## TL;DR

Check the project's IP Allow settings for recent changes; correlate timestamps. IP Allow was enabled or edited: once configured, only listed IPs can connect (the default allow-all the all-interfaces address is gone).

## Steps

1. IP Allow was enabled or edited: once configured, only listed IPs can connect (the default allow-all the all-interfaces address is gone). The app's egress IP, a CI runner, or a developer IP is not on the list.

2. Check the project's IP Allow settings for recent changes; correlate timestamps.
2. Test from a known-listed IP vs the failing location.
3. Note the allowlist applies to all branches by default (or protected branches only, if scoped).

3. - Add the missing IPs or ranges (`neonctl ip-allow add` or Console).
- For cloud egress IPs that change, use ranges or a static-egress proxy/VPN rather than playing whack-a-mole.
- Consider scoping the list to protected branches only if dev branches need open access.

## When to use

You are seeing this: Every Postgres connection fails (timeouts or rejections) starting at a specific time, often right after someone "hardened" the project. Use this skill when you run into "Connections suddenly refused: check IP Allow first".

## When not to use

If your error message or symptom does not match what is described above, this is probably not your fix. Search for your exact error text instead of forcing this one to fit.

## Versions

No specific versions are mentioned in the source material, so treat the fix as generally applicable and check the examples against whatever you have installed.

## Why this happens

IP Allow was enabled or edited: once configured, only listed IPs can connect (the default allow-all the all-interfaces address is gone).

## Edge cases

- Note the allowlist applies to all branches by default (or protected branches only, if scoped).