Manage database IP access lists

By default, Astra DB databases don’t restrict public access. This means databases allow connection attempts from any public IP address. However, you can use the database’s IP access list to allow only client connections from trusted IP addresses. If configured, your database automatically denies any connection attempts to and from an IP not included in the list.

Restricting public access doesn’t affect private endpoint connections. However, DataStax recommends restricting public access to ensure that your database is available only through private endpoints and allowed IPs.

Prerequisites

Restrict public access to a database

When you restrict public access, your database becomes inaccessible to all internet traffic. This can disrupt any applications that depend on a connection to your database, including viewing the database from your own machine.

To prevent downtime, promptly add approved IP addresses or CIDR blocks to the access list. Until you add entries to the access list, no external connections to your database are allowed.

To restrict public access to a database, do the following:

  1. In the Astra Portal navigation menu, select your database.

    Each database has one IP access list. For multi-region databases, this access list applies to every region for that database.

  2. Click the Settings tab.

  3. In the IP Access List section, enable Restrict public access.

  4. In the confirmation dialog, click Restrict Public Access.

Next, add IP access list entries.

Add IP access list entries

After you Restrict public access to a database, create a list of allowed IP addresses or CIDR blocks that can access the database. Each entry can be a single IPv4 address, address space, or a CIDR block.

Using CIDR notation

A CIDR range indicates a range of IP addresses. For example, the CIDR range 192.168.0.0/16 represents the first IP address of 192.168.0.0 through the last IP address of 192.168.255.255. The /16 mask indicates that the first 16 bits of the IP address are static. The addresses in the CIDR range are represented by all the permutations of the last 16 bits.

Multiple tools are available online to help you convert a range of IP addresses to CIDR.

Each database has its own IP access list. When you add entries, make sure you add them to all applicable databases. For a multi-region database, all of the database’s regions share the same access list.

In the Astra Portal, you can add individual access list entries, import multiple entries from a file, or copy entries from another database.

Importing entries from a file or another database overrides any existing access list entries.

  1. In the Astra Portal navigation menu, select your database.

  2. Click the Settings tab.

  3. In the IP Access List section, click Add Access, and then select Add IP Address.

  4. Enter the IP address or CIDR-notated range of IP addresses that you want to be able to access your database. The Current IP Address field shows the IP address you are currently using to access the Astra Portal. You can click Copy to automatically paste this address into the IP Address or CIDR field.

  5. Optional: Enter a description for the access list entry.

  6. Click Add Address.

Test the connection and restart applications

After you add or edit IP access list entries, restart any applications, including clients and drivers, that depend on a connection to your database. DataStax recommends testing IP access list changes in a development environment before applying them in production.

The database might take a few minutes to recognize new IP access list entries. Wait a few minutes before you attempt to connect to your database from the new IP address.

Edit IP access list entries

  1. In the Astra Portal navigation menu, select your database.

  2. Click the Settings tab.

  3. In the IP Access List section, find the entry you want to edit, click More, and then select Edit.

    If you want to overwrite all entries, see Add IP access list entries for import and copy options.

  4. In the Add Access dialog, you can edit the Description.

  5. Click Update Address to save your changes.

  6. Test the connection and restart applications, if necessary.

Disable or delete IP access list entries

When you delete an IP access list entry, it can take a few minutes for your database to reject new traffic from that address. Existing connections can remain open for an indefinite amount of time, depending on application behavior and how the connection was established.

  1. In the Astra Portal navigation menu, select your database.

  2. Click the Settings tab.

  3. In the IP Access List section, find the entry you want to disable or delete, click More, and then select either Disable or Delete.

  4. In the confirmation dialog, click Disable or Delete.

See also

Was this helpful?

Give Feedback

How can we improve the documentation?

© 2025 DataStax | Privacy policy | Terms of use | Manage Privacy Choices

Apache, Apache Cassandra, Cassandra, Apache Tomcat, Tomcat, Apache Lucene, Apache Solr, Apache Hadoop, Hadoop, Apache Pulsar, Pulsar, Apache Spark, Spark, Apache TinkerPop, TinkerPop, Apache Kafka and Kafka are either registered trademarks or trademarks of the Apache Software Foundation or its subsidiaries in Canada, the United States and/or other countries. Kubernetes is the registered trademark of the Linux Foundation.

General Inquiries: +1 (650) 389-6000, info@datastax.com