Description

Ensure Network Restrictions are configured so that only approved IP addresses or CIDR ranges, such as office networks, VPNs, and application servers, can connect directly to the Postgres database and its connection pooler. All other IP addresses should be blocked before they reach the database.

Rationale

By default, the database accepts connection attempts from any IP address on the internet, protected only by the database password. This leaves it open to password guessing and makes a leaked password immediately usable from anywhere. Restricting connections to known IP ranges adds a second layer of protection that is checked before any login attempt.

Impact

  • Only approved IP ranges can connect to the database

  • Blocks attacks from unknown networks

  • New servers or developers must be added to the allowlist

Default Value

By default, all IP addresses are allowed to connect to the database. Network Restrictions do not affect the HTTP APIs.

Pre-Requisites

  • Project Owner or Admin role

  • A list of IPv4 and IPv6 ranges that need database access

Test Plan

  1. Sign in to the Supabase Dashboard at https://supabase.com/dashboard.

  2. Select your project.

  3. Open Database in the sidebar and select Settings.

  4. Scroll to the Network Restrictions section.

  5. Verify that access is restricted to specific IP ranges and not open to all IP addresses. You can also check with the CLI: supabase network-restrictions get --project-ref <project-ref>

  6. If all IP addresses are allowed, follow the implementation steps.

Implementation Steps

  1. Sign in to the Supabase Dashboard at https://supabase.com/dashboard.

  2. Select your project.

  3. Open Database in the sidebar and select Settings.

  4. In the Network Restrictions section, add each approved IPv4 and IPv6 CIDR range and apply the changes.

  5. Alternatively, use the CLI: supabase network-restrictions update --project-ref <project-ref> --db-allow-cidr <cidr> (repeat --db-allow-cidr for each range).

  6. Confirm that approved clients can still connect.

Backout Plan

  1. Sign in to the Supabase Dashboard at https://supabase.com/dashboard.

  2. Select your project.

  3. Open Database in the sidebar and select Settings.

  4. In the Network Restrictions section, remove the restrictions so all IP addresses are allowed, and apply the changes.

  5. Alternatively, use the CLI: supabase network-restrictions update --project-ref <project-ref> --db-allow-cidr 0.0.0.0/0 --db-allow-cidr ::/0

Reference