--- title: "IP allowlists for inbound and outbound traffic" slug: "ip-allowlists-for-inbound-and-outbound-traffic" abstract: "Provides a list of Network Address Translation (NAT) gateway IP addresses to allow for outbound and inbound traffic when sending and receiving data from Sitecore CDP." --- # IP allowlists for inbound and outbound traffic IP allowlisting enables a secure way for your organization's systems to send and receive data from Sitecore CDP. You can use this topic to access a list of Network Address Translation (NAT) gateway IP addresses to add to an allowlist for outbound and inbound traffic. ## Outbound traffic IP allowlist This section provides a list of IP addresses to add to the allowlist for each region. For each region, a table contains hosting types for Production Virtual Private Cloud (VPC) and Amazon Elastic Kubernetes Service (EKS) VPC. The Amazon S3 buckets section provides a list of AWS IP address ranges to add to the allowlist for the Batch API. ### IP allowlist eu-west-1 region (Ireland) Here are the NAT gateway IP addresses to add to the allowlist for outbound traffic from the eu-west-1 region: | VPC | NAT gateway IPs | | --- | --- | | Production VPC | | | Amazon EKS VPC | | sidebar. Amazon S3 buckets > [!note] > IP address ranges for Amazon AWS S3 buckets might change. To keep your allowlist up to date, we recommend that you regularly check for changes, for example, by subscribing to [AWS IP address ranges notifications](https://docs.aws.amazon.com/vpc/latest/userguide/subscribe-notifications.html). For Amazon AWS S3 buckets in eu-west-1 region, you must also add the following IP addresses to the allowlist: - 3.5.72.0/23 - 52.218.0.0/17 - 3.5.64.0/21 - 52.92.0.0/17 - 3.251.110.208/28 - 3.251.110.224/28 ### IP allowlist us-east-1 region (North Virginia) Here are the NAT gateway IP addresses to add to the allowlist for outbound traffic from the us-east-1 region: | VPC | NAT gateway IPs | | --- | --- | | Production VPC | | | Amazon EKS VPC | | sidebar. Amazon S3 buckets > [!note] > IP address ranges for Amazon AWS S3 buckets might change. To keep your allowlist up to date, we recommend that you regularly check for changes, for example, by subscribing to [AWS IP address ranges notifications](https://docs.aws.amazon.com/vpc/latest/userguide/subscribe-notifications.html). For Amazon AWS S3 buckets in us-east-1 region, you must also add the following IP addresses to the allowlist: - 18.34.0.0/19 - 16.15.192.0/18 - 54.231.0.0/16 - 52.216.0.0/15 - 18.34.232.0/21 - 16.15.176.0/20 - 16.182.0.0/16 - 3.5.0.0/19 - 44.192.134.240/28 - 44.192.140.64/28 ### IP allowlist ap-southeast-2 region (Sydney) Here are the NAT gateway IP addresses to add to the allowlist for outbound traffic from the ap-southeast-2 region: | VPC | NAT gateway IPs | | --- | --- | | Production VPC | | | Amazon EKS VPC | | sidebar. Amazon S3 buckets > [!note] > IP address ranges for Amazon AWS S3 buckets might change. To keep your allowlist up to date, we recommend that you regularly check for changes, for example, by subscribing to [AWS IP address ranges notifications](https://docs.aws.amazon.com/vpc/latest/userguide/subscribe-notifications.html). For Amazon AWS S3 buckets in ap-southeast-2 region, you must also add the following IP addresses to the allowlist: - 52.95.128.0/21 - 16.12.74.0/24 - 3.5.164.0/22 - 3.5.168.0/23 - 3.26.88.0/28 - 3.26.88.16/28 ### IP allowlist ap-northeast-1 region (Tokyo) Here are the NAT gateway IP addresses to add to the allowlist for outbound traffic from the ap-northeast-1 region: | VPC | NAT gateway IPs | | --- | --- | | Production VPC | | | Amazon EKS VPC | | sidebar. Amazon S3 buckets > [!note] > IP address ranges for Amazon AWS S3 buckets might change. To keep your allowlist up to date, we recommend that you regularly check for changes, for example, by subscribing to [AWS IP address ranges notifications](https://docs.aws.amazon.com/vpc/latest/userguide/subscribe-notifications.html). For Amazon AWS S3 buckets in ap-northeast-1 region, you must also add the following IP addresses to the allowlist: - 52.219.68.0/22 - 52.219.162.0/23 - 52.219.16.0/22 - 52.219.195.0/24 - 3.5.152.0/21 - 52.219.0.0/20 - 52.219.20.0/24 - 52.219.136.0/22 - 52.219.201.0/24 - 52.219.172.0/22 - 52.219.200.0/24 - 52.219.152.0/22 - 52.219.150.0/23 - 52.219.196.0/22 - 35.72.164.240/28 - 35.73.115.0/28 ## Inbound traffic IP allowlist You can add the specified static IP address for your organization's environment region to an allowlist to ensure a safe and static connection when receiving responses from the Sitecore CDP Batch API, REST API and other connections. To find the environment, in Sitecore CDP, on the navigation pane, click ![cdp_gear_icon.png](https://doc.sitecore.com/api/markdown-image/cdp/en/developers/api/images/cdp_gear_icon.png) > **Company information** > **Environment**. Here are the inbound traffic IP addresses to add to the allowlist: | Environment | IP address | | --- | --- | | **AP Region** | | | **EU Region** | | | **US Region** | | | **JPE Region** | |