Allow Access to Mondoo Service Endpoints
Firewall allowlist entries for installation, updates, and the Mondoo API.
If your environment blocks outbound traffic by default, allow the Mondoo service endpoints below so clients can install, update, and report scan results. All Mondoo client traffic is outbound HTTPS on port 443; Mondoo never requires inbound access to your environment.
Allow by hostname (recommended)
Mondoo services run behind load balancers, so IP addresses can change over time. Where your firewall supports hostname (FQDN) rules, allow these hostnames instead of pinning IP addresses:
| Hostname | Purpose |
|---|---|
us.api.mondoo.com | Mondoo Platform API for the US region: registration, policies, scan results |
eu.api.mondoo.com | Mondoo Platform API for the EU region: registration, policies, scan results |
releases.mondoo.com | Mondoo client releases and updates |
install.mondoo.com | The install service; needed only during setup |
Allow the API hostname for the region your organization runs in.
Allow by IP address
If your firewall supports only IP-based rules, use the addresses below. Because these addresses can change, prefer hostname rules where possible.
releases.mondoo.com (Mondoo client releases) and install.mondoo.com (the install service) both resolve to:
34.110.159.213
2600:1901:0:d78e::For the Mondoo API, use the IP address for the region your organization runs in:
34.160.242.34 # US region
34.102.168.217 # EU region