> ## Documentation Index
> Fetch the complete documentation index at: https://semgrep-ee9d73d8-abhijna-tec-647-weekly-release-notes.mintlify.site/llms.txt
> Use this file to discover all available pages before exploring further.

# Network access and allowlists

> Configure ingress and egress allowlists, IP addresses, and Semgrep Network Broker so Semgrep can reach your SCM and related services.

If your organization uses a self-hosted source code manager (SCM), IP allowlisting, or other network restrictions, confirm that Semgrep can connect to the systems it needs before you deploy.

<Note>
  **Before you configure**

  Use the [Pre-deployment checklist](/deployment/checklist) to confirm whether network configuration applies to your deployment.
</Note>

## When to configure allowlists

You might need to update ingress or egress allowlists if any of the following apply:

* Your SCM offers security features that limit access to your resources.
* Your SCM is behind a firewall or protected by network restrictions.
* You use a virtual private network (VPN).
* You host your SCM on-premise or in a private network.

## Ingress and egress allowlists

Semgrep deployments might require both **ingress** and **egress** allowlist updates:

* **Ingress allowlists** control traffic from Semgrep into your infrastructure.
* **Egress allowlists** control traffic from your infrastructure to Semgrep.

Depending on your network, you might need to configure one or both.

<h2 id="ip-addresses">
  IP addresses
</h2>

If you are behind a firewall, are using a virtual private network (VPN), or have network restrictions regarding access, you might need to add the following IP addresses to the **ingress** allowlist and **egress** allowlist:

```bash theme={null}
# Ingress IP addresses (from Semgrep to your infrastructure)
# and egress IP addresses (from your infrastructure to Semgrep)
35.166.231.235
52.35.248.246
52.34.137.110
44.225.64.41
```

### CloudFront egress IP addresses

You must add **CloudFront IP addresses** to your **egress** allowlist. Refer to [Locations and IP address ranges of CloudFront edge servers](https://docs.aws.amazon.com/AmazonCloudFront/latest/DeveloperGuide/LocationsOfEdgeServers.html) for a list of IP addresses.

## Semgrep Network Broker

[Semgrep Network Broker](/semgrep-ci/network-broker) facilitates secure access between Semgrep and your private network. Its use can replace allowlisting the IP addresses required for **ingress** traffic from Semgrep.

The Network Broker, however, only facilitates requests from Semgrep to your network. It does *not* assist with requests originating from your network to Semgrep, including egress traffic from your infrastructure to Semgrep.

When using the Network Broker, the only address you would have to allow inbound is `wireguard.semgrep.dev` on UDP port `51820`, or your tenant's equivalent. Depending on how restrictive your network is, you might also need to modify your egress allowlist to include the IP addresses listed in [IP addresses](#ip-addresses).

For general setup instructions, see [Set up Semgrep Network Broker](/semgrep-ci/network-broker). For network-specific setup, see [Network requirements](/semgrep-ci/network-broker#network-requirements).

## Features that require inbound network connectivity

The following Semgrep features require Semgrep to reach resources in your network:

| Feature                    | Guide                                                                                                      |
| :------------------------- | :--------------------------------------------------------------------------------------------------------- |
| On-premise SCM connections | [Connect to on-premise orgs and projects](/deployment/connect-scm#connect-to-on-premise-orgs-and-projects) |
| PR and MR comments         | [PR or MR comments](/category/pr-or-mr-comments)                                                           |
| Semgrep Managed Scans      | [Managed Scans overview](/deployment/managed-scanning/overview)                                            |
| Semgrep Multimodal         | [Semgrep Multimodal getting started](/semgrep-multimodal/getting-started)                                  |
| Notification webhooks      | [Enable webhooks](/semgrep-appsec-platform/webhooks)                                                       |