> ## Documentation Index
> Fetch the complete documentation index at: https://docs.teamduo.ai/llms.txt
> Use this file to discover all available pages before exploring further.

# Network access

> Let TeamDuo reach your database without opening it to the internet.

A database that accepts connections from anywhere is the problem this page exists to
avoid. TeamDuo connects from a known address, so you can allowlist that address instead.

## Find the address

The datasource wizard shows TeamDuo's egress address as a CIDR block — the form every
firewall wants — along with the specific command or console path for your provider.

Providers TeamDuo recognises from the hostname:

| Provider         | Mechanism            |
| ---------------- | -------------------- |
| Amazon RDS       | security group       |
| MongoDB Atlas    | Network Access list  |
| Neon             | IP Allow             |
| Supabase         | network restrictions |
| Google Cloud SQL | authorized networks  |
| Azure Database   | firewall rules       |
| DigitalOcean     | trusted sources      |
| Anything else    | generic guidance     |

Host detection is a hint, never a decision. A CNAME hides the provider and a self-hosted
cluster looks like nothing in particular, so an unrecognised host still gets generic
guidance — being wrong about the provider costs you an extra paragraph, nothing more.

<Note>
  The commands use placeholders for your own resource ids, which you replace. TeamDuo never
  interpolates a value you typed into a command you're about to paste into an authenticated
  terminal.
</Note>

## Shared and dedicated addresses

This is the part most worth understanding before you rely on it.

A **shared** address is the one all TeamDuo customers egress from. Allowlisting it narrows
your exposure from the whole internet to TeamDuo's infrastructure — an enormous
improvement, and the right move. But it is **not** isolation from other TeamDuo tenants,
because everyone else's traffic arrives from the same place.

A **dedicated** address is yours alone. That is what gives you tenant isolation at the
network layer.

<Warning>
  Allowlisting a shared address is a real security gain and should not be mistaken for a
  guarantee it doesn't provide.
</Warning>

## BigQuery

BigQuery has no network firewall. It is reached over Google's API and access is decided
entirely by IAM, so there is nothing to allowlist and an IP address would be noise.
TeamDuo says so rather than offering an address that would teach you that you'd tightened
something when you hadn't.

Control BigQuery access through the service account's roles instead — see
[Connect a datasource](/guides/connect-a-datasource).

## Private networks

Only direct connections are supported today. A database with no route from the public
internet — a private-subnet RDS instance, for example — cannot be reached yet.