---
title: "Control network access to a database"
description: "Choose which IPv4 addresses can reach a TIR DBaaS database's public endpoint, and attach the database to a VPC for private connections."
content_type: "how-to"
product: "tir-dbaas"
platform: "TIR"
url: "/tir/tir-dbaas/how-to/control-network-access/"
topic: ["network"]
---

# Control network access to a database

Applications connect to a TIR DBaaS database over its public endpoint, from the addresses in its IP
allowlist. They can also connect privately from inside a VPC the database is attached to. You set
both in **Network & Security** when you create the database, and change them later from **Edit**.

## Before you begin

- The public IPv4 addresses or CIDR ranges your applications and your own computer connect from.
- (Optional) An **Active** VPC in the project with at least one free IP address, for private
  connections. To make one, see [Create a VPC](/tir/tir-vpc/how-to/create-a-vpc/).
- The DBaaS create permission to set access on a new database, or the update permission to change
  it on an existing one. See [TIR Access Control](/tir/tir-iam/).
- A database in the **Running** state, if you are changing an existing one.

## How the IP allowlist works

Only the addresses in the IP allowlist can reach the database's public endpoint. A database needs at
least one range to be created or updated. The public
endpoint opens once the database is **Running**, and **Public Endpoint** on the **Overview** tab
then has the address and port your applications connect to.

The allowlist holds up to 50 ranges, IPv4 only. Each range can have a description of up to 63
characters. The allowlist covers the public endpoint only; connections from inside an attached VPC bypass it.

## Add IP ranges

In **Network & Security**, under **IP Allowlist**:

1. To allow the computer you are using now, select **Add my IP**. It adds your public IPv4 address
   as a /32 range. If TIR cannot detect your address, type it in yourself.
2. To allow another address or range, type an IPv4 address or CIDR range, such as `203.0.113.0/24`.
   (Optional) Enter a description that says what the range is for. Then select **Add**, or press
   Enter.
3. Repeat for each range. To take a range out, select the remove button on its row.

A single address is stored as a /32 range. A range typed with host bits set, such as
`203.0.113.5/24`, is stored as its network, `203.0.113.0/24`. Each range can be in the list only
once.

Add each range before you save; a range left typed in the box stops the save until you add it or
clear the box.

### Allow any address

**Allow from anywhere** adds `0.0.0.0/0`, which lets any IPv4 address reach the public endpoint. Use `0.0.0.0/0` only for short-lived testing, and replace
it with the ranges you need as soon as you know them. While it is in the list, the database is
**Open to any IPv4 address**.

## Attach the database to a VPC

Attach a VPC when your applications run on VMs or services inside that VPC. They then connect to
the database's private address and their traffic stays off the internet.

1. In **Network & Security**, under **VPC**, choose an **Active** VPC that has at least one free
   address.
2. To make a new VPC from here, select **Click here**. When the VPC is **Active**, refresh the VPC
   list and choose it.

On a new database, TIR attaches the VPC once the database turns **Running**. **Private Endpoint** on the
**Overview** tab then shows its address on the VPC. While the VPC is attaching or detaching, there
is no address there yet.

To connect from inside the VPC, choose **Inside the VPC** on the **Connect** tab. The connection
strings then use the private address. See [Connect to a
database](/tir/tir-dbaas/how-to/connect-to-a-database/).

## Change access on an existing database

You can change the allowlist and the VPC while the database is **Running**.

1. Open **Edit Database** in one of these ways:
   - On the **Overview** tab, select **Edit** beside **IP Allowlist**.
   - Choose **Edit** in the database's row menu on the list, or in the three-dot menu on its
     details page.
2. Add or remove IP ranges, or choose another VPC, the same way as when you create a
   database.
3. Select **Update Database**.

Changing the VPC restarts the database, so you confirm the restart before the change is saved. Open connections are dropped, and applications need to reconnect once the database
is back. Changing the allowlist alone keeps the database running.

Each allowlist change is recorded on **Activity Timeline** as "IP allowlist updated", with how many
address ranges are now allowed.

## Check who can connect

On the **Overview** tab, **IP Allowlist** gives how many ranges are allowed, and **Public Endpoint**
the address to connect to. On the **Connect** tab, with **Public internet** chosen, TIR says who the
public endpoint accepts.

Next, connect with the details on the **Connect** tab. See [Connect to a
database](/tir/tir-dbaas/how-to/connect-to-a-database/). For help with a connection that is refused,
see [Troubleshooting TIR DBaaS](/tir/tir-dbaas/troubleshooting/tir-dbaas/).