Allow only corporate or deployment-network addresses
Production database access
Neon · Const
IP Allow
IP Allow restricts connections to a Neon project so that only explicitly trusted IP addresses or ranges can connect. It is available on the Scale plan and supports individual addresses, ranges, and CIDR notation.
How it works
IP Allow is a project-level network restriction that permits database connections only from configured IP addresses or ranges. The allowlist can be managed in the Neon Console, through the API, or with the Neon CLI, and can optionally apply only to protected branches.
Syntax
neonctl ip-allow <list|add|remove|reset> [addresses]Returns
Restricts project database connections to the configured IP allowlist.
Key points
- IP Allow is offered as a feature of Neon’s Scale plan.
- Connections from addresses absent from the project allowlist are denied.
- The allowlist accepts single IPs, IP ranges, and CIDR notation.
- The Neon Console exposes IP Allow configuration in project settings.
Common mistakes
- Enabling the feature can block every client outside the configured allowlist, so include all required connection sources.
- Neon-hosted services may need their addresses added explicitly when IP Allow is enabled.
- The protected-branches-only mode leaves other branches unrestricted.
Example: Allow a specific IP address
neonctl ip-allow add 203.0.113.10 --project-id $NEON_PROJECT_IDAdds a trusted IP address to the allowlist for the specified Neon project.
When to use it
Restrict protected branches while leaving other branches open
Branch-specific protection
Manage allowlist entries through the CLI or API
Infrastructure automation
Interview questions
QWhat does Neon IP Allow do, and which address formats can it accept?
IP Allow restricts project database access to explicitly permitted IP addresses, including individual addresses, ranges, and CIDR blocks. It is available with the Neon Scale plan.
Follow-up: How would you preserve access for multiple networks? Replace the configuration with a complete list containing every required address or range, rather than assuming an update appends entries.
QWhat is the default branch scope of an IP allowlist?
The allowlist applies to all branches by default. Neon also supports configuring it for protected branches only, leaving other branches without IP restrictions.
Follow-up: When is protected-branch scope useful? It is useful when production or other protected branches require network controls while development branches must remain broadly accessible.
QHow can an engineer automate IP Allow management?
The configuration can be managed in project settings, through the Neon API, or with the CLI. The CLI provides list, add, remove, and reset operations for the project allowlist.
Follow-up: Which CLI operation should be used to inspect machine-readable state? Use the CLI list operation with JSON output.
Related
IP allowlistCIDR notationprotected branchesNeon CLI ip-allowConfigure IP Allow