Stop worrying about zero days
on your internet-exposed assets

Allowist keeps your firewall's IP access control lists updated with your remote workstations' public IP addresses, so you can lock down internet-exposed VPN, RMM, web applications and more. Scanners, bots, and the next zero-day never even see a login page — and the time that buys you is the difference between a scheduled patch and a breach.Allow what's needed. Deny everything else.

Start for free → See how it works

allowist — live heartbeat

12:00:01 203.0.113.45KG-workstation · unchanged 4 entries active

12:01:01 203.0.113.45 → .99IP changed · allow list updated ✓ allowed

12:01:03 firewall pollPalo Alto EDL refreshed · 4 IPs 200 OK

Why it matters

Shrink your
attack surface

Every IP that can reach your VPN or admin portal is a potential entry point — and when a zero-day hits, exposed services get hit first. Allowist keeps your allow list current automatically, so unknown IPs never reach the service at all.

✓

Zero-days can't reach youAn exploit can't fire from an IP the firewall never lets through.

✓

No stale rules, no lockoutsIP changed? The list already knows. No tickets.

✓

Your existing firewallWorks with anything that reads an external IP list.

How it works

Three steps,
zero manual work

Device check-in / IP update Policy-approved traffic Unknown or unwanted traffic

agents report IPs → your traffic passes the green Allowist list → everything else bounces off the wall

Your devices report

A small agent on each workstation sends its public IP address whenever it changes.

Allowist updates the list

The old address comes off, the new one goes on, and the change is logged.

Your firewall enforces it

It fetches the list on its schedule and allows only those addresses.

Not just agents. A complete EDL manager.

Sources: plain lists & JSON

Subscribe an EDL to any URL — a text list or JSON with a selector (AWS ip-ranges, Microsoft 365, GitHub). Refreshed on your schedule; you're alerted if a source stops importing.

Exclusions, including by source

Carve ranges out of any list, manually or by subtracting another feed. Excluded addresses can't re-enter from agents, imports, links, or other sources.

Hostnames & URL lists

Add a hostname and publish its resolved addresses — an agent for hosts you can't install one on — or publish domain and URL lists for PAN-OS and FortiGate.

Allow Links

Send a contractor a link; their address is recorded when they open it and expires on the schedule you set. No agent, no ticket.

TTL policies per list

Agent, manual, and link lifetimes set once per EDL and enforced everywhere — nothing outlives the policy, and every expiry is audited.

Every vendor format

Palo Alto, Fortinet, Cisco, Juniper, Check Point, F5, pfSense/OPNsense, iptables/nftables, JSON — one list, any firewall, with HTTP auth and IP restriction on the feed.

No more stale IPs

Old addresses are removed automatically after a TTL, or the moment a device checks in from a new location.

Temporary access

Grant contractor or vendor access that expires on its own. No cleanup, no forgotten holes in the wall.

Audit-ready

Every IP change, feed fetch, and member action is logged with actor, timestamp, and source IP. Exportable to CSV.

Firewall support

Every major platform
natively supported

Allowist generates the exact format each vendor expects. Point your firewall at a URL and you're done.

paloalto

Palo Alto Networks

Panorama & NGFW EDL

fortinet

Fortinet FortiGate

External Connector feed

cisco_acl

Cisco IOS / IOS-XE

Named extended ACL

cisco_asa

Cisco ASA

object-group network

juniper

Juniper SRX

prefix-list policy-options

checkpoint

Check Point

Bulk host object JSON

F5 BIG-IP

iRule data-group class

iptables / nftables

Linux firewall

bash script · nft config

Pricing

Simple,
transparent plans

All plans include all 12 firewall formats and full audit logging. Billed monthly via PayPal.

Free

forever

1 EDL

5 agents

1 user · single IPs only

All 12 formats

Audit log (30 days)

Team members

Email notifications

Get started

Starter

^$19.99

/ month

2 EDLs

100 agents

Unlimited team members

IP subnets (CIDR)

CSV import

Email notifications

Email support

Start Starter

Common
questions

How does this reduce my attack surface?

Your VPN or admin portal is only reachable from IPs on your allow list. When a zero-day drops, it can't be exploited from an IP that was never allowed through the firewall to begin with.

Do agents need elevated privileges or open ports?

No. Agents only make outbound HTTPS calls to detect their IP and send heartbeats. They run as a standard system service — no open ports, no admin rights after install.

What happens if an agent goes offline?

Its last known IP stays in the allow list and the agent shows offline in your dashboard. You can remove it manually, get an email alert, or set a stale-TTL policy that sweeps it automatically.

Can I import an existing list of IPs?

Yes — any allow list supports CSV import. Upload a file with an ip column and optional label column. Duplicates are skipped automatically.

How does payment work?

All plans billed monthly via PayPal. Upgrade, downgrade, or cancel anytime. Enterprise customers can arrange annual invoicing — [email protected].

My firewall only polls external lists every 5 minutes. Will users notice a delay?

Only when an address changes. The agent reports the new IP within seconds, but your firewall doesn't see it until its next fetch — so a user whose address just changed could wait up to one polling interval. Set the EDL refresh to the shortest interval your firewall allows; most vendors go down to a minute or two.

What is an Allow Link?

A one-time link you email to a contractor or a user who doesn't have the agent. When they open it, their current IP is added to your list for the time you choose, then expires on its own.

What is an Allow URL?

A standing, password-protected page for your list. Contractors or users visit it whenever they need their current IP added — no agent, no ticket, and each addition expires on the schedule you set.

Does Allowist replace my web application's own security?

No. Allowist is an extra layer in front of your existing stack, not a substitute for passwords, MFA or certificates. It keeps the open internet from reaching the login page at all, which shrinks your attack surface and buys time when the next zero-day lands.

Is there anything to install server-side?

No. Allowist is a fully managed cloud platform. Just sign up, create an allow list, and install the lightweight agent on each workstation.

Stop worrying about zero dayson your internet-exposed assets

Shrink yourattack surface

Three steps,zero manual work

Every major platformnatively supported

Simple,transparent plans

Commonquestions