Last Updated: 2025-03-27
Purpose
This document provides the required information needed for the communication with the HIAB and OUTSCAN through a firewall.
Introduction
The HIAB requires several firewall rules to allow for a smooth functionality in regard to updates and enrollments. Below is a list of rules that are used, however the Enrollment and Update rules are required and necessary. DNS host names are used for services where changes may occur without prior notification.
When using IP address only instead of hostnames, you need to add the scanning range to the firewall for HIAB to reach Outscan.
|
Service |
Destination |
Port |
Protocol |
Direction |
Description |
|
Remote Support |
osrss.outpost24.com |
22 |
TCP |
Outbound |
Remote Assistance |
|
Update |
repo.outpost24.com |
443 5000 |
TCP |
Outbound |
HIAB Updates |
|
Enrollment |
outscan.outpost24.com |
443 |
TCP |
Outbound |
Registering HIAB |
|
HIAB External/ OUTSCAN Internal |
outscan.outpost24.com |
443 |
TCP |
Outbound |
External Scanning from HIAB |
|
WEB |
<HIAB IP> |
443 |
TCP |
Inbound |
WEB GUI |
|
Scheduler to Scanner |
<HIAB IP> |
443 |
TCP |
Outbound |
Communication to scanner, depends on Polling enabled or not This is also necessary when enrolling a scanner through scheduler.
|
|
SMTP |
<SMTP Server> |
25 |
TCP |
Outbound |
For the HIAB to send emails |
|
DNS |
<DNS Server> |
53 |
TCP/UDP |
Outbound |
To resolve host names |
|
SSH |
<HIAB IP> |
22 |
TCP |
Inbound |
To allow remote access to the console |
|
Proxy |
<Proxy IP> |
<Proxy port> |
TCP |
Outbound |
To allow communications using a proxy server |
|
FTP |
<FTP IP> |
<FTP Port> |
TCP |
Outbound |
To perform backup and imports |
Outpost24 Network Scanning Range
Firewalls, IDSs and IPSs may interfere with the security scan if they have a reactive defense mechanism. In such case, we recommend to set up OUTSCAN (CIDR IP range 91.216.32.0/24, 80.254.228.0/22, 185.92.168.0/22, IPv6 range 2001:67c:1084::/48, 2a13:5240::/29) as a trusted range.
Clarification
The scanning occurs from within the below range:
-
For IPv4: 91.216.32.1 to 91.216.32.254, 80.254.228.0 to 80.254.231.255, 185.92.168.1 to 185.92.171.255.
-
For IPv6: 2001:67c:1084::0 to 2001:067c:1084:ffff:ffff:ffff:ffff:ffff, 2a13:5240::0 to 2a13:5247:ffff:ffff:ffff:ffff:ffff:ffff.
Related Articles
- Windows 10/Windows 2019 Server
- HIAB Updates
- General Information about SMB/WinRM Scanning
- Change Risk Levels
- Removing an Agent from Windows
- ServiceNow - Legacy
- Windows 8.1
- Netsec Filters
- Discovering the Agent in OUTSCAN
- Technical Specification
- Account Settings
- How to Test SMB Authentication
- Windows 2016 Server
- Identity Provider Settings
- HIAB Server Settings
- Installing a Linux Agent
- Okta Identity Provider Configuration
- Scanning-Less Scanning
- Check Connectivity to Agent Server
- Scan Scheduling Errors
- Overview
- Event Notification Module
- HIAB Maintenance Settings
- HIAB Deployment Guide
- Database Connector (HIAB only)
- Azure AD Identity Provider Configuration
- Add Comments
- Target Groups
- Checking if Agent is Running
- Core Installation
- Windows 2008 R2 Server
- Agent Installation Introduction
- Automatic Asset Joining With Netsec
- Manage Users
- Firewall Setup for Agents
- Scanning Range
- SNMP (HIAB only)
- ADFS Identity Provider Configuration
- Splunk
- Agent Call Home
- Advanced Report Filters
- Accept Risks
- SMB Authentication from OUTSCAN/HIAB
- Virtual HIAB Appliance
- Using the Agent Info Command
- Amazon
- User Roles
- Removing an Agent from Linux
- Retrieving the Agent UUID
- Atlassian Jira
- Understanding Scanner and Scheduler
- Finding the Agent Version
- Create and Edit Event Notifications
- Installing a macOS Agent
- Syslog (HIAB only)
- Setting Up an Agent Using System Proxy
- ServiceNow - App
- Thycotic
- DNS Lookup in UI and in Console
- HIAB Console
- Auditing Guide
- Adding Agent Attributes
- HIAB Distribution Settings
- Run Verification Scans
- Agent Latest Version
- Finding New Agents In OUTSCAN
- Setting up a HIAB as an Appsec Scale Scanner
- Hardening the HIAB
- Performing a PCI DSS Scan
- Two Factor Authentication
- Attributes
- Firewall Rules
- HIAB Enrollment
- Supported Platforms for Authenticated SSH Scanning
- Authenticated Scanning Using WinRM
- OneLogin Identity Provider Configuration
- Windows 7
- HIAB Remote Support
- Compliance Scanning
- Manage Targets
- Assign Tasks
- Authenticated Scanning Using SSH
- Tickets Quick Start Guide
- Retrieving Results From the Agent in OUTSCAN
- Appliance Logs
- Converting Normal with Webapp Scans (Netsec) to Portal Workflows
- Updating the Agent
- Troubleshooting SMB Authentication
- Agent Licensing
- Mark as False Positives
- Installing a Windows Agent
- Using Farsight in Netsec
- Testing Target System for Open TCP Ports
- HIAB Restore
- Scan Stages
- Request Clarifications
- HIAB Setup Guide
- Updating Agent Attributes
- CyberArk
- LDAP/AD
- Checking if the Agent has Produced Results
- ArcSight (HIAB only)
- HIAB E-mail Whitelisting
- Adjust Identity Provider SAML Metadata File
- Scanning Critical Industrial Devices/Machines
- Reporting Tools
- Scan Scheduling
- Scanning Performance and Impact Tuning
- PCI Compliance Scanning
- Configuring and Accessing the HIAB console using SSH
- User Groups
- Create Users
- HIAB Remote SSH Guide
- Download Agents
- Create Targets
- Windows 2012 R2 Server
- HIAB Backup
- Report Scheduling
- Access Tokens
- O24AUTH
- Complementary Authenticated Scan on Default Credentials
- Authenticated Scanning Using SMB
- Dynamic Target Group