# Can I allow Transloadit's IPs in my firewall?

Our platform is highly volatile in the sense that we'll have 1000 servers online today that will be
gone tomorrow. Trying to keep your firewalls up to date with this pace is asking for dropped
connections.

We don't funnel outgoing connections (e.g. [🤖/sftp/store](/docs/robots/sftp-store.md) or <dfn>Notifications</dfn> or [🤖/http/import](/docs/robots/http-import.md)) through one point
because of performance and <abbr title="Singe Point of Failure">SPOF</abbr> reasons. Using a fleet
of proxies that scale along with load puts us back in the same problem, and using
[NAT has prohibitive limitations performance-wise](https://docs.aws.amazon.com/vpc/latest/userguide/vpc-nat-gateway.html).
The trade-off of our decision to have maximum reliability & throughput is that our outgoing IPs
change rapidly.

## Ingress (Transloadit pinging your server, acquiring results)

The 'best' we can do is give you your region's Amazon ranges, but obviously you will be allowing a
lot more than you bargained for. On the other hand you'll still rule out 99% of the internet, so for
some less critical use cases it could be viable. We'll refer to them just in case.

An up to date [Amazon IP list](https://docs.aws.amazon.com/general/latest/gr/aws-ip-ranges.html) is
available, that page also lists a [JSON variant](https://ip-ranges.amazonaws.com/ip-ranges.json) for
automation.

A better solution you could implement, if security is paramount, is to setup a server outside of
your trusted zone that we'll push updates to. Machines inside your trusted zone could then pull
updates from this machine using rsync, a database, or ZeroMQ (collect Notifications and have your
trusted zone eat through this queue). This way you will only have to deal with a limited set of
known IPs. Additionally, this will cover the security risk that, should our machines ever get
compromised, there is a allowlisted connection straight into your trusted zone. We'd push file
results to an S3 bucket with append-only access, and you can then from inside your DMZ safely pull
them in.

For a near-real-time approach, something like HAProxy (directly forward traffic into your trusted
zone), direct routing, or SSH tunnelling the `notify_url` into your DMZ will work.

## Egress (Client-side integrations talking to Transloadit)

If you're deploying a client-side integration of Transloadit (like [Uppy](https://uppy.io)) with a
corporation that puts restrictions on internet use, please allow these domains:

* `*.transloadit.com`
* `*.*.transloadit.com`
* `s3.amazonaws.com`
* `s3-eu-west-1.amazonaws.com`