IP allowlisting & cloud firewall
Your whole team's work traffic exits through one trusted gateway IP. This guide covers how to find it, how to allowlist it in the tools you already use, and two ways to control access with it: server-enforced group IP rules, and automatic cloud firewall sync.
Find your gateway IP
Your team's static Australian egress IP is shown on the dashboard as soon as your group is set up — no separate configuration needed. Every member's work traffic exits from this same address, regardless of where they're physically connecting from (home, co-working space, a different city).
Allowlist it in your SaaS and cloud tools
Add the gateway IP once to any IP-based access control — AWS security groups, Salesforce trusted IPs, Atlassian allowlists, or similar — and you're done. New members who join the group are covered automatically; members who leave lose access without any change to the allowlist itself.
Group IP access rules
As a group owner, you can restrict which destinations your group's gateway allocation can reach with server-enforced whitelist and blacklist rules, defined as CIDR ranges. These rules are enforced at the gateway itself, not just on the client — so they apply consistently to every member regardless of device or OS.
To set them:
- Go to your Dashboard and open the Group section.
- Open the group's admin page.
- Add whitelist or blacklist entries as CIDR ranges (for example
10.0.0.0/8or203.0.113.4/32). - Save. Rules apply to the group's gateway traffic going forward.
Use a whitelist to lock a group down to a known set of internal or partner ranges, or a blacklist to block specific destinations while otherwise allowing normal traffic.
Cloud firewall automation
Allowlisting the gateway IP once solves the "who's allowed in" problem for your own tools. Cloud firewall automation solves the flip side — keeping your cloud firewall pointed at that IP without manual edits.
Connect a GCP, AWS, Azure, or Cloudflare account from the admin dashboard, and Reach keeps the firewall rule pointed at the current gateway IP automatically. Each provider targets a slightly different resource:
| Provider | What Reach manages |
|---|---|
| Google Cloud (GCP) | A firewall rule on a VPC network in your project |
| Amazon Web Services (AWS) | A security group, connected using an IAM role ARN |
| Microsoft Azure | A network security group (NSG) within a resource group |
| Cloudflare | A zone on your Cloudflare account |
To set it up:
- From the admin dashboard's Cloud connections page, connect your GCP, AWS, Azure, or Cloudflare account using the credentials or role the provider requires.
- Add a firewall target — the protocol and port you want the rule to cover.
- Reach keeps the rule pointed at the current gateway IP automatically.
- Verify the connection is active and the rule is current from the same dashboard page at any time.