> ## Documentation Index
> Fetch the complete documentation index at: https://clickhouse.com/docs/llms.txt
> Use this file to discover all available pages before exploring further.

# Setting IP filters

> This page explains how to set IP filters in ClickHouse Cloud to control access to ClickHouse services.

export const Image = ({img, alt, size = "lg", background}) => {
  const normalizedSize = ["sm", "md", "lg"].includes(size) ? size : "lg";
  const backgroundColor = background === "white" ? "white" : background === "black" ? "rgb(31 31 28)" : undefined;
  return <div className={`ch-image-${normalizedSize}`}>
      <Frame>
        <img src={img} alt={alt} style={{
    backgroundColor
  }} />
      </Frame>
    </div>;
};

<h2 id="setting-ip-filters">
  Setting IP filters
</h2>

IP access lists filter traffic to ClickHouse services or API keys by specifying which source addresses are permitted to connect.  These lists are configurable for each service and each API key.  Lists can be configured during service or API key creation, or afterward.

<Warning>
  **Configure the IP access list for your service**

  When you create a ClickHouse Cloud service, the default setting for the IP allow list is 'Allow from anywhere.' We strongly recommend restricting access to specific IP addresses or ranges as soon as possible. Services set to `Allow from anywhere` may be periodically moved from an idle to an active state by internet crawlers and scanners that look for public IPs, which may result in unexpected costs.
</Warning>

<h2 id="prepare">
  Prepare
</h2>

Before you begin, collect the IP addresses or ranges that should be added to the access list.  Take into consideration remote workers, on-call locations, VPNs, etc. The IP access list user interface accepts individual addresses and CIDR notation.

Classless Inter-domain Routing (CIDR) notation, allows you to specify IP address ranges smaller than the traditional Class A, B, or C (8, 6, or 24) subnet mask sizes. [ARIN](https://account.arin.net/public/cidrCalculator) and several other organizations provide CIDR calculators if you need one, and if you would like more information on CIDR notation, please see the [Classless Inter-domain Routing (CIDR)](https://www.rfc-editor.org/rfc/rfc4632.html) RFC.

<h2 id="create-or-modify-an-ip-access-list">
  Create or modify an IP access list
</h2>

<Info>
  **Applicable only to connections outside of PrivateLink**

  IP access lists only apply to connections from the public internet, outside of [PrivateLink](/docs/products/cloud/guides/security/connectivity/private-networking/index).
  If you only want traffic from PrivateLink, set `DenyAll` in IP Allow list.
</Info>

<Accordion title="IP access list for ClickHouse services">
  When you create a ClickHouse service, the default setting for the IP allow list is 'Allow from anywhere.'

  From your ClickHouse Cloud services list select the service and then select **Settings**.  Under the **Security** section, you will find the IP access list. Click on the Add IPs button.

  A sidebar will appear with options for you to configure:

  * Allow incoming traffic from anywhere to the service
  * Allow access from specific locations to the service
  * Deny all access to the service
</Accordion>

<Accordion title="IP access list for API keys">
  When you create an API key, the default setting for the IP allow list is 'Allow from anywhere.'

  From the API key list, click the three dots next to the API key under the **Actions** column and select **Edit**. At the bottom of the screen you will find the IP access list and options to configure:

  * Allow incoming traffic from anywhere to the service
  * Allow access from specific locations to the service
  * Deny all access to the service
</Accordion>

This screenshot shows an access list which allows traffic from a range of IP addresses, described as "NY Office range":

<Image img="https://mintcdn.com/private-7c7dfe99/zhhfCE__w-UVvpQP/images/cloud/security/ip-filtering-after-provisioning.webp?fit=max&auto=format&n=zhhfCE__w-UVvpQP&q=85&s=879b24b7e5b44996f0cac9c9cb591268" size="md" alt="Existing access list in ClickHouse Cloud" border width="588" height="492" data-path="images/cloud/security/ip-filtering-after-provisioning.webp" />

<h3 id="possible-actions">
  Possible actions
</h3>

1. To add an additional entry you can use **+ Add new IP**

This example adds a single IP address, with a description of `London server`:

<Image img="https://mintcdn.com/private-7c7dfe99/zhhfCE__w-UVvpQP/images/cloud/security/ip-filter-add-single-ip.webp?fit=max&auto=format&n=zhhfCE__w-UVvpQP&q=85&s=12979e30982b10100751051d682bf6d2" size="md" alt="Adding a single IP to the access list in ClickHouse Cloud" border width="591" height="495" data-path="images/cloud/security/ip-filter-add-single-ip.webp" />

2. Delete an existing entry

Clicking the cross (x) can deletes an entry

3. Edit an existing entry

Directly modifying the entry

4. Switch to allow access from **Anywhere**

This isn't recommended, but it is allowed.  We recommend that you expose an application built on top of ClickHouse to the public and restrict access to the back-end ClickHouse Cloud service.

To apply the changes you made, you must click **Save**.

<h2 id="verification">
  Verification
</h2>

Once you create your filter confirm connectivity to a service from within the range, and confirm that connections from outside the permitted range are denied.  A simple `curl` command can be used to verify:

```bash title="Attempt rejected from outside the allow list" theme={null}
curl https://<HOSTNAME>.clickhouse.cloud:8443
```

```response theme={null}
curl: (35) error:02FFF036:system library:func(4095):Connection reset by peer
```

or

```response theme={null}
curl: (35) LibreSSL SSL_connect: SSL_ERROR_SYSCALL in connection to HOSTNAME.clickhouse.cloud:8443
```

```bash title="Attempt permitted from inside the allow list" theme={null}
curl https://<HOSTNAME>.clickhouse.cloud:8443
```

```response theme={null}
Ok.
```

<h2 id="limitations">
  Limitations
</h2>

* Currently, IP access lists support only IPv4