Use IP Allowlist

IP Allowlist can be used to restrict which IP addresses are permitted to access your database by comparing a connection’s address with predefined CIDR blocks. This feature enhances database security by allowing connections only from specified IP addresses. For example if you have dedicated production servers with static IP addresses, enabling IP allowlist blocks connections from other addresses.

​

Enabling IP Allowlist

By default, any IP address can be used to connect to your database. To enable the allowlist:

1. Open the database you want to protect in the Upstash Console.
2. Go to the Configuration section on the database details page.
3. Add at least one IP range to the allowlist. The allowlist becomes active once the first range is saved.
4. Add more ranges to allow additional clients. Meeting the criteria of just one range is enough to establish a connection.

You can either provide

• IPv4 address, e.g. 37.237.15.43
• CIDR block, e.g. 181.49.172.0/24

​

What Happens to Blocked Requests

Once the allowlist is enabled, the database compares each connection’s address with the predefined CIDR blocks. Connections from addresses that match none of the listed ranges are rejected, so clients on those addresses cannot reach the database.

​

Serverless Environments

Use known outbound IP addresses for the allowlist. Serverless platforms can use dynamic egress addresses by default. Configure static egress, such as a NAT gateway or your provider’s static IP feature, before you allowlist a serverless application. Add the outbound IPv4 addresses used by that configuration. For private connectivity, see VPC Peering and Private Link. Both require an Enterprise contract.