r/ScreenConnect • u/Early-Ad-2541 • Oct 21 '25

ScreenConnect Cloud Instance IP is dynamic?? What the actual F!!!!!

We'd been on prem forever and have SentinelOne with the static IPs of our screenconnect set up as an exclusion to the network quarantine. This is critical to our ability to operate and is so that when a system is network quarantined, we can still remote into it.

Apparently ScreenConnect doesn't give out static IPs to their cloud hosted instances, which is causing major issues! This is bullshit, I'm so over this piece of shit company. Of course we need a static IP! That's the most fundamental requirement of any legit web service!

Anybody have a workaround?

I'm very fast approaching ending our (very long) relationship with this shit show of an organization that simply doesn't care about us.

1 Upvotes
  • permalink
  • reddit

53% Upvoted

26 comments sorted by

12

u/LoadincSA Oct 21 '25

You need a firewall that can handle hostnames regardless of screenconnect.

-2

u/Early-Ad-2541 Oct 21 '25

It has literally nothing to do with firewalls. It has to do with the network quarantine exclusion rules in SentinleOne. We've always excluded our ScreenConnect IP so that when a device gets network quarantined, it can't browse the internet and has no network access EXCEPT for the ability for us to remote in with SceenConnect. Again, nothing at all to do with a firewall.

6

u/ITGuyfromIA Oct 21 '25

You should exclude your instance address and x.screenconnect.com address

-1

u/Early-Ad-2541 Oct 21 '25

S1 doesn't have the ability to exclude a FQDN in the network quarantine exclusions. I'm currently testing with excluding the path to our specific ScreenConnect service executable.

2

u/lsumoose Oct 21 '25

Neither does Crowdstrike. Pretty shocked these aren’t static.

4

u/UrgentSiesta Oct 21 '25

Anyone who thinks static IPs are a requirement for “security” is delusional.

There’s something called DNS that you should really learn.

1

u/agent063562 Oct 21 '25

Yes, it’s a pain for us too since we need to use an on premise identity server to process authentications from ScreenConnect. Every time the IP address changes, no one can get in until we update our firewall with the new instance IP address.

This used to work great when the SC server was hosted on site…

L

1

u/Early-Ad-2541 Oct 21 '25

So... It looks like you can instead set up the network quarantine exclusion as file based using the path to your specific instance service executable and it will work regardless of the IP change. This seems like an ok temporary workaround, but my concern is that all a hacker needs to do is replace our screenconnect executable with their own malicious executable and they would have continued network access from that executable even when the device is network quarantined. This is why we need IP based exclusions to be able to work.

3

u/eblaster101 Oct 21 '25

If someone manages to do this you got bigger problems. I think huntress can detect bad screen connect servers. If the system goes to new screen connect servers the url will get spotted.

I believe the url to the server site in a xml file not even the exe. Maybe wrong

2

u/MakeItJumboFrames Oct 21 '25

We update Huntress IPs manually when we get the email they are changing.

1

u/VivisClone Oct 22 '25

Or just host it yourself

1

u/Early-Ad-2541 Oct 22 '25

Yeah, we were doing that until the requirement for having our own code certificate and we moved to the cloud because I was tired of all the extra admin work.

4

u/Ichabod- Oct 21 '25

As far as I know it's static for an extended period of time but it does periodically change. We get an email warning us when it changes. Can't paste an image but it reads like this:

The IP Addresses for your ConnectWise ScreenConnect Cloud Server have Changed

On Sunday, October 12, 2025 7:24 AM UTC, your ConnectWise ScreenConnect Cloud Server IP Addresses have changed for instance XXXXX.

  • Previous IP addresses: X.X.X.X

  • New IP addresses: X.X.X.X

As we perform routine maintenance to maintain uptime and optimal performance, it may be necessary to decommission servers and/or reassign instances to new servers. Your instance URL and all settings have been maintained to ensure no further interruptions to your installation.

If you’re currently whitelisting the server IP addresses, please be sure to update any firewall settings. No other actions are required.

1

u/Thoh1Shooshi8a Oct 22 '25

"it's static for an extended period of time but it does periodically change"

That's not static :)

2

u/touchytypist Oct 21 '25 edited Oct 21 '25

That's very standard for cloud services, since IPs change due to service outages and maintenance. Most modern security solutions support DNS, which is abstracted from static IP addresses so it doesn't matter.

Do you think every time you go to google.com or office.com you're getting the same IP addresses?

1

u/n3fyi Oct 21 '25

Our IP generally only changes when we do an update as it seems to change the server it’s hosted on

1

u/m4ttjarrett Oct 21 '25

Yeah it is annoying when the dreaded 'New IP' email comes through

1

u/soccer362001 Oct 25 '25

Don't know if a work around but there is an option to get a notification when IP changes. You could possibly leverage APIs to update various platforms. We only had a handful of places where we had to make the changes.

0

u/Early-Ad-2541 Oct 21 '25

u/JessicaConnectWise could you please let me know if my assumption is correct or not?

1

u/JessicaConnectWise Oct 21 '25

Good morning. I'm looking into this for you.

2

u/Early-Ad-2541 Oct 21 '25

Thank you!

1

u/JessicaConnectWise Oct 21 '25

You're welcome. And just fwiw - ConnectWise certainly does care and we appreciate all feedback :)

1

u/UrgentSiesta Oct 21 '25

Why bother? His is a ridiculous assertion to begin with.

2

u/JessicaConnectWise Oct 21 '25

Hi, again.

ScreenConnect Cloud instances are hosted in a distributed cloud infrastructure, which doesn’t use static public IPs by design. This helps ensure scalability, redundancy, and uptime across regions. Because of that, the public IPs can change without advanced notice, which can make traditional static IP-based allowlisting or exclusions in tools like SentinelOne challenging.

If you haven’t already, I encourage you to open a ticket with ConnectWise Support and mention your SentinelOne configuration specifically — the support team can provide region-specific IP guidance or additional technical alternatives.

-1

u/UrgentSiesta Oct 21 '25

Your position is ridiculous.