Manage dedicated-stack network access
This guide applies to dedicated stacks (a single-tenant environment with its own VM and database). It shows how to control who can reach your environment over the internet. A shared environment does not have this setting.
Goal
Choose one of two ingress postures for your environment and request the change:
- Public: reachable from anywhere on the internet (ports 80 and 443).
- IP allowlist: reachable only over HTTPS from the network ranges you list.
Who owns what
You own the policy. The platform owns enforcement. Your environment can never change its own firewall directly. Instead, it reports the posture you request to the platform, which applies it centrally. Two rules keep this safe:
- Tightening applies automatically. Switching from public to an allowlist, or removing a range from your allowlist, takes effect within a few minutes.
- Opening access is reviewed first. Switching to public, or adding a new range, is sent to the platform operator for review before it applies.
The platform support range is always kept in your allowlist, so you cannot lock support out of your environment.
Steps
- Open Admin, Settings, Network Access.
- Pick an Access Level:
- Public to open access to the internet.
- IP allowlist to restrict access to specific networks.
- If you picked IP allowlist, enter your Allowed CIDR Ranges, one per
line. Examples:
203.0.113.0/24,198.51.100.7,2001:db8::/32. A single address is treated as a/32. You can list up to 32 ranges. - Select Save Changes.
What happens next
Your environment reports the request on its next check-in with the platform (within about a minute).
- If your change locks access down, it applies automatically.
- If your change opens access, the platform operator receives a notification and applies it after review.
Notes
- Leaving the access level blank means “no change”: the platform keeps the posture the operator last set.
- An invalid range is rejected when you save, so a typo can never strand your environment with an empty allowlist.