Network Rules & Database Access
6 min read
Overview
Every tenant has a Network tab on its detail page. It controls two directions of traffic:
- Inbound rules: which outside IP addresses can reach a service or the database directly
- Egress mode and outbound rules: which destinations your services can connect out to
Public web traffic to your services through their subdomains and custom domains is not affected by these rules.
Inbound Rules
Inbound traffic from outside the cluster to a service port or the database is blocked by default. To open it for specific addresses:
- Open the tenant and go to the Network tab
- Click to add an inbound rule
- Choose the target service (or the database) and the target port
- Choose the protocol: TCP or UDP
- Enter the source CIDRs allowed in, comma-separated (e.g.,
203.0.113.10/32, 198.51.100.0/24) - Pick when the rule expires: 1 hour, 2 hours, 24 hours, 7 days, or never
- Optionally add a description so you remember why it exists
Once created, the rule shows the allocated node port to connect to. Expired rules are marked Expired and stop allowing traffic.
Quick Database Access
Need to connect to a tenant's database from your laptop? Use Quick access from your IP. Staxa creates a rule for your current IP address that expires after 2 hours, and you can copy a ready-made connection string for your database client.
Egress Mode
Egress mode decides where services in the tenant can connect out to:
- Allow all (the default): Services can reach any address on the internet
- Restricted: Services can only reach destinations listed in your outbound rules. DNS always resolves.
Switching to Restricted asks for confirmation first, because it can break calls your services make to third-party APIs.
Outbound Rules
In Restricted mode, add an outbound rule for each destination your services need: the destination CIDRs (comma-separated), an optional destination port, and an optional description.
Plan Limits
The number of network rules per tenant depends on your plan: none on Free, 3 on Starter, 10 on Growth, and 25 on Scale.
Still have questions?
Email us and a person will answer, or look it up in the API docs.