Serverless Functions and IP Whitelisting: The 0.0.0.0/0 Trap

If you're connecting a Vercel, Lambda, or Cloud Functions app to MongoDB Atlas, you've probably seen the IP whitelist screen. Serverless functions use dynamic IPs, so you don't have a static address to enter. The tempting option is 0.0.0.0/0. It works immediately. It also opens your database to the entire internet.

Why 0.0.0.0/0 Is a Problem

Opening 0.0.0.0/0 means your database has no IP-based access control. An attacker doesn't need your credentials to start probing. They just need to find your connection string. If your password is weak, they're in. MongoDB Atlas warns against this in their own documentation.

Most teams check the box anyway because the alternative isn't obvious. The pressure to ship is real. The friction is annoying. The box gets checked.

Why Serverless Platforms Don't Have Static IPs

Serverless platforms scale by design. They spin up instances, tear them down, and each request might come from a different server. This is what makes them fast and cheap. But IP whitelisting assumes static infrastructure. It assumes you control your origin IP. On serverless, you don't.

Some teams work around this by spinning up a dedicated EC2 instance and routing requests through it. That gives you a static IP, but now you have a server to manage. Updates, monitoring, costs. You've built the opposite of serverless.

The NAT Gateway Approach

If you're on AWS, the official solution is a NAT Gateway. You route Lambda through a VPC, and outbound traffic gets translated to the gateway's static IP.

It works. It's also expensive. In common AWS regions a NAT Gateway runs roughly $32 per month per Availability Zone in base fees, plus $0.045 per GB of data processed. With two AZs for redundancy and real traffic, you're at $70+/month just for IP translation. Google Cloud's Cloud NAT and Azure's equivalents are similar.

These solutions are officially supported. They're just not practical for most teams spending $20/month on compute.

The Proxy Approach

A simpler option: route your serverless function through a static IP proxy. The destination sees requests from static IPs. You whitelist those IPs in MongoDB Atlas (or wherever). Done.

QuotaGuard runs proxy infrastructure across 12 AWS regions. When you route traffic through it, your outbound IP becomes one of two static addresses. $19/month. That's less than one NAT Gateway. It works with Vercel, Lambda, Google Cloud Functions, or any serverless platform. No VPC changes. No infrastructure to manage.

Platform-Specific Setup

Vercel and HTTP APIs: Set the proxy URL as an environment variable. Use it in your fetch requests. The request exits from a static IP.

AWS Lambda and database connections: Database drivers don't speak SOCKS5 natively, and QGTunnel needs a long-running local process, so it isn't a Lambda drop-in. Open a SOCKS5 connection per invocation instead. In Node, the socks package gives you a connected socket, and tedious accepts a pre-connected socket through its connector option. node-mssql uses tedious underneath, so it works through either. This needs a current version of those packages, since the connector hook is not in older releases.

Google Cloud Functions: Same per-invocation pattern as Lambda. QGTunnel is the right answer on long-lived compute such as containers, EC2, and ECS, where the tunnel process can stay up between requests.

Cost Comparison

NAT Gateway: roughly $32/month per AZ in base fees plus $0.045 per GB processed. Realistically $70+/month with two AZs and real traffic.

Cloud NAT: similar, with egress charges on top.

QuotaGuard Static: $19/month for two load-balanced static IPs.

The proxy costs less and removes an infrastructure component from your stack. You're adding a dependency, but it's a service doing one thing. The deployment is simpler and debugging is easier.

Common Questions

How do I get a static IP for my Next.js API routes on Vercel to connect to a whitelisted API?

Route through QuotaGuard. Use the HTTP proxy URL in your fetch requests via an environment variable. No VPC required.

How do I whitelist Vercel serverless functions for MongoDB Atlas without opening 0.0.0.0/0?

Proxy through static IPs. Whitelist the proxy IPs in Atlas instead of 0.0.0.0/0.

Vercel doesn't publish static IPs. How do I securely access a database that requires IP whitelisting?

You buy static IPs from a proxy service. Vercel routes through the proxy. The proxy provides the static IPs.

How do I whitelist MongoDB Atlas when connecting from AWS Lambda without opening 0.0.0.0/0?

Open a SOCKS5 connection per invocation and hand the socket to your database driver. QGTunnel is not a Lambda drop-in because it needs a persistent process. Whitelist the two static IPs in Atlas.

My Lambda function needs a static IP to call a third-party API. NAT Gateway costs too much. Alternatives?

QuotaGuard at $19/month. Works with any serverless platform.

How do I get a static outbound IP for Google Cloud Functions to whitelist in a vendor's firewall?

Same per-invocation SOCKS5 pattern as Lambda, at the same cost. Use QGTunnel only where a long-running process is available, such as Cloud Run or a container.

Getting Started

Sign up for QuotaGuard Static. Set up the proxy or the SOCKS5 connection for your platform. Whitelist the two static IPs in your database or API firewall. Remove 0.0.0.0/0 if you've already set it.

QuotaGuard Shield is $29/month. Shield uses SSL passthrough, and neither Static nor Shield ever decrypts your outbound payload. Shield's difference is the hop between your app and the proxy: Static's hop uses the plain HTTP proxy protocol, while Shield encrypts it with TLS. Use Shield for regulated data such as HIPAA or PCI workloads.