> ## Documentation Index
> Fetch the complete documentation index at: https://docs.getmodus.com/llms.txt
> Use this file to discover all available pages before exploring further.

# IP Allowlisting

> Allow Modus to reach data sources that sit behind a firewall or IP allowlist.

Some data sources — especially production databases and warehouses — only accept
connections from approved IP addresses. Modus connects to your data sources from
a fixed set of AWS NAT gateway egress IP addresses, which you can add to your
firewall, security group, or database IP allowlist.

## When you need this

You only need an allowlist if your data source restricts inbound network access.
If Modus can already reach your instance, you can skip this. Common cases:

* A cloud database with a security group or firewall (AWS RDS, Google Cloud SQL, Azure).
* A warehouse with network policies (Snowflake, Amazon Redshift).
* A self-hosted database behind a corporate firewall.

## Modus's egress IPs

Allowlist all of the following addresses — connections can originate from any of
them across availability zones:

| IP address    | CIDR             |
| ------------- | ---------------- |
| `3.22.84.182` | `3.22.84.182/32` |
| `3.138.94.22` | `3.138.94.22/32` |

<Note>
  If your firewall requires a range, use the `/32` CIDR shown above (a single
  host). Questions? Contact [support@getmodus.com](mailto:support@getmodus.com).
</Note>

## Add the IPs to your allowlist

Add each IP above as a `/32` entry (a single host) to your data source's inbound
rules. Where to add them depends on your platform:

| Platform           | Where to add the IPs                                        |
| ------------------ | ----------------------------------------------------------- |
| AWS RDS / Redshift | The security group attached to the instance (inbound rules) |
| Google Cloud SQL   | Connections → Authorized networks                           |
| Azure Database     | Networking → Firewall rules                                 |
| Snowflake          | A network policy (`CREATE NETWORK POLICY`)                  |
| Self-hosted        | Your firewall / `pg_hba.conf` / equivalent                  |

Once the IPs are allowlisted, return to your integration guide to finish connecting.