Inbound IP Rules

You can configure which IP addresses can connect to your Render services over the public internet:

By setting these inbound IP rules, you can grant access only to IP ranges you trust.

All workspaces can set inbound IP rules for:

• Individual Render Postgres and Key Value datastores

Scale and Enterprise orgs can also set rules for:

• Individual web services and static sites
• An entire environment
• An entire workspace

After you set IP rules, Render only allows inbound service connections from the IP ranges you specify. Disallowed IPs are automatically blocked with a 403 Forbidden response.

Render blocks requests from disallowed IPs before they reach your service. For web services, blocked requests do still appear in HTTP request logs.

Inbound IP rules apply only to connections from the public internet.

These rules do not apply to inter-service communication over your private network. For private network controls, see Blocking cross-environment traffic.

Permissions

Different resource types require different roles to manage inbound IP rules:

Setup

Render Postgres / Key Value

All workspaces can set inbound IP rules for Render Postgres and Key Value. See the documentation for each type of managed datastore:

• Render Postgres
• Render Key Value

All other resource types

Setting IP rules for any resource besides a managed datastore requires a Scale or Enterprise plan.

Follow these steps to set inbound IP rules for a web service, static site, environment, or workspace.

1. In the Render Dashboard, open the settings page for the service or environment you want to configure.

   • For workspace-level rules, click Network Access in the left pane of your workspace home.

2. Scroll down to the Networking section and find Inbound IP Restrictions:

   

   If you haven't made any changes yet, you'll see a single default rule: 0.0.0.0/0 (allow all IPs).

3. Click an existing rule to edit it, or click