persist table in pf.conf. 5. Assign users or groups, then test by logging in and running pfctl -t knoc_ssh_allowed -T show on the host.
    • Adds support for PF (BSD/macOS/Solaris) as a local firewall backend type, where the Knocknoc agent manages a named persist PF table in pf.conf via pfctl — adding and removing user IPs as grants are issued or expire.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
    • Adds pfctl -t <table> -T show as the verification command to confirm the agent is correctly populating the PF table with granted user IPs.
    • Supports creating a Local firewall Knoc in the Knocknoc wizard, where the ACLACLAn access control list, a set of rules allowing or denying operations for particular users, services or network addresses. It decides who can use a resource. is configured by selecting or typing the PF table name (e.g., knoc_ssh_allowed) the agent writes to.

    3 details in Everything

36. docs update Sep 29, 2026 · issue 089

    Knocknoc now orchestrates Windows Firewall for just-in-time RDPRDPA Microsoft protocol that lets a user view and control a remote Windows desktop over a network, giving cyber tools a standard channel to audit, attack-simulate, or monitor Windows systems remotely. and other port access via the Knocknoc Agent.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

    └──▷ HOW TO FIND IT
    Protect RDP on a Windows Server by linking its built-in firewall rule to Knocknoc so only authenticated users' IPs are allowed through.
    📍In the admin portal: Settings › Knocs › New Knoc › Backend type: Windows host Firewall › Select the agent running on the target server › Choose firewall rule Remote Desktop - User Mode (TCP-In) 3389/TCP › Save.
    Create a custom firewall rule that Knocknoc auto-discovers and controls, without a port match, by using the required name prefix.
    📍In Windows Firewall, create a new inbound rule named kk_MyService on your desired port. Within one minute, it will appear in the Knocknoc portal Knoc rule drop-down for assignment — no agent restart needed.
    • Adds support for a Windows host Firewall backend type in the admin portal, enabling Knocknoc to dynamically control named Windows Firewall rules (e.g.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠ Remote Desktop - User Mode (TCP-In) 3389/TCP) per authenticated user.
    • Firewall rules prefixed with kn_ or kk_ are automatically discovered and surfaced in the portal drop-down without restarting the agent, updating within one minute of rule additions or removals.
    • Supports just-in-time RDP access control on Windows Server 2019 and Windows 10/11 Pro/Enterprise using Knocknoc Agent version 25.12, hiding ports like RDP from unauthenticated sources with a default-deny stance.

    3 details in Everything

37. docs update Sep 29, 2026 · issue 089

    Knocknoc adds IPSetIPSetA Linux kernel subsystem for storing sets of IP addresses, networks, or ports in hash or bitmap structures so that firewall rules can match millions of entries in constant time instead of scanning a list. (Linux NetfilterNetfilterA Linux kernel framework for packet filtering, NAT, and connection tracking, maintained by the Netfilter project. Cyber tools use it to inspect or manipulate network traffic without writing custom kernel modules./IPTablesIPTablesA Linux kernel firewall framework that lets administrators define rules for filtering, routing, and modifying network packets. Cyber tools use it to block traffic, redirect connections, or inspect packets at the OS level.) integration for dynamic IP allow-listing on Linux hosts⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

    └──▷ USE IT
    Restrict which IPSets the agent creates on boot — add or remove service names to control the dynamic allow-list surfaces available to Knocknoc Knocs
    /opt/knocknoc-agent/etc/ipset.list copy

    # /opt/knocknoc-agent/etc/ipset.list
    knoc_ssh
    knoc_http
    knoc_https
    ssh_allowed

    Protect an SSH port so only IPs Knocknoc has granted access appear in knoc_ssh and all others are dropped
    copy

    $ iptables -A INPUT -i eth0 -p tcp --dport 22 -m set --match-set knoc_ssh src -j ACCEPT
    iptables -A INPUT -i eth0 -p tcp --dport 22 -j DROP

    Ensure the create-ipsets service runs on every boot so IPSets are ready before any firewall rules reference them
    copy

    $ systemctl enable create-ipsets
    systemctl start create-ipsets
    ipset -L

    • Adds /opt/knocknoc-agent/etc/ipset.list config file to define IPSet names created on agent startup, including defaults knoc_ssh, knoc_http, and knoc_https⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
    • Adds create-ipsets systemd service (managed via systemctl restart create-ipsets / systemctl enable create-ipsets) to ensure IPSets are present at boot on Linux agents
    • Supports a custom backend script path on the Knocknoc server to invoke a user-supplied wrapper (e.g. /usr/local/bin/ipset_block.sh) for add/del/flush operations, with automatic _v4 / _v6 IPSet name suffixing for dual-stack support
    • Introduces a knocknoc_blocked / knocknoc_blocked_v6 blocking IPSet pattern in the reference wrapper script, allowing active termination of pre-established TCPTCPA network protocol that delivers a reliable, ordered stream of bytes between two endpoints. It detects lost data and retransmits it. connections when access is revoked
    • Supports Linux / Host firewall Knoc type in the Knocknoc Server UI, enabling per-agent IPSet-based access grants scoped to selected users and groups

    +1 more show less

    • Supports MFAMFAMulti-factor authentication, requiring proof from different categories, such as a password and a hardware key, to sign in. It reduces reliance on a password alone./TOTPTOTPA one-time password algorithm (RFC 6238) that generates short-lived codes from a shared secret and the current time, giving cyber tools phishing-resistant second-factor authentication without a server round-trip.-gated SSH access by combining Knocknoc's built-in TOTP functionality or an external IdPIdPA service that authenticates users and supplies identity information to other applications. It is the sign-in authority behind many single sign-on systems. with IPSet-controlled iptables rules

    6 details in Everything

38. docs update Sep 29, 2026 · issue 089

    Knocknoc adds a shared Integrations hub with credential rotation, activity visibility, and duplicate-connection merging.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

    └──▷ HOW TO FIND IT
    Merge duplicated per-Knoc firewall credentials into one shared integration so future credential rotations only need a single update.
    📍In the console, go to Admin › Integrations › Find duplicates. Update any listed agents first, then select the matching connections identified and choose Merge. All Knoc assignments are preserved automatically.
    • Adds Admin > Integrations as a central hub to define firewall, cloud-platform, reverse-proxy, and on-host enforcement connections once and share them across multiple Knocs.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
    • Supports firewall integrations for FortiGate, PAN-OS, and SonicWall; cloud integrations for AWS, Azure, and GCP; reverse-proxy integrations for nginx and HAProxy; and on-host enforcement via ipset, nftables, pf, Windows Firewall, nginx, HAProxy, or a custom script.
    • Adds per-integration activity view showing which Knocs use the integration, who has been connecting, grant volumes, average wait times, and failures.
    • Adds Admin > Integrations > Find duplicates to identify agents sharing the same connection, merge them into a single shared integration, and preserve all existing Knoc assignments.

    4 details in Everything

39. docs update Sep 29, 2026 · issue 089

    Knocknoc publishes integration docs covering 35+ enforcement points: firewalls, cloud platforms, proxies, and identity providersidentity providersA service that authenticates users and supplies identity information to other applications. It is the sign-in authority behind many single sign-on systems..⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

    • Adds documented integration with IPSetIPSetA Linux kernel subsystem for storing sets of IP addresses, networks, or ports in hash or bitmap structures so that firewall rules can match millions of entries in constant time instead of scanning a list. (Linux Netfilter/IPTablesIPTablesA Linux kernel firewall framework that lets administrators define rules for filtering, routing, and modifying network packets. Cyber tools use it to block traffic, redirect connections, or inspect packets at the OS level.) for dynamic on-host network access control via IPSets.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
    • Adds documented integration with Windows Firewall for dynamic on-host network access control.
    • Adds documented integration with PF (Packet Filter) for dynamic network access control on hosts running PF.
    • Adds documented integration with Fortinet FortiGate firewalls (directly or via FortiManager).
    • Adds documented integration with Palo Alto firewalls and the Panorama management system.

    +33 more show less

    • Adds documented integration with SonicWall via Active (API call from Orchestration Agent), and additional orchestration modes.
    • Adds documented integration with Check Point gateways in Active and passive modes.
    • Adds documented integration with F5 Networks BigIP devices, including via iRulesiRulesA Tcl-based scripting language built into F5 BIG-IP load balancers that lets operators intercept and manipulate traffic flows with fine-grained, event-driven logic at the data plane..
    • Adds documented integration with Cisco Secure Firewall Management Console (SFMC/Firepower).
    • Adds documented integration with Sophos SFOS/XGS devices for advanced firewall and UTM capabilities.
    • Adds documented integration with Sophos UTM devices (noted as a legacy series).
    • Adds documented integration with Microsoft Azure NSG for dynamic management of IPs within Azure Network Security Groups.
    • Adds documented integration with Microsoft Entra IDEntra IDMicrosoft's cloud-based identity and access management service, formerly Azure Active Directory, used by cyber tools to authenticate users and enforce access policies in Microsoft 365 and Azure environments. (formerly Azure AD) Named Locations for dynamic IP control over protected apps.
    • Adds documented integration with AWS EC2EC2Amazon's cloud virtual-machine service, letting tools run on-demand servers without managing physical hardware. Security Groups for network-level firewall orchestration.
    • Adds documented integration with AWS WAFWAFA reverse proxy that inspects HTTP/HTTPS traffic and blocks requests matching known attack patterns such as SQL injection or XSS, sitting between clients and a web application to filter malicious input before it reaches the server. Ipset for dynamic IP allowlisting via AWS WAF.
    • Adds documented integration with Google Cloud Platform VPCVPCA logically isolated virtual network inside a public cloud provider's infrastructure, letting tools deploy resources with private addressing, controlled routing, and firewall rules without managing physical hardware. Firewall rules for dynamic network access control.
    • Adds documented integration with Cloudflare IP lists for dynamic inbound IP allowlisting.
    • Adds documented integration with DigitalOcean Cloud Firewalls for dynamic IP allowlisting.
    • Adds documented integration with Okta for dynamically controlling which IPs are allowed to access Okta-protected apps.
    • Adds documented Knocknoc Reverse Proxy integration for enforcement via the Orchestration Agent deployed alongside managed infrastructure.
    • Adds documented integration with HAProxy as a reverse proxy for IP-based allowlisting.
    • Adds documented HAProxy + KAT integration for enforcement beyond IP-based allowlisting (e.g. airport lounge scenarios).
    • Adds documented integration with Nginx for driving allow/deny lists directly from the agent without a wrapper script.
    • Adds documented integration with Apache 2.4+ for ACLACLAn access control list, a set of rules allowing or denying operations for particular users, services or network addresses. It decides who can use a resource. management via the Knocknoc agent.
    • Adds documented Allowlist (EDLs) backend that exposes active IP address grants via the Knocknoc server for consumption by firewalls.
    • Adds documented example for using IPsets with UFWUFWA command-line frontend for Linux's iptables firewall, maintained by Canonical, that lets tools configure host-based packet filtering rules without writing raw iptables syntax. (Uncomplicated Firewall).
    • Adds documented example for using IPsets with Shorewall.
    • Adds documented integration with firewalld (IPsets with firewalld) for RHELRHELRed Hat Enterprise Linux, a commercially supported Linux distribution maintained by Red Hat, chosen by cyber tools for its long support lifecycle, certified hardware compatibility, and enterprise deployment prevalence.-family and other firewalld-based hosts.
    • Adds documented integration with OPNsense via a pre-existing firewall alias.
    • Adds documented integration with pfSense for dynamic network access control.
    • Adds documented integration with MikroTik RouterOS for dynamic network access control.
    • Adds documented integration with Proxmox VE using the built-in Proxmox firewall.
    • Adds documented integration with Juniper SRX in Passive, Active, or combined modes.
    • Adds documented integration with Kemp LoadMaster for dynamic network access control.
    • Adds documented integration with Cisco Meraki for dynamic source IP allowlisting.
    • Adds documented Custom Script integration type, allowing the agent to execute arbitrary scripts directly on the Agent machine.
    • Adds documented integration with nftables for dynamic network access control on Linux hosts.
    • Adds documented integration with Fastly for dynamic source IP control at the edge.

    38 details in Everything

40. docs update Sep 29, 2026 · issue 089

    Knocknoc adds Trust Engine, PostgreSQL HAPostgreSQL HAA deployment pattern for PostgreSQL databases that keeps the service available through automatic failover when the primary node fails, letting cyber tools maintain persistent storage without manual intervention during outages., Blocked Address Lists, and SIEMSIEMSecurity information and event management, collecting logs from many systems and correlating events to find suspicious activity. Analysts use it to investigate alerts and incidents./GELFGELFA structured log format created by Graylog that carries JSON payloads over UDP, TCP, or HTTP, giving cyber tools a compact, schema-aware alternative to syslog for shipping log data to centralised collectors. log integration to its admin guide.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

    • Adds GELF log destination support for SIEM event delivery from the Trust Engine.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
    • Adds the Trust Engine, which sets per-Knoc conditions on network access and raises SIEM events.
    • Adds Blocked Address Lists as a premium licensed add-on to deny access at the Knoc level.
    • Adds PostgreSQL replication and failover support, enabling an active/standby database pair for the Knocknoc server.

    4 details in Everything

41. docs update Sep 22, 2026 · issue 082

    Knocknoc adds Cisco Meraki integration for dynamic source-IP access control⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

    • Integrates with Cisco Meraki to dynamically control which source IPs are allowed through network access policies.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

    1 detail in Everything

42. changelog Sep 2, 2026 · issue 062

    Knocknoc 26.08 adds Fastly ACLACLAn access control list, a set of rules allowing or denying operations for particular users, services or network addresses. It decides who can use a resource. integration and native nftablesnftablesA Linux kernel packet-filtering framework maintained by Netfilter that replaces iptables, offering a unified ruleset for firewalling and NAT that cyber tools use for efficient, scriptable traffic control. enforcement.

    • Adds Fastly ACL integration for network access control enforcement.

    1 detail in Everything

43. docs update Sep 2, 2026 · issue 062

    Knocknoc adds backend integrations for Kemp LoadMaster, nftablesnftablesA Linux kernel packet-filtering framework maintained by Netfilter that replaces iptables, offering a unified ruleset for firewalling and NAT that cyber tools use for efficient, scriptable traffic control., and Fastly for dynamic network access control.

    • New Kemp LoadMaster backend integration enables Knocknoc to dynamically control network access via the LoadMaster.
    • New Fastly backend integration enables Knocknoc to control which source IPs are permitted through a Fastly edge service.

    2 details in Everything

44. docs update Sep 2, 2026 · issue 062

    Knocknoc: New Kemp LoadMaster integration dynamically controls network access through the load balancer based on Knocknoc authentication events.

    • New nftables integration dynamically controls network access on Linux hosts, adding and removing source IPs via nftables rules when users authenticate.
    • New Fastly integration controls which source IPs are permitted through a Fastly edge service, enabling JITJITA runtime compilation strategy where code is translated from an intermediate form to native machine instructions at execution time, giving tools the speed of compiled code without sacrificing dynamic flexibility. network access at the CDNCDNA content delivery network, servers distributed across locations that cache and serve content near readers. It can reduce loading time and traffic to the original server. layer.

    2 details in Everything

45. docs update Sep 1, 2026 · issue 061

    Knocknoc adds nftablesnftablesA Linux kernel packet-filtering framework maintained by Netfilter that replaces iptables, offering a unified ruleset for firewalling and NAT that cyber tools use for efficient, scriptable traffic control. and Fastly as supported backends for dynamic network access control.

    • Adds nftables integration to dynamically control network access on a Linux host.
    • Adds Fastly integration to control which source IPs an edge service allows through.

    2 details in Everything

46. docs update Sep 1, 2026 · issue 061
    • New integration with nftables to dynamically control network access on a Linux host based on authenticated users.
47. v26.08 seen Sep 1, 2026 · issue 061

    Knocknoc v26.08 adds Fastly ACLACLAn access control list, a set of rules allowing or denying operations for particular users, services or network addresses. It decides who can use a resource. and native nftablesnftablesA Linux kernel packet-filtering framework maintained by Netfilter that replaces iptables, offering a unified ruleset for firewalling and NAT that cyber tools use for efficient, scriptable traffic control. enforcement, plus improved Palo Alto visibility and admin diagnostics.

    • Adds Fastly ACL enforcement as a new supported enforcement target.
    • Adds native nftables enforcement support.
    • Improves Palo Alto visibility for administrators.
    • Improves operational diagnostics tooling for administrators.

    4 details in Everything

48. docs update seen Aug 4, 2026 · issue 035

    Knocknoc adds Allowlist/EDLEDLExternal Dynamic List — a plain-text URL-hosted feed of IPs, domains, or URLs that a firewall or cyber tool polls on a schedule to keep block or allow lists current without manual updates. backend to publish active IP grants via server API for agentless firewall integration

    • New Allowlist (EDL) backend publishes active IP address grants via the Knocknoc server API, enabling firewalls and appliances to poll for dynamic IP lists without deploying a Knocknoc agent — compatible with Palo Alto External Dynamic Lists, Fortinet External Connectors, Juniper SRX, SonicWall DEAG, F5 BigIP IP Intelligence, Cisco Firepower Dynamic Attributes Connector, PfSense, and others.
    • Supports two EDL modes: Passive (firewall polls on its own schedule) and Passive+ (Knocknoc also pushes an API call to the firewall requesting an immediate EDL refresh, reducing grant propagation delay).
    • EDL access security supports two protection methods: Secret based (requires a secret/key in the authentication header plus IP access control) and IP based (restricts EDL access by source IP only).
    • Per-Knoc EDL URL and secret are configurable under Knocs > *Your Knoc* > EDL Security, including optional irreversible secret encryption via the yellow lock symbol.
    • User-facing grant status progresses from Published (IP written to EDL, awaiting firewall poll) to Read (firewall has consumed the EDL and access is established), giving operators visibility into the EDL consumption lifecycle.

    5 details in Everything