---
title: Allowing our checkers through your firewall
description: The IP addresses to allow if your service is locked down.
category: advanced
updated: 2026-09-05
tags: [firewall, allowlist, ip, security]
---

If your service only accepts traffic from known IP addresses, add ours to your
allowlist so our checks aren't blocked. Every address below was confirmed by asking
each checker what address it actually leaves from, so this list matches what your
firewall will really see. We add addresses here before they go into use, and we'll
update this page if anything changes.

If your firewall treats IPv4 and IPv6 separately, allow both. A check that reaches
you over IPv6 can be blocked even though you allowed our IPv4.

## All checker IPs

Allow every address below to keep your monitors working no matter which check region
you pick.

**IPv4**

```text
209.71.96.111
209.71.96.171
209.71.84.131
209.71.91.177
209.71.76.244
209.71.87.219
209.71.102.240
209.71.103.197
209.71.69.199
209.71.64.49
209.71.64.175
209.71.86.215
209.71.80.100
209.71.95.169
209.71.88.95
152.55.176.240
152.55.177.181
162.220.232.250
162.220.232.252
152.55.184.240
208.77.244.241
208.77.244.242
208.77.246.240
208.77.246.241
208.77.246.242
143.244.201.212
209.38.4.189
64.225.81.240
139.59.195.199
162.220.232.251
```

Every address above is reserved for us. Some of our services have more than one,
and which one a given check or email leaves from can vary between them — so allow
the whole list rather than the one address you happen to see in your logs.

**IPv6**

```text
2a09:8280:e633:1:0:14a:3368:0
2a09:8280:e633:1:0:14a:3368:1
2a09:8280:e621:1:0:14a:3368:0
2a09:8280:e621:1:0:14a:3368:1
2a09:8280:e609:1:0:14a:3368:0
2a09:8280:e609:1:0:14a:3368:1
2a09:8280:e618::13f:445c:0
2a09:8280:e618::13f:445c:1
2a09:8280:e610:1:0:13f:445c:0
2a09:8280:e601::13f:4464:0
2a09:8280:e601::13f:4464:1
2a09:8280:e607:1:0:13f:4464:0
2a09:8280:e632::13f:7e34:0
2a09:8280:e632::13f:7e34:1
2a09:8280:e625::13f:7e34:0
2600:1f1c:1d1:8201:dea5:e185:2979:b88d
2600:1900:4090:6c8:0:118::
2607:99c0:a00:189::1
2607:99c0:300:56::1
2604:a880:400:d1:0:4:bd7d:a001
2604:a880:4:1d0:0:3:2aa5:6000
2a03:b0c0:2:f0:0:1:ccc3:d001
2400:6180:0:d2:0:3:922:9000
```

## Allow just one region

If you'd rather only allow the region a monitor checks from, use the matching list
below. Keep the monitor pinned to that same region so it's never checked from an
address you haven't allowed.

One address in the full list is not tied to a region: `162.220.232.251` belongs to a
set our platform services share, so allow it alongside whichever regional list you
use.

### US West

**IPv4** — `209.71.96.111`, `209.71.96.171`, `209.71.84.131`, `209.71.91.177`,
`209.71.76.244`, `209.71.87.219`, `152.55.176.240`, `209.38.4.189`

**IPv6** — `2a09:8280:e633:1:0:14a:3368:0`, `2a09:8280:e633:1:0:14a:3368:1`,
`2a09:8280:e621:1:0:14a:3368:0`, `2a09:8280:e621:1:0:14a:3368:1`,
`2a09:8280:e609:1:0:14a:3368:0`, `2a09:8280:e609:1:0:14a:3368:1`,
`2600:1f1c:1d1:8201:dea5:e185:2979:b88d`, `2604:a880:4:1d0:0:3:2aa5:6000`

### US East

**IPv4** — `209.71.102.240`, `209.71.103.197`, `209.71.69.199`,
`152.55.177.181`, `162.220.232.250`, `162.220.232.252`,
`143.244.201.212`

**IPv6** — `2a09:8280:e618::13f:445c:0`, `2a09:8280:e618::13f:445c:1`,
`2a09:8280:e610:1:0:13f:445c:0`,
`2600:1900:4090:6c8:0:118::`, `2604:a880:400:d1:0:4:bd7d:a001`

### Europe

**IPv4** — `209.71.64.49`, `209.71.64.175`, `209.71.86.215`,
`208.77.244.241`, `208.77.244.242`, `152.55.184.240`,
`64.225.81.240`

**IPv6** — `2a09:8280:e601::13f:4464:0`, `2a09:8280:e601::13f:4464:1`,
`2a09:8280:e607:1:0:13f:4464:0`,
`2607:99c0:a00:189::1`, `2a03:b0c0:2:f0:0:1:ccc3:d001`

### Asia-Pacific

**IPv4** — `209.71.80.100`, `209.71.95.169`, `209.71.88.95`, `208.77.246.240`,
`208.77.246.241`, `208.77.246.242`, `139.59.195.199`

**IPv6** — `2a09:8280:e632::13f:7e34:0`, `2a09:8280:e632::13f:7e34:1`,
`2a09:8280:e625::13f:7e34:0`, `2607:99c0:300:56::1`,
`2400:6180:0:d2:0:3:922:9000`

## A note on rate limits

An allowlist isn't the only thing that can block a check. Some firewalls and
intrusion-detection systems temporarily ban an address that connects very
frequently. If a monitor flaps even though the port is open, check whether something
between us and your service is rate-limiting connections, and exempt our IPs if so.

## Get started
- [Choose a check region](/docs/configuration/check-regions)
- [Set a sensible check interval](/docs/configuration/check-intervals)

## Related
- [TCP & UDP port monitors](/docs/monitors/tcp-udp)
- [HTTP / website monitors](/docs/monitors/http)
- [Choose IPv4 or IPv6 for a monitor](/docs/configuration/ip-version)