By setting these inbound IP rules, you can grant access only to IP ranges you trust.

**All workspaces** can set inbound IP rules for:

- Individual [Render Postgres](/content/docs/postgresql-creating-connecting#restricting-external-access/index.html) and [Key Value](/content/docs/key-value#enabling-external-connections/index.html) datastores

**Scale** and **Enterprise** orgs can also set rules for:

- Individual web services and static sites
- An entire [environment](/content/docs/projects/index.html)
- An entire workspace

After you set IP rules, Render only allows inbound service connections from the IP ranges you specify. Disallowed IPs are automatically blocked with a `403 Forbidden` response.

Render blocks requests from disallowed IPs before they reach your service. For web services, blocked requests _do_ still appear in [HTTP request logs](/content/docs/logging#http-request-logs/index.html).

**Inbound IP rules apply only to connections from the public internet.**

These rules do not apply to inter-service communication over your [private network](/content/docs/private-network/index.html). For private network controls, see [Blocking cross-environment traffic](/content/docs/projects#blocking-cross-environment-traffic/index.html).

## Permissions

Different resource types require different [roles](/content/docs/team-members#member-roles/index.html) to manage inbound IP rules:

| Resource | Required role | Plan requirement |
| --- | --- | --- |
| Datastore | **Admin** or **Developer**\* | All workspaces |
| Service | **Admin** or **Developer**\* | [**Scale** or **Enterprise**](/content/pricing/index.html) |
| Environment | **Admin** or **Developer**\* | [**Scale** or **Enterprise**](/content/pricing/index.html) |
| Workspace | **Admin** | [**Scale** or **Enterprise**](/content/pricing/index.html) |

\*Non- [protected environments](/content/docs/projects#protected-environments/index.html) only.

## Setup

### Render Postgres / Key Value

All workspaces can set inbound IP rules for Render Postgres and Key Value. See the documentation for each type of managed datastore:

- [Render Postgres](/content/docs/postgresql-creating-connecting#restricting-external-access/index.html)
- [Render Key Value](/content/docs/key-value#enabling-external-connections/index.html)

### All other resource types

**Setting IP rules for any resource besides a [managed datastore](/content/docs/inbound-ip-rules#render-postgres-key-value/index.html) requires a Scale or Enterprise [plan](/content/pricing/index.html).**

Follow these steps to set inbound IP rules for a web service, static site, environment, or workspace.

1. In the [Render Dashboard](https://dashboard.render.com/), open the settings page for the service or environment you want to configure.
   - For workspace-level rules, click **Network Access** in the left pane of your workspace home.
2. Scroll down to the **Networking** section and find **Inbound IP Restrictions**:

If you haven't made any changes yet, you'll see a single default rule: `0.0.0.0/0` (allow all IPs).

3. Click an existing rule to edit it, or click **\+ Add source** to create a new rule. You can also click the trash icon next to a rule to delete it.

- Learn more about [rule format](/content/docs/inbound-ip-rules#rule-format/index.html) below.

**If you delete all rules, Render blocks _all_ inbound traffic to the affected service(s)!**

4. Click **Save** to apply your changes.

You're all set! Your new rules take effect within a few seconds.

## Rule format

Inbound IP rules are allowlists of IP ranges you specify using [CIDR notation](https://en.wikipedia.org/wiki/Classless_Inter-Domain_Routing#CIDR_notation). Render allows connections from the IP ranges you specify and blocks connections from all other IPs.

**Only IPv4 CIDR ranges are supported.**

Here are some example ranges:

| Rule | Meaning |
| --- | --- |
| `0.0.0.0/0` | Allow any IP address.<br>This is the default rule for services besides [Render Key Value instances](/content/docs/key-value#enabling-external-connections/index.html). |
| `203.0.113.0/24` | Allow IP addresses `203.0.113.0` through `203.0.113.255`.<br>This might represent a company's office network or a trusted third-party service. |
| `198.51.100.16/29` | Allow IP addresses `198.51.100.16` through `198.51.100.23`.<br>This smaller range of 8 addresses might represent a specific subnet of an office network. |
| `203.0.113.42/32` | Allow _only_ the IP address `203.0.113.42`.<br>The `/32` suffix limits the rule to the single defined IP address. This is useful for allowing only your own development machine. |

## Combining IP rules

**This section only applies to Scale and Enterprise [workspace plans](/content/pricing/index.html).**

When a service is subject to IP rules at multiple levels (workspace, environment, and/or service), an inbound IP must be allowed by _each level's_ rules to successfully connect:

If an IP is allowed at the service level but disallowed at the environment level (or vice versa), the connection is blocked.

When you view a service's inbound IP rules, you can see each level of rules that apply to it:

## FAQ

###### Can I set IP rules for a private service / background worker / cron job?

No. These service types never receive traffic from the public internet.

###### How do I allow connections from all IP addresses?

Include the value `0.0.0.0/0` (CIDR notation for "any IPv4 address") in your inbound IP rules.

This is the default rule for services besides [Render Key Value instances](/content/docs/key-value#enabling-external-connections/index.html).

###### What happens if I delete all rules for a given resource?

If you delete all inbound IP rules for a given service, environment, or workspace, Render blocks _all_ inbound traffic to the affected service(s).

###### Why don't I see inbound IP rule settings for my web service?

Inbound IP rules require a **Scale** or **Enterprise** [plan](/content/pricing/index.html) for everything besides [managed datastores](/content/docs/inbound-ip-rules#render-postgres-key-value/index.html).

###### What happens to inbound IP rules if I downgrade my workspace plan?

If you [downgrade](/content/docs/organizations#downgrading-an-org/index.html) to a plan below **Scale**, you must first delete all inbound IP rules for services, environments, and workspaces. Rules for [managed datastores](/content/docs/inbound-ip-rules#render-postgres-key-value/index.html) are available on all plans and are not affected.

###### Do inbound IP rules block TCP connectivity checks?

Usually, no. Render enforces inbound IP rules when receiving a protocol-level request (for example, an HTTPS request or a Postgres connection), _after_ the initial TCP connection is established.

This means tools like `nc` and `telnet` might show a successful connection from a disallowed IP, because they often only test socket connectivity. Actual requests from a disallowed IP are still blocked.