Connections suddenly refused: check IP Allow first

Sudden connection failures: the IP Allow check

Symptom

Every Postgres connection fails (timeouts or rejections) starting at a specific time, often right after someone "hardened" the project. The Neon Console and API still work fine.

Cause

IP Allow was enabled or edited: once configured, only listed IPs can connect (the default allow-all the all-interfaces address is gone). The app's egress IP, a CI runner, or a developer IP is not on the list.

Confirm

1. Check the project's IP Allow settings for recent changes; correlate timestamps.
2. Test from a known-listed IP vs the failing location.
3. Note the allowlist applies to all branches by default (or protected branches only, if scoped).

Fix

• Add the missing IPs or ranges (neonctl ip-allow add or Console).
• For cloud egress IPs that change, use ranges or a static-egress proxy/VPN rather than playing whack-a-mole.
• Consider scoping the list to protected branches only if dev branches need open access.

Verify

Connections succeed from every location that needs access, not just the one you tested.

Neon's project docs (verified live 2026-09-26): once IP Allow is configured only listed IPs can connect (default was the all-interfaces address allow-all); applies to all branches by default with a protected-branches-only option; CLI reference for add/remove/reset/list.