Do I need to whitelist every IP?
Yes. Whitelist all IPs in the list below. Zwiron uses multiple outbound addresses for high availability. Traffic can leave from any of them. If you allow only some:- Test Connection may pass but sync jobs fail, or
- Connections work sometimes and fail other times
Hosted static egress IPs
Add each of these as a separate allowlist entry:
Cloud SQL (and most cloud firewalls) label this field IP range and require CIDR notation. That does not mean you must open a whole subnet.
For a single host, append
/32:
Add five separate authorized networks — one per IP above — each named clearly (e.g.
zwiron-1, zwiron-2).
These IPs are for outbound connections from Zwiron to your database. They are not used for inbound traffic to Zwiron.
Google Cloud SQL
Private IP alone does not work for Hosted mode. Private IP is only reachable inside your GCP VPC. Zwiron Hosted is outside that VPC. Use this setup instead:- Keep Public IP enabled on the Cloud SQL instance
- Open Connections → Networking → Authorized Networks
- Click Add a network once per IP
- Name: e.g.
zwiron-1 - Network / IP range:
x.x.x.x/32(CIDR —/32= that single IP only) - Click Done, then repeat for the other four IPs
- Save the instance and wait 1–2 minutes for the update
- Retry Test Connection in Zwiron
@, /, ?, or #, encode those characters in the URI (%40, %2F, %3F, %23). Other special characters are fine unencoded.
Agent mode (alternative)
If the database must stay private (no public IP), use Agent mode:- Deploy a Zwiron Agent where it can reach the database
- Whitelist the agent machine’s egress IP (not the table above), or use private networking inside your VPC
- Select that agent when creating the connection