Skip to main content

Outbound IP Addresses

When your service connects to something outside ComputeSphere, such as a managed database with a firewall, an email provider or a partner's API, the other side sees the connection come from your region's outbound IP range. Add the range for your environment's region to that system's allowlist.

  • us-east-1, US East (Virginia): 52.247.113.114/31
  • eu-north-1, EU (Sweden): 4.223.89.116/31
  • us-west-1, US West (Arizona): 20.38.7.128/31

Each range is a /31, which is two addresses. Allowlist the whole range, not a single address: your services' connections can leave from either one.

Before you allowlist​

  • Shared by the whole region. Every service in a region, on every account, connects out from that region's range. Allowlisting it lets in the whole region, not only your account. Keep the other side's own sign-in or API key in place: the allowlist narrows who can connect, it doesn't prove who is connecting.
  • Never changes. A published range stays the same. You won't need to update an allowlist because an address moved.
  • New ranges are announced 14 days ahead. If a region adds a range, it's announced on status.computesphere.com at least 14 days before any traffic leaves from it. Add it to your allowlists during that window.
  • Every service type. Web services, private services, background workers and cron jobs in a region all connect out from its range.
  • One region per environment. An environment's services use its region's range. If you run environments in two regions, allowlist both ranges.
  • Outbound only. These are the addresses your services' requests come from, not where your services are reached. For inbound traffic, see Custom Domains.

Find your region's range​

Console​

Open a web service or a private service, go to the Settings tab, and look in the Networking card. Outbound IP addresses lists the range for the service's region, with a copy button.

API​

GET /v2/regions lists each region with its outbound_ips:

curl --request GET \
  --url https://api.computesphere.com/v2/regions \
  --header "Authorization: Bearer YOUR_API_TOKEN"
{
  "object": "list",
  "items": [
    {
      "object": "region",
      "name": "us-east-1",
      "display_name": "US East (Virginia)",
      "available": true,
      "outbound_ips": ["52.247.113.114/31"]
    },
    {
      "object": "region",
      "name": "eu-north-1",
      "display_name": "EU (Sweden)",
      "available": true,
      "outbound_ips": ["4.223.89.116/31"]
    },
    {
      "object": "region",
      "name": "us-west-1",
      "display_name": "US West (Arizona)",
      "available": true,
      "outbound_ips": ["20.38.7.128/31"]
    }
  ]
}

A region that has no published range yet comes back without outbound_ips.

Limits​

  • No per-account addresses. A range belongs to its region, not to your account. Addresses that only your traffic uses aren't available today.
  • IPv4 only. Outbound connections leave over IPv4.
  • Builds use separate addresses. Builds connect out from their own build addresses, which aren't listed here yet. If a build fetches from a private package registry or repository behind an allowlist, contact support for the build addresses.
  • The console shows the range on web and private services only. For a background worker or a cron job, use the table above or the API: it leaves from the same range as every other service in its region.
  • The CLI doesn't show the ranges yet. csph regions get and csph regions list don't include outbound_ips today. Use the API until they do.

What's next​

  • Private Network: service-to-service traffic inside an environment.
  • Custom Domains: bring your own domain for inbound traffic.
  • Networking: who can reach your services inbound.
  • Security: how environments and accounts are isolated.
  • Status: where range announcements and maintenance windows are posted.