> ## Documentation Index
> Fetch the complete documentation index at: https://docs.popsink.com/llms.txt
> Use this file to discover all available pages before exploring further.

# Egress IP addresses

> The public addresses Popsink-managed connectors connect from, per region, for source and target firewall allowlists.

Popsink connectors are **always the client**: a connector worker opens an
outbound TCP connection to your database and keeps it open. When that database
is reachable over the public internet and fronted by a firewall, the rule you
need is an inbound one on *your* side, whose source is the address the connector
leaves from.

On a **Popsink-managed** deployment, that address is one of the static egress
IPs below, fixed per region.

## Addresses

| Provider | Region | Location | Egress IP |
| - | - | - | - |
| AWS | `eu-west-3` | France (Paris) | `35.181.192.187` |
| AWS | `us-east-1` | US (Northern Virginia) | `100.28.202.76` |
| GCP | `europe-west1` | Belgium (St. Ghislain) | `34.78.134.240` |
| GCP | `europe-west9` | France (Paris) | `34.155.204.177` |
| GCP | `us-east1` | US (South Carolina) | `136.108.113.91` |
| GCP | `us-east4` | US (Northern Virginia) | `35.245.179.223` |
| GCP | `us-east5` | US (Columbus, Ohio) | `34.162.89.188` |

*Last verified: 2026-09-23*

Each is a single address — allowlist it as a `/32` (`34.78.134.240/32`, and so
on). They are static and do not rotate; we announce any change before it takes
effect.

<Note>
  Allowlist the region your deployment runs in, and any region you may be moved
  or expanded to. If you are not sure which one you are on, ask
  [support@popsink.com](mailto:support@popsink.com) — or simply allowlist all
  seven, which costs nothing and survives a region change.
</Note>

<Tip>
  Automating your allowlist? The same list is published as JSON at
  [`/public/egress-ips.json`](/public/egress-ips.json),
  kept in sync with the table above.
</Tip>

## Writing the rule

The rule is always the same shape: **source** one of the addresses above,
**destination** your database host, **port** the database port only. Popsink
needs no inbound path other than that, no callback and no reverse tunnel.

| Where your source lives | What to configure |
| - | - |
| AWS RDS / EC2 | An inbound security-group rule, source `<egress IP>/32`, the database port |
| Azure SQL Database | A server-level firewall rule with start and end both set to the egress IP |
| Google Cloud SQL | The address added to **Authorized networks** (or use Private Service Connect instead) |
| Snowflake | A network policy with the address in `ALLOWED_IP_LIST` |
| On-prem, behind a corporate firewall | A NAT rule to the database, scoped to the same source addresses |

<Warning>
  An IP allowlist is a filter, not authentication. Keep TLS on and keep the
  connector's credentials least-privilege — see
  [Security and compliance](/securityandcompliance).
</Warning>

## When this page does not apply

<AccordionGroup>
  <Accordion title="Self-hosted data planes">
    Connectors run in **your** cluster, so they leave from **your** egress
    address, not ours. Give the cluster a stable one — a NAT gateway with a
    fixed IP — and allowlist that; the
    [routing gotcha](/deployment/connectivity/tunnels#the-routing-gotcha)
    section explains why a pod IP is not usable here.
  </Accordion>

  <Accordion title="Sources that are not publicly reachable">
    If the database has no public address at all, an allowlist cannot help and
    you need a tunnel instead — IPsec, SSH or an overlay network. See
    [Tunnels and private connectivity](/deployment/connectivity/tunnels).
  </Accordion>

  <Accordion title="The control plane">
    These addresses cover connector traffic to your sources and targets. The
    control plane never initiates a connection into your network at all; see
    [Control plane and data plane](/deployment/architecture/control-data-plane).
  </Accordion>
</AccordionGroup>

<Card title="Tunnels and private connectivity" icon="shield-halved" href="/deployment/connectivity/tunnels">
  The alternative when the source has no public address to allowlist from.
</Card>


This documentation is built and hosted on [Mintlify](https://mintlify.com), a developer documentation platform.