> ## Documentation Index
> Fetch the complete documentation index at: https://upstash-codex-consolidate-doc-suggestions.mintlify.site/llms.txt
> Use this file to discover all available pages before exploring further.

# Use IP Allowlist

<Info>
  IP Allowlist is available on all plans except for the free plan.
</Info>

IP Allowlist can be used to restrict which IP addresses are permitted to access your database by comparing a connection's address with predefined CIDR blocks. This feature enhances database security by allowing connections only from specified IP addresses. For example if you have dedicated production servers with static IP addresses, enabling IP allowlist blocks connections from other addresses.

<img src="https://mintcdn.com/upstash-codex-consolidate-doc-suggestions/qRznSGMP7sixbcy8/img/ipallowlist/ipallowlist.png?fit=max&auto=format&n=qRznSGMP7sixbcy8&q=85&s=85bd82041e2fe2771470077fa67b830e" alt="allowlist" width="1930" height="264" data-path="img/ipallowlist/ipallowlist.png" />

## Enabling IP Allowlist

By default, any IP address can be used to connect to your database. To enable the allowlist:

1. Open the database you want to protect in the [Upstash Console](https://console.upstash.com).
2. Go to the `Configuration` section on the database details page.
3. Add at least one IP range to the allowlist. The allowlist becomes active once the first range is saved.
4. Add more ranges to allow additional clients. Meeting the criteria of just one range is enough to establish a connection.

You can either provide

* IPv4 address, e.g. `37.237.15.43`
* CIDR block, e.g. `181.49.172.0/24`

<Info>
  Currently, IP Allowlist only supports IPv4 addresses.
</Info>

<Note>
  It may take a few minutes for changes to propagate.
</Note>

## What Happens to Blocked Requests

Once the allowlist is enabled, the database compares each connection's address
with the predefined CIDR blocks. Connections from addresses that match none of
the listed ranges are rejected, so clients on those addresses cannot reach the
database.

## Serverless Environments

Use known outbound IP addresses for the allowlist. Serverless platforms can use
dynamic egress addresses by default. Configure static egress, such as a NAT
gateway or your provider's static IP feature, before you allowlist a serverless
application. Add the outbound IPv4 addresses used by that configuration.

For private connectivity, see [VPC Peering](/redis/features/security#vpc-peering)
and [Private Link](/redis/features/security#private-link). Both require an
Enterprise contract.