Skip to main content
This step tells the agent how to reach your application. Most applications are on the public internet, and you can keep the default. If your application is only reachable from inside your network, choose a private network connection.

​
Choose a network mode

1

Public network

The application is reachable directly over the internet. This is the default. If you use a firewall or WAF, allowlist the agent IP shown in the Target & scope step.
2

Private network

The application is only reachable from inside your network, for example an internal tool or a staging environment behind a VPN. You then choose a connection type.

​
Connection types for a private network

1

OpenVPN

The agent connects through your existing OpenVPN gateway. Upload a .ovpn profile.
2

WireGuard

The agent connects through your existing WireGuard tunnel. Upload a .conf profile.
3

NoScope connector

You run a small NoScope agent on a host inside your network. It opens an outbound connection to NoScope, so you do not need to open inbound firewall ports.

​
OpenVPN and WireGuard

  • Name: optional. If you leave it empty, NoScope uses the profile file name.
  • Allowed CIDRs: optional. A comma-separated list of the network ranges the agent may reach, for example 10.0.0.0/16, 192.168.1.0/24. Leave it empty to allow all destinations.
  • VPN profile: required. A plain text .ovpn or .conf file, up to 256 KB. Profiles that run commands are rejected.
  • VPN username and VPN password: only if your VPN needs them.
  • TOTP seed: only if your VPN uses a TOTP code for two-factor login. Hardware keys and push-based 2FA are not supported.
NoScope creates the connection when you save the application. There is nothing to install.

​
NoScope connector

1

Name the connector

Enter a Connector name, for example prod-vpc-connector. You can also set Allowed CIDRs to limit where the agent can go.
2

Create the connector

Click Create connector and get install command. NoScope shows an install command with a one-time enrollment token. Copy it now. The token is only shown once.
3

Install it

Run the command on any host that can reach the application. When the connector starts, it shows as Connected.
4

Continue the wizard

Go on with the next steps. Scans for this application go through the connector.
If you lose the install command, open the application’s Network access settings and use Rotate token to get a new one.

​
Tips

  • Use Allowed CIDRs to keep the agent inside the networks you want tested.
  • Out-of-scope URLs and blocked endpoints still apply on a private network.
  • Keep the VPN account or connector host running for the whole scan. A typical scan runs for several hours.