Firewall
Restrict public database access to an allow-list of IP addresses you control.
The firewall is an allow-list for a database's public port. With no rules added, a public database is reachable from anywhere; adding even one rule switches it to allow-list mode — only listed addresses get through.
Adding a rule
- Open the database and go to Firewall.
- Add an IP address (or a CIDR range for a block of addresses) — your office network, your CI runner, a teammate's connection.
- It applies immediately. No restart, no propagation delay.
What "blocked" actually means
An address that isn't on the list never completes a connection to the database engine — it's refused at the network layer, not logged in and then rejected by a permissions check. There's no way to fingerprint or probe the database from an unlisted address.
Removing a rule
Remove it the same way you added it — takes effect immediately, same as adding one.
Combining with public access
Firewall rules only matter once public access is on. If public access is off, the database already isn't reachable from outside your private network, and firewall rules have nothing to restrict.