> ## Documentation Index
> Fetch the complete documentation index at: https://docs.noscope.com/llms.txt
> Use this file to discover all available pages before exploring further.

# Network access

> Tell NoScope how to reach your application: directly over the internet, or through your private network.

This step tells the agent how to reach your application. Most applications are on the public internet, and you can keep the default. If your application is only reachable from inside your network, choose a private network connection.

## Choose a network mode

**1. Public network**

The application is reachable directly over the internet. This is the default. If you use a firewall or WAF, allowlist the agent IP shown in the Target & scope step.

**2. Private network**

The application is only reachable from inside your network, for example an internal tool or a staging environment behind a VPN. You then choose a connection type.

## Connection types for a private network

**1. OpenVPN**

The agent connects through your existing OpenVPN gateway. Upload a `.ovpn` profile.

**2. WireGuard**

The agent connects through your existing WireGuard tunnel. Upload a `.conf` profile.

**3. NoScope connector**

You run a small NoScope agent on a host inside your network. It opens an outbound connection to NoScope, so you do not need to open inbound firewall ports.

### OpenVPN and WireGuard

* **Name**: optional. If you leave it empty, NoScope uses the profile file name.
* **Allowed CIDRs**: optional. A comma-separated list of the network ranges the agent may reach, for example `10.0.0.0/16, 192.168.1.0/24`. Leave it empty to allow all destinations.
* **VPN profile**: required. A plain text `.ovpn` or `.conf` file, up to 256 KB. Profiles that run commands are rejected.
* **VPN username** and **VPN password**: only if your VPN needs them.
* **TOTP seed**: only if your VPN uses a TOTP code for two-factor login. Hardware keys and push-based 2FA are not supported.

NoScope creates the connection when you save the application. There is nothing to install.

### NoScope connector

**1. Name the connector**

Enter a **Connector name**, for example `prod-vpc-connector`. You can also set **Allowed CIDRs** to limit where the agent can go.

**2. Create the connector**

Click **Create connector and get install command**. NoScope shows an install command with a one-time enrollment token. Copy it now. The token is only shown once.

**3. Install it**

Run the command on any host that can reach the application. When the connector starts, it shows as Connected.

**4. Continue the wizard**

Go on with the next steps. Scans for this application go through the connector.

If you lose the install command, open the application's **Network access** settings and use **Rotate token** to get a new one.

## Tips

* Use Allowed CIDRs to keep the agent inside the networks you want tested.
* Out-of-scope URLs and blocked endpoints still apply on a private network.
* Keep the VPN account or connector host running for the whole scan. A typical scan runs for several hours.


This documentation is built and hosted on [Mintlify](https://mintlify.com), a developer documentation platform.