Scanner ACL
The Scanner ACL page exports a merged list of all registered scanner IP addresses, subnets, and ASNs in formats suitable for firewalls and WAFs. Use these exports to configure network-level access control rules that ensure only registered scanners can reach your target networks. Scanner traffic reaches the manager on two ports: :443 (bootstrap — provisioning, enrollment, the install script — and the runtime path for legacy API-key scanners while the fleet policy is migration) and :8443 (SCANNER_MTLS_PORT), the mandatory-mTLS runtime ingress published by the cutover. Allow both from every scanner host; this page's exports cover the SCANNER side (source IPs) only.
Inputs
| Name | Description | Allowed values | Default |
|---|---|---|---|
Export Format | Output format for the ACL | JSON, nginx, iptables, Cloudflare | JSON |
Fields & columns
| Name | Description |
|---|---|
Entries | Number of ACL entries (IPs, subnets, ASNs) in the export |
Generated | Timestamp when the ACL was generated |
How to
Generate and apply firewall rules
- Navigate to Admin > Scanner ACL.
- Select the output format matching your infrastructure (iptables, nginx, Cloudflare, or JSON).
- Review the generated allow rules in the preview area.
- Click Copy to clipboard or Download to save the file.
- Apply the rules to your firewall or WAF configuration.
Gotchas
- Bootstrap paths on :443 — /scanner/register (provisioning, authenticated by a one-time provisioning token), /scanner/enroll (authenticated by a one-time enrollment token plus the scanner's current API key) and /scanner/install.sh (static, SHA-256-verified) — are reached BEFORE any IP binding exists, so your allowlist must admit new hosts to them.
- Runtime traffic (heartbeats, jobs, results, certificate renewal and activation) from an mTLS scanner goes to :8443 and presents the scanner's client certificate; a legacy scanner keeps using :443 until it is enrolled and is rejected there once the policy is required (or once that scanner itself is Required).
- :8443 is served by a dedicated Traefik process (traefik-scanner-mtls) whose TLS options REQUIRE a client certificate — a plain HTTPS probe without one is refused by design; judge health from the Fleet mTLS Policy panel on Config > Scanners, not from curl.
- ACL entries are created when scanners register and bind to an IP address. No entries appear until scanners are provisioned.
- The iptables format generates a shell script that must be run with root privileges.
API calls (1)
| Method | Path | Description |
|---|---|---|
| GET | /api/admin/scanner-acl | Export scanner ACL (optional format query parameter: json, nginx, iptables, cloudflare) |
Related
- Scanners — Scanner registrations generate the ACL entries
- Scanner Groups — Grouped scanners share ACL entries
- Settings — The Public URL is the host scanners dial on both :443 and :8443