A database that accepts connections from anywhere is the problem this page exists to
avoid. TeamDuo connects from a known address, so you can allowlist that address instead.
Find the address
The datasource wizard shows TeamDuo’s egress address as a CIDR block — the form every
firewall wants — along with the specific command or console path for your provider.
Providers TeamDuo recognises from the hostname:
Host detection is a hint, never a decision. A CNAME hides the provider and a self-hosted
cluster looks like nothing in particular, so an unrecognised host still gets generic
guidance — being wrong about the provider costs you an extra paragraph, nothing more.
The commands use placeholders for your own resource ids, which you replace. TeamDuo never
interpolates a value you typed into a command you’re about to paste into an authenticated
terminal.
Shared and dedicated addresses
This is the part most worth understanding before you rely on it.
A shared address is the one all TeamDuo customers egress from. Allowlisting it narrows
your exposure from the whole internet to TeamDuo’s infrastructure — an enormous
improvement, and the right move. But it is not isolation from other TeamDuo tenants,
because everyone else’s traffic arrives from the same place.
A dedicated address is yours alone. That is what gives you tenant isolation at the
network layer.
Allowlisting a shared address is a real security gain and should not be mistaken for a
guarantee it doesn’t provide.
BigQuery
BigQuery has no network firewall. It is reached over Google’s API and access is decided
entirely by IAM, so there is nothing to allowlist and an IP address would be noise.
TeamDuo says so rather than offering an address that would teach you that you’d tightened
something when you hadn’t.
Control BigQuery access through the service account’s roles instead — see
Connect a datasource.
Private networks
Only direct connections are supported today. A database with no route from the public
internet — a private-subnet RDS instance, for example — cannot be reached yet. 
