Configure network access and firewall

Enable an external endpointCopy Anchor Link

1. Open Connectivity on the memory database.
2. Select Enable domain.
3. Wait for the managed hostname to appear.
4. Open Connection and use the External TLS endpoint to test a connection.

To keep the instance private again, select Disable domain. Private project-network connectivity uses its own endpoint. Do not assume that disabling a public route immediately terminates every established client session.

Configure the IP allowlistCopy Anchor Link

1. Open Firewall Policy.
2. Enable Enable IP allowlist.
3. Add the public addresses or CIDR ranges that should reach the database, including your own client or outbound gateway address.
4. Optionally label entries and select Save changes.
5. Allow routing changes to apply, then test a connection from an allowed address.

Up to 32 entries are supported. A single IPv4 address uses /32; a single IPv6 address uses /128. Enabling the policy requires at least one valid entry or the internal gateway option below.

The database policy restricts the public TCP endpoint. Blocked connections close without an HTTP error page; this is not a web application firewall.

Disabling the policy removes the saved IP list and clears the internal gateway option. Copy entries you intend to reuse before turning it off.

Allow connections via the RDC internal gatewayCopy Anchor Link

While the IP allowlist is enabled, you can select Allow connections via RDC internal gateway and save. This option starts off and can be used alone or alongside your named IP rules; it does not consume one of the 32 entries.

Connections sharing that gateway address are allowed together. This does not identify an individual client or limit permission to your workspace. Database credentials are still required.

If the option is unavailable, contact support with the resource ID. If a previously saved gateway permission becomes unavailable, public access is blocked until it is restored or you remove that permission and save valid IP rules. Disabling the entire policy allows all source addresses to the enabled public endpoint.

Test policy changes using a new connection. Existing sessions may remain connected.