Scanner ACL
The Scanner ACL page exports a merged list of all registered scanner IP addresses, subnets, and ASNs in formats suitable for firewalls and WAFs. Use these exports to configure network-level access control rules that ensure only registered scanners can reach your target networks.
Inputs
| Name | Description | Allowed values | Default |
|---|---|---|---|
Export Format | Output format for the ACL | JSON, nginx, iptables, Cloudflare | JSON |
Fields & columns
| Name | Description |
|---|---|
Entries | Number of ACL entries (IPs, subnets, ASNs) in the export |
Generated | Timestamp when the ACL was generated |
How to
Generate and apply firewall rules
- Navigate to Admin > Scanner ACL.
- Select the output format matching your infrastructure (iptables, nginx, Cloudflare, or JSON).
- Review the generated allow rules in the preview area.
- Click Copy to clipboard or Download to save the file.
- Apply the rules to your firewall or WAF configuration.
Gotchas
- You must also add the provisioning endpoints to your allowlist: /scanner/register (authenticated by a one-time provisioning token, not IP binding) and /scanner/install.sh (the static, SHA-256-verified install script). New scanners reach both before any IP binding exists.
- ACL entries are created when scanners register and bind to an IP address. No entries appear until scanners are provisioned.
- The iptables format generates a shell script that must be run with root privileges.
API calls (1)
| Method | Path | Description |
|---|---|---|
| GET | /api/admin/scanner-acl | Export scanner ACL (optional format query parameter: json, nginx, iptables, cloudflare) |
Related
- Scanners — Scanner registrations generate the ACL entries
- Scanner Groups — Grouped scanners share ACL entries