# Ensure database network restrictions (IP allowlist) are configured

- Source: https://support.icompaas.com/support/solutions/articles/a_1790103903263281-ensure-database-network-restrictions-ip-allowlist-are-configured
- Section: [Solutions](https://support.icompaas.com/support/solutions) › [Supabase cloud](https://support.icompaas.com/support/solutions/c_1790103054038308) › [supabase checks](https://support.icompaas.com/support/solutions/folders/f_1790103067540538)
- Last updated: 2026-09-22
- Publisher: iCompaas, Inc. (https://www.icompaas.com)

**Description**

Ensure Network Restrictions are configured so that only approved IP addresses or CIDR ranges, such as office networks, VPNs, and application servers, can connect directly to the Postgres database and its connection pooler. All other IP addresses should be blocked before they reach the database.

**Rationale**

By default, the database accepts connection attempts from any IP address on the internet, protected only by the database password. This leaves it open to password guessing and makes a leaked password immediately usable from anywhere. Restricting connections to known IP ranges adds a second layer of protection that is checked before any login attempt.

**Impact**

-   Only approved IP ranges can connect to the database
    
-   Blocks attacks from unknown networks
    
-   New servers or developers must be added to the allowlist
    

**Default Value**

By default, all IP addresses are allowed to connect to the database. Network Restrictions do not affect the HTTP APIs.

**Pre-Requisites**

-   Project Owner or Admin role
    
-   A list of IPv4 and IPv6 ranges that need database access
    

**Test Plan**

1.  Sign in to the Supabase Dashboard at [https://supabase.com/dashboard](https://supabase.com/dashboard).
    
2.  Select your project.
    
3.  Open Database in the sidebar and select Settings.
    
4.  Scroll to the Network Restrictions section.
    
5.  Verify that access is restricted to specific IP ranges and not open to all IP addresses. You can also check with the CLI: supabase network-restrictions get --project-ref <project-ref>
    
6.  If all IP addresses are allowed, follow the implementation steps.
    

**Implementation Steps**

1.  Sign in to the Supabase Dashboard at [https://supabase.com/dashboard](https://supabase.com/dashboard).
    
2.  Select your project.
    
3.  Open Database in the sidebar and select Settings.
    
4.  In the Network Restrictions section, add each approved IPv4 and IPv6 CIDR range and apply the changes.
    
5.  Alternatively, use the CLI: supabase network-restrictions update --project-ref <project-ref> --db-allow-cidr <cidr> (repeat --db-allow-cidr for each range).
    
6.  Confirm that approved clients can still connect.
    

**Backout Plan**

1.  Sign in to the Supabase Dashboard at [https://supabase.com/dashboard](https://supabase.com/dashboard).
    
2.  Select your project.
    
3.  Open Database in the sidebar and select Settings.
    
4.  In the Network Restrictions section, remove the restrictions so all IP addresses are allowed, and apply the changes.
    
5.  Alternatively, use the CLI: supabase network-restrictions update --project-ref <project-ref> --db-allow-cidr 0.0.0.0/0 --db-allow-cidr ::/0
    

**Reference**

-   [https://supabase.com/docs/guides/platform/network-restrictions](https://supabase.com/docs/guides/platform/network-restrictions)

## Related compliance guidance

- [SOC 2 compliance: a practical implementation guide for cloud-native SaaS teams](https://support.icompaas.com/compliance/soc-2-trust-services-criteria): Configuration checks like this one are the technical half of a SOC 2 / ISO 27001 programme — the guide shows where they fit, what else an auditor expects, and how to evidence them.
- [ISO/IEC 27001:2022 compliance: a practical implementation guide](https://support.icompaas.com/compliance/iso-27001-2022): ISO 27001 Annex A.8 (technological controls) is where cloud hardening evidence lands; the guide shows how to run the ISMS around it.