Skip to main content
When you use Hosted mode, Zwiron connects to your source and destination from its cloud infrastructure. If your database firewall only allows known IPs (Cloud SQL Authorized Networks, RDS security groups, Azure SQL firewall, etc.), you must allowlist Zwiron’s static outbound IPs. Agent mode does not use these IPs — the connection comes from your agent machine instead. See Install the Agent.

​
Do I need to whitelist every IP?

Yes. Whitelist all unique IPs in the table below. Zwiron runs High Availability egress. Outbound traffic can leave from any listed address. If you allow only some of them:
  • Test Connection may pass (Atlas IP) but jobs fail (worker IP), or
  • Connections work sometimes and fail other times as traffic shifts across HA IPs
One IP appears on both the API and worker gateways — add it once. You still need every unique address.

​
Hosted static egress IPs

Cloud SQL (and most cloud firewalls) label this field IP range and require CIDR notation. That does not mean you must open a whole subnet. For a single host, append /32:
Add five separate authorized networks — one per IP above — each named clearly (e.g. zwiron-atlas-1, zwiron-worker-2).
These IPs are for outbound connections from Zwiron to your database. They are not used for inbound traffic to Zwiron.

​
What each service needs

Whitelist the full set so both testing and production syncs succeed.

​
Google Cloud SQL

Private IP alone does not work for Hosted mode. Private IP is only reachable inside your GCP VPC. Railway / Zwiron Hosted is outside that VPC. Use this setup instead:
  1. Keep Public IP enabled on the Cloud SQL instance
  2. Open Connections → Networking → Authorized Networks
  3. Click Add a network once per IP
  4. Name: e.g. zwiron-api-1
  5. Network / IP range: x.x.x.x/32 (CIDR — /32 = that single IP only)
  6. Click Done, then repeat for the other four IPs
  7. Save the instance and wait 1–2 minutes for the update
  8. Retry Test Connection in Zwiron
Do not click Use My IP — that would whitelist your laptop, not Zwiron. Connection string format:
URL-encode special characters in the password before pasting a full URI (@, %, :, /, ?, #, \, etc.). See MySQL connection strings for the full encoding table. Or enter user and password in the separate form fields and skip encoding.

​
Agent mode (alternative)

If the database must stay private (no public IP), use Agent mode:
  1. Deploy a Zwiron Agent where it can reach the database
  2. Whitelist the agent machine’s egress IP (not the table above), or use private networking inside your VPC
  3. Select that agent when creating the connection

​
Common errors

Last modified on July 13, 2026