# Sudden connection failures: the IP Allow check
## Symptom
Every Postgres connection fails (timeouts or rejections) starting at a specific time, often right after someone "hardened" the project. The Neon Console and API still work fine.
## Cause
IP Allow was enabled or edited: once configured, only listed IPs can connect (the default allow-all the all-interfaces address is gone). The app's egress IP, a CI runner, or a developer IP is not on the list.
## Confirm
1. Check the project's IP Allow settings for recent changes; correlate timestamps.
2. Test from a known-listed IP vs the failing location.
3. Note the allowlist applies to all branches by default (or protected branches only, if scoped).
## Fix
- Add the missing IPs or ranges (`neonctl ip-allow add` or Console).
- For cloud egress IPs that change, use ranges or a static-egress proxy/VPN rather than playing whack-a-mole.
- Consider scoping the list to protected branches only if dev branches need open access.
## Verify
Connections succeed from every location that needs access, not just the one you tested.