Give Your NetSuite Integration a Static IP for IP Address Rules

NetSuite holds your financial records and customer PII. Token-based access to SuiteTalk and RESTlets is powerful, so security teams want another layer on top of the mandatory 2FA. NetSuite offers one: IP Address Rules. Turn them on, and API access only works from source IPs you approve. Then the problem shows up. Your integration runs on Heroku, AWS, or Lambda, and its outbound IP keeps changing.

NetSuite IP Address Rules Restrict API Access to Source IPs You Choose

By default NetSuite doesn't allowlist anything. The API rides the public internet, and any request with valid token credentials gets in. That's fine for a lot of shops. It isn't fine for one that treats a leaked token as a real risk to financial data.

IP Address Rules are the opt-in fix. An administrator restricts account and API access to a set of approved source IPs, on top of the 2FA that NetSuite already requires. Once that's on, a request from an unlisted address fails to authenticate even when the token is correct. The rule applies to token-based auth roles the same way it applies to interactive logins, so it covers RESTlets and SuiteTalk REST and SOAP. Check the current setup steps and scope in NetSuite/Oracle docs, since the exact menu path and role behavior are theirs to define.

So this post is for the security-conscious NetSuite team. If you've enforced IP Address Rules, or you're about to, your cloud integration needs a fixed address to keep passing them.

A Fixed Egress IP Keeps Your Integration on the Allowlist

Here's where most integrations break. If your app runs on Heroku, Render, Railway, Fly.io, or AWS Lambda, its outbound IP changes on every deploy and restart. The address you added to NetSuite's IP Address Rules goes stale the next time the platform moves your workload. Requests that worked yesterday start returning invalid login errors today.

You can't allowlist the platform's whole range either. PaaS hosts don't publish narrow CIDR blocks, so trusting the platform's range means trusting every other customer running on it. That defeats the reason you turned on IP Address Rules in the first place.

A static outbound IP solves both problems. Your integration leaves from the same address every time, the allowlist stays short, and no unrelated workload shares it.

QuotaGuard Gives Your NetSuite Integration a Static IP in 2 Minutes

QuotaGuard is a proxy. Your app sends its NetSuite traffic through QuotaGuard, and NetSuite sees one of your two fixed IPs on every request. Setup is one environment variable and a proxy config on your HTTP client.

Add the connection URL to your environment:

QUOTAGUARDSTATIC_URL="http://username:password@us-east-static-01.quotaguard.com:9293"

Then route your SuiteTalk REST calls through it. Point the request at your account-specific SuiteTalk REST domain rather than a shared host. In Node.js:

const axios = require("axios");
const { HttpsProxyAgent } = require("https-proxy-agent");

const httpsAgent = new HttpsProxyAgent(process.env.QUOTAGUARDSTATIC_URL);

// Your account-specific SuiteTalk REST domain and record path,
// from your NetSuite account. See NetSuite/Oracle docs for the exact URL.
const suiteTalkEndpoint = process.env.NETSUITE_SUITETALK_URL;

await axios.get(suiteTalkEndpoint, {
  headers: { Authorization: tokenBasedAuthHeader },
  httpsAgent,
  proxy: false,
});

The token-based auth header is built the way NetSuite documents for your integration. QuotaGuard doesn't change how you sign the request. It only changes the IP the request leaves from. Every SuiteTalk REST or SOAP call, and every RESTlet call, now exits through one of your two static IPs.

The example host above is region-specific. You pick your region at sign-up, so choose the one closest to your NetSuite data center, and changing it later means contacting QuotaGuard support. QuotaGuard runs this on AWS infrastructure.

Register Both QuotaGuard IPs in NetSuite's IP Address Rules

Every subscription includes two load-balanced static IPs. That's the one QuotaGuard detail people miss when they set up an allowlist. Requests can leave from either IP, so both belong in the rule. Add both to your NetSuite IP Address Rules and either one passes.

Once both IPs are registered and your integration is proxied through them, the loop is closed. NetSuite accepts token-based API calls from your two known addresses and rejects a stolen token used from anywhere else. Follow NetSuite/Oracle docs for the exact place to enter the addresses, since the administrator screen for IP Address Rules is theirs.

NetSuite's Own Webhooks Use a DNS Name, Not a Fixed IP List

One thing this doesn't cover, so you don't chase the wrong angle. NetSuite's native outbound notifications aren't allowlisted by pinning a set of NetSuite IPs on your side. NetSuite publishes those source addresses behind a DNS name, outboundips.netsuite.com, and signs its native webhooks with HMAC-SHA256 so you verify the signature instead of the IP. That's the inbound-to-your-app direction, and NetSuite already handles it.

The direction that's yours to control is outbound to NetSuite. That's the case above: your integration calling NetSuite's API and needing a fixed source IP to satisfy IP Address Rules. Verify signatures for NetSuite's calls in, and use a static egress IP for your calls out.

QuotaGuard Static Pricing Starts at $19/Month

Bandwidth is bundled. No per-GB overage fees. A typical NetSuite integration moves records and transactions, not bulk media, so the entry tier covers most teams. Dedicated IPs are available on Enterprise and above. On lower tiers, your two assigned IPs are still static, but shared with other customers.

QuotaGuard Shield Pricing Starts at $29/Month

NetSuite carries financial data and PII, so this is where Shield earns its place. Shield costs slightly more than Static at each tier because SSL passthrough adds routing overhead. If your NetSuite traffic falls under SOC 2, PCI-DSS, or an internal policy that says no proxy can decrypt data in transit, Shield keeps the payload encrypted end to end. QuotaGuard never decrypts your data in ordinary operation. For a regulated finance workflow, that difference is worth it.

All plans include a 3-day trial. Enterprise plans include a 7-day trial. Credit card required.

See the full pricing table at quotaguard.com/products/pricing.