Get a Static IP Address for Allowlisting

How to Get a Static IP for Allowlisting

To get a static IP for allowlisting, send the tool that needs access through a static proxy: the service then always sees the proxy's address, wherever you are and whatever your own connection does. Order one address, add it to the allowlist, and set the proxy in that tool alone, as shown below for curl, browsers, git and SSH. If every app on a device must use the fixed address, a VPN to your own server is the better fit.

1. Find the Address to Allow

Your proxy line looks like 198.51.100.42:PORT:USER:PASS; the first part is the address to give the service. Confirm it is what sites see:

curl -x http://USER:[email protected]:PORT https://api.ipify.org; echo

Then add that address, as a single address or /32, to the allowlist: the vendor's portal, your firewall or the admin panel's security settings.

2. Command Line and APIs

export HTTPS_PROXY=http://USER:[email protected]:PORT
curl https://api.vendor.example/v1/status

Most tools and SDKs read HTTPS_PROXY (and HTTP_PROXY). Set it only in the shell or service that needs the fixed address, so nothing else goes through the proxy. For git over HTTPS, set it for one host only:

git config --global http.https://git.vendor.example/.proxy http://USER:[email protected]:PORT

3. A Browser Profile for the Admin Panel

Use a separate browser profile so only the allowlisted site goes through the proxy. In Firefox, open the profile's Settings, then Network Settings, choose Manual proxy configuration and enter the address and HTTP port; it asks for the username and password on first use. In Chrome or Edge, start a separate profile with --proxy-server=http://198.51.100.42:PORT and enter the login when prompted. How to set up a proxy has the full steps.

4. SSH and Other TCP Connections

OpenSSH can reach a server through a SOCKS5 proxy with a ProxyCommand. This uses ncat from the Nmap project, which supports a SOCKS5 login:

# ~/.ssh/config
Host vendor-sftp
  HostName sftp.vendor.example
  User youruser
  ProxyCommand ncat --proxy 198.51.100.42:SPORT --proxy-type socks5 --proxy-auth USER:PASS %h %p

We have tested web traffic through our proxies, not every port, so check this connection works before you depend on it. Database clients and SFTP apps with a SOCKS5 setting work the same way.

Keep It Locked Down

Anyone with the proxy login reaches the service from your allowlisted address. Keep it in a password manager or secrets store.
Allowlisting is a second lock, not the only one: keep passwords, keys and two-factor sign-in on the service too.
Only use it for services you are authorized to reach. Using a proxy to get past an allowlist or block meant to keep you out breaks our Acceptable Use Policy.

Comparing options? Proxy vs VPN explains when each one fits.

Common Questions

Is allowlisting the same as whitelisting?

Yes. Allowlist is the newer word for the same thing: a list of addresses that are let through, with everything else refused.

Can my whole team use one static proxy?

Yes, within your organization. Everyone uses the same address and login, so the service only needs one entry on its list. Do not share the login outside your organization.

What if a tool cannot use a proxy?

Then it needs its traffic to leave from a fixed address another way: a VPN to a server you control, or running the tool on that server. Setting up WireGuard on a VPS covers the VPN route.

Will the address change?

A static proxy keeps the same address while you keep the service. Providers may still change an address when they must for operational reasons, so keep the allowlist owner's contact handy.