Connections suddenly refused: check IP Allow first

TL;DR

Check the project's IP Allow settings for recent changes; correlate timestamps. IP Allow was enabled or edited: once configured, only listed IPs can connect (the default allow-all the all-interfaces address is gone).

When to use

You are seeing this: The app's egress IP, a CI runner, or a developer IP is not on the list. Use this skill when you run into "Connections suddenly refused: check IP Allow first".

When not to use

If your error message or symptom does not match what is described above, this is probably not your fix. Search for your exact error text instead of forcing this one to fit.

Versions

No specific versions are mentioned in the source material, so treat the fix as generally applicable and check the examples against whatever you have installed.

Steps

1. IP Allow was enabled or edited: once configured, only listed IPs can connect (the default allow-all the all-interfaces address is gone). The app's egress IP, a CI runner, or a developer IP is not on the list.
2. Check the project's IP Allow settings for recent changes; correlate timestamps.
3. Test from a known-listed IP vs the failing location.
4. Note the allowlist applies to all branches by default (or protected branches only, if scoped).
5. - Add the missing IPs or ranges (neonctl ip-allow add or Console).

• For cloud egress IPs that change, use ranges or a static-egress proxy/VPN rather than playing whack-a-mole.
• Consider scoping the list to protected branches only if dev branches need open access.

Why this happens

IP Allow was enabled or edited: once configured, only listed IPs can connect (the default allow-all the all-interfaces address is gone).

Edge cases

• Note the allowlist applies to all branches by default (or protected branches only, if scoped).

Neon's project docs (verified live 2026-09-26): once IP Allow is configured only listed IPs can connect (default was the all-interfaces address allow-all); applies to all branches by default with a protected-branches-only option; CLI reference for add/remove/reset/list.