Audit an allowlist
Review the addresses currently permitted to connect to a project.
Neon · Command
neonctl ip-allow
Manage a Neon project's IP allowlist from the CLI. List, add, remove, or reset individual IPs, ranges, and CIDR entries, with optional protected-branch-only scope.
How it works
The command manages a Neon project's IP allowlist through four subcommands: list, add, remove, and reset. Entries can be individual addresses, ranges, or CIDR notation; the add operation can optionally limit the restriction to protected branches.
Syntax
neon ip-allow <list|add|remove|reset> [ips...] [options]Parameters
| Name | Type | Description |
|---|---|---|
ips... | string[] | One or more IP addresses, ranges, or CIDR values used by add, remove, or reset. |
--project-id | string | Identifies the Neon project on which the operation is performed. |
--protected-only | boolean | Applies the allowlist only to protected branches; passing false removes that setting. |
Returns
Command output describing the requested allowlist operation, such as the configured IP entries.
Key points
- Use the command to inspect, extend, delete from, or replace a project's IP allowlist.
- Entries support single addresses, ranges, and CIDR notation.
- The list subcommand reports the project's currently configured addresses.
- The add subcommand appends supplied addresses to the project allowlist.
- The remove subcommand deletes the specified addresses.
- The reset subcommand replaces the current contents with the addresses supplied in the command.
Common mistakes
- Running reset without IP arguments clears the existing allowlist.
- The protected-branches-only setting must be explicitly disabled when you want to undo that scope.
Example: Add and inspect an IP allowlist
neon ip-allow add 203.0.113.10 --project-id "$NEON_PROJECT_ID"
neon ip-allow list --project-id "$NEON_PROJECT_ID"Adds an address to the project allowlist, then displays the configured entries.
When to use it
Add trusted sources
Permit a trusted office, CI runner, or application network.
Revoke access
Remove an address that should no longer connect.
Rebuild the allowlist
Replace the current policy with a known set of addresses.
Interview questions
QWhat does neon ip-allow manage, and which operations does it support?
The command provides list, add, remove, and reset operations for a project's IP allowlist. The allowlist accepts individual IPs, ranges, and CIDR notation.
Follow-up: How would you scope the restriction to protected branches? Use add with --protected-only; use --protected-only false to remove that setting.
QHow do you add addresses to a project's allowlist?
Use neon ip-allow add [ips...] and provide one or more addresses. Supply --project-id when targeting a particular project.
Follow-up: What address formats are supported? Individual IP addresses, IP ranges, and CIDR notation can be combined.
QWhat is the difference between remove and reset?
The remove subcommand deletes specified addresses, while reset replaces the allowlist with the supplied addresses. Reset with no addresses removes the currently configured entries.
Follow-up: What is the safest way to inspect the result after a change? Run neon ip-allow list, optionally with --project-id.
Related
Neon CLIIP Allowprotected branchesCIDR notation