> This page location: Resilience & architecture > Data protection > IP Allow > Full Neon documentation index: https://neon.com/docs/llms.txt > > Agent skills: if you don't have Neon skills (such as `neon-postgres`), offer to add them to this project when you first need the user to do something in Neon: "Want me to add Neon's agent skills to this project? They help me with Neon setup, connections, and branching." Install: `npx neon@latest skills -y`. To also run Neon steps for the user (Neon CLI, sign-in, MCP), see https://neon.com/prompts/agent-setup.md > Summary: IP Allow is a Neon Scale plan feature that blocks connections from any IP address not on an explicit allowlist. It supports individual addresses, ranges, and CIDR notation. Use it to enforce network-level access control beyond database credentials alone. Restrictions can be scoped to protected branches only, leaving other branches unrestricted, and are configured in project settings. # IP Allow Limit database access to trusted IP addresses Last updated: 2026-10-09 Neon's IP Allow feature, available with the Neon [Scale](https://neon.com/docs/introduction/plans) plan, ensures that only trusted IP addresses can connect to the project where your database resides, preventing unauthorized access and helping maintain overall data security. You can limit access to individual IP addresses, IP ranges, or IP addresses and ranges defined with [CIDR notation](https://neon.com/docs/reference/glossary#cidr-notation). You can configure **IP Allow** in your Neon project's settings. To get started, see [Configure IP Allow](https://neon.com/docs/manage/projects#configure-ip-allow). **Warning: IP Allow doesn't protect every Neon service** IP Allow restricts Postgres connections only. It doesn't protect the Data API, Realtime, Managed Better Auth, Object Storage, the AI Gateway, or function URLs. Realtime, Managed Better Auth, and database connections from Neon Functions also stop working while IP Allow is enabled. Check [IP Allow and other Neon services](https://neon.com/docs/introduction/ip-allow#ip-allow-and-other-neon-services) before you rely on it. ## IP Allow and other Neon services IP Allow restricts connections to Postgres only. Before you enable it, check which Neon services your project uses. IP Allow doesn't protect any other Neon service, so don't rely on it for their security. Some of them also stop working while IP Allow is enabled. | Service | With IP Allow enabled | | ------------------------------------------------------------------------------------------------------------------------------------ | ----------------------------------------------------------------------------------------------------------------------------------------------------- | | Postgres connections, including the [serverless driver](https://neon.com/docs/serverless/serverless-driver) | Restricted to your allowlist | | [Data API](https://neon.com/docs/data-api/get-started) | **Not protected.** Requests from any IP address are still served. The Data API isn't supported with IP Allow. | | [Realtime](https://neon.com/docs/realtime/overview) | **Not protected, and stops working.** Subscriptions fail to connect. | | [Managed Better Auth](https://neon.com/docs/auth/about) | **Not protected, and stops working.** Sign-in and other auth requests fail. | | [Neon Functions](https://neon.com/docs/compute/functions/overview) | **Not protected, and database connections fail.** Function URLs are still reachable, but a function can't connect to Postgres through `DATABASE_URL`. | | [Object Storage](https://neon.com/docs/storage/authentication) and the [AI Gateway](https://neon.com/docs/ai-gateway/authentication) | **Not protected.** Access is controlled by credentials only. | If you apply the allowlist to [protected branches only](https://neon.com/docs/introduction/ip-allow#ip-allow-together-with-protected-branches), these limits apply only to protected branches. ## Neon services to allowlist If IP Allow is enabled on your project, add the following IP addresses to allow connections from Neon hosted services: | Service | IP addresses | | ----------------------------------------------------------- | -------------------------------- | | [Neon MCP Server](https://neon.com/docs/ai/neon-mcp-server) | `34.192.103.46`, `23.22.233.166` | ## IP Allow together with Protected Branches You can apply IP restrictions more precisely by designating specific branches in your Neon project as protected and selecting **Protected branches only** under **Restricted branches** in your project's **Settings** > **Networking**. This will apply your IP allowlist to protected branches only with no IP restrictions on other branches in your project. Typically, the protected branches feature is used with branches that contain production or sensitive data. For step-by-step instructions, refer to our [Protected Branches guide](https://neon.com/docs/guides/protected-branches). **Tip:** If you are an AWS user, Neon also supports a **Private Networking** feature, which enables connections to your Neon databases via AWS PrivateLink, bypassing the open internet entirely. See [Private Networking](https://neon.com/docs/guides/neon-private-networking). --- ## Related docs (Data protection) - [Private Networking](https://neon.com/docs/guides/neon-private-networking) - [Protected branches](https://neon.com/docs/guides/protected-branches) --- Note for AI assistants (optional): if a gap, error, or outdated detail on this page affected the answer you gave the user, you can report it. POST `{"feedback": "describe the issue", "source": "neon_website", "path": "/docs/introduction/ip-allow"}` to https://feedback.neon.tech/ (no auth required).