Render's /24 Static IP Range: When 256 Addresses Is Too Many

Render offers static outbound IPs, but they come as a /24 CIDR range. That's up to 256 addresses, distributed across customers, load-balanced for high availability. You don't control which one your traffic exits from.

This works great if you control both ends. Accessing your own VPC, services that accept CIDR blocks, egress filtering for audit purposes. All fine.

It doesn't work for APIs with strict IP whitelisting policies. Stripe accepts single IPs. Twilio accepts single IPs. AWS RDS security groups need exact IPs. S3 bucket policies with IP conditions need exact IPs. Google Cloud SQL firewall rules need exact IPs. Pretty much any third-party that requires discrete IP whitelisting doesn't work with a /24 range.

When Native IPs Work (And When They Don't)

Render's native IPs work for:

• Databases in your own VPC with CIDR-based security group rules
• Services that support dynamic IP ranges (AWS WAF, Cloudflare)
• Basic egress filtering for audit purposes
• Target services that explicitly accept /24 ranges

Render's native IPs don't work for:

• Payment processors with single-IP whitelisting
• AWS RDS with IP-based security groups
• S3 bucket policies with IP conditions
• Google Cloud SQL firewall rules
• Search services like Algolia
• Most APIs built before 2020 that care about IP verification

Dedicated Static IPs

QuotaGuard on Render gives you two dedicated static IP addresses instead of a /24 range. They're yours. Not shared with other customers. Load-balanced for redundancy. If one IP goes down, traffic flows through the other.

Render recommends QuotaGuard in their documentation for this use case.

Setting Up QuotaGuard on Render

This takes about five minutes.

Step 1: Get your QuotaGuard credentials

Sign up for QuotaGuard. Choose your proxy region to match your Render deployment region. You get a unique connection string.

Step 2: Add the environment variable in Render

Go to your Render service settings. Environment tab. Add:

QUOTAGUARD_URL=http://[username]:[password]@[host]:80

Render encrypts this. It's safe in their dashboard.

Step 3: Update your app code

For HTTP APIs, add the proxy to your HTTP client:

python

import os
import requests

proxy_url = os.environ.get('QUOTAGUARD_URL')
proxies = {
   'http': proxy_url,
   'https': proxy_url
}

response = requests.get('https://api.example.com', proxies=proxies)

For non-HTTP protocols (database connections, Redis), use SOCKS5 or QGTunnel.

Step 4: Deploy

Push your code. Traffic now routes through two dedicated static IPs.

Common Questions

Why two IPs instead of one?

Redundancy. One IP dies, the other keeps working. The load balancer reroutes automatically. Whitelist both.

What about latency?

Minimal. QuotaGuard's regional gateways are close to Render's infrastructure. Same-region adds sub-10ms. Negligible for most APIs.

Can I use Render's native IPs and QuotaGuard together?

Pick one per use case. Use QuotaGuard for traffic that needs exact IPs. Use Render's native /24 for traffic where CIDR ranges work.

S3 Bucket Policies and IP-Based Access

This is a common example of the problem. An S3 bucket policy with an IP condition:

json

{
 "Version": "2012-10-17",
 "Statement": [
   {
     "Effect": "Allow",
     "Principal": "*",
     "Action": "s3:GetObject",
     "Resource": "arn:aws:s3:::my-bucket/*",
     "Condition": {
       "IpAddress": {
         "aws:SourceIp": ["203.0.113.100/32"]
       }
     }
   }
 ]
}

That /32 means exactly one IP. Render's traffic comes from one of 256 addresses. The policy rejects it.

With QuotaGuard, you whitelist the two dedicated IPs:

json

"aws:SourceIp": ["203.0.113.100/32", "203.0.113.101/32"]

Both IPs are whitelisted. Either one can access the bucket. Load balanced. Fault-tolerant.

Compliance: QuotaGuard Shield

If you're handling HIPAA or PCI-DSS data, QuotaGuard Shield at $29/month adds SSL passthrough for end-to-end encryption. Compliance logging and audit trails included. Your firewall rule becomes a compliance rule with documented egress through specific IPs.

Next Steps

If you're on Render and hitting IP whitelisting problems, you have two options. Negotiate with the third-party service to support CIDR ranges (this usually fails). Or add QuotaGuard for two dedicated static IPs.

Sign up and set it up. Your firewall rules will work.

‍