> ## Documentation Index
> Fetch the complete documentation index at: https://docs.zwiron.com/llms.txt
> Use this file to discover all available pages before exploring further.

# Network Access & Egress IPs

> Allowlist Zwiron static egress IPs for Hosted mode firewall access to Cloud SQL, RDS, and Azure SQL.

When you use **Hosted mode**, Zwiron connects to your source and destination from its cloud infrastructure. If your database firewall only allows known IPs (Cloud SQL Authorized Networks, RDS security groups, Azure SQL firewall, etc.), you must allowlist Zwiron's **static outbound IPs**.

**Agent mode** does not use these IPs — the connection comes from your agent machine instead. See [Install the Agent](/getting-started/install-agent).

***

## Do I need to whitelist every IP?

**Yes.** Whitelist **all** unique IPs in the table below.

Zwiron runs High Availability egress. Outbound traffic can leave from **any** listed address. If you allow only some of them:

* **Test Connection** may pass (Atlas IP) but **jobs fail** (worker IP), or
* Connections work sometimes and fail other times as traffic shifts across HA IPs

One IP appears on both the API and worker gateways — add it once. You still need every **unique** address.

***

## Hosted static egress IPs

| IP                | Notes                   |
| ----------------- | ----------------------- |
| `162.220.234.240` | Shared by API + workers |
| `162.220.234.241` | API (Atlas)             |
| `162.220.234.242` | Workers                 |
| `152.55.180.240`  | API (Atlas)             |
| `152.55.180.241`  | Workers                 |

Cloud SQL (and most cloud firewalls) label this field **IP range** and require **CIDR notation**. That does **not** mean you must open a whole subnet.

For a single host, append `/32`:

```text theme={null}
162.220.234.240/32
```

| CIDR                 | Meaning                                                |
| -------------------- | ------------------------------------------------------ |
| `162.220.234.240/32` | Only this one IP (correct for Zwiron)                  |
| `162.220.234.0/24`   | Entire /24 block — **do not use** unless you intend to |

Add **five separate** authorized networks — one per IP above — each named clearly (e.g. `zwiron-atlas-1`, `zwiron-worker-2`).

<Info>
  These IPs are for **outbound** connections from Zwiron to your database. They are not used for inbound traffic to Zwiron.
</Info>

***

## What each service needs

| Action                                 | Originates from |
| -------------------------------------- | --------------- |
| **Test Connection** (Hosted, no agent) | API (Atlas)     |
| **Sync jobs** (Hosted)                 | Workers         |

Whitelist the full set so both testing and production syncs succeed.

***

## Google Cloud SQL

Private IP alone **does not** work for Hosted mode. Private IP is only reachable inside your GCP VPC. Railway / Zwiron Hosted is outside that VPC.

Use this setup instead:

1. Keep **Public IP** enabled on the Cloud SQL instance
2. Open **Connections → Networking → Authorized Networks**
3. Click **Add a network** once per IP
4. **Name:** e.g. `zwiron-api-1`
5. **Network / IP range:** `x.x.x.x/32` (CIDR — `/32` = that single IP only)
6. Click **Done**, then repeat for the other four IPs
7. Save the instance and wait 1–2 minutes for the update
8. Retry **Test Connection** in Zwiron

Do not click **Use My IP** — that would whitelist *your laptop*, not Zwiron.

Connection string format:

```text theme={null}
mysql://USER:PASSWORD@PUBLIC_IP:3306/DATABASE
```

```text theme={null}
postgres://USER:PASSWORD@PUBLIC_IP:5432/DATABASE
```

**URL-encode special characters in the password** before pasting a full URI (`@`, `%`, `:`, `/`, `?`, `#`, `\`, etc.). See [MySQL connection strings](/connectors/databases/mysql#passwords-with-special-characters) for the full encoding table. Or enter user and password in the separate form fields and skip encoding.

***

## Agent mode (alternative)

If the database must stay private (no public IP), use **Agent mode**:

1. Deploy a [Zwiron Agent](/getting-started/install-agent) where it can reach the database
2. Whitelist the **agent machine's** egress IP (not the table above), or use private networking inside your VPC
3. Select that agent when creating the connection

***

## Common errors

| Error                                                      | Likely cause                                                          |
| ---------------------------------------------------------- | --------------------------------------------------------------------- |
| `Connection failed. The request did not reach the server.` | Missing Authorized Network / security group rule                      |
| `Access denied for user ... (using password: YES)`         | User missing in cloud console, or wrong password                      |
| `this user requires clear text authentication`             | TLS not established — use `skip-verify` for Cloud SQL / managed MySQL |
| Test works, job fails                                      | Atlas IPs allowed, worker IPs missing                                 |
| Intermittent failures                                      | Only some HA IPs allowlisted                                          |

***

## Related

* [Execution modes](/concepts/execution-modes)
* [Create a connection](/getting-started/create-connection)
* [MySQL](/connectors/databases/mysql)
* [PostgreSQL](/connectors/databases/postgres)