Skip to content
M↓ View as Markdown ↗

Network access and IP allowlisting

Actian AI Analyst connects to your warehouse from its own servers, not from your browser, so the warehouse must accept connections from those servers before you test a connection.

Which IP addresses to allow

When you add a warehouse connection, the Setup help panel next to the form tells you what to allow:

  • If your deployment publishes the IP addresses it connects from, Before you connect says "Allow inbound connections from these AI Analyst egress IPs before you test." and lists the addresses under Which IPs to allow. Add each address to your firewall, security group, or the warehouse's network policy.
  • If no addresses are listed, the panel shows general guidance instead. On Actian SaaS, contact Actian support for the addresses to allow. On a self-managed deployment, connections come from your own network, so ask the team that runs the deployment.

Use the addresses shown in Studio, not a list copied from elsewhere.

Hosts on a private network

AI Analyst can only connect to a host its servers can reach. In addition, it refuses to connect to private-network and loopback addresses unless the deployment has been configured to allow them. A VPN or peering alone is not enough.

This applies to hosts that are, or that resolve to, these addresses:

  • 10.0.0.0/8, 172.16.0.0/12, and 192.168.0.0/16
  • loopback addresses (127.0.0.0/8 and ::1)
  • the unspecified addresses (0.0.0.0/8 and ::)
  • IPv6 unique local addresses (fc00::/7)

Names that look internal, such as names ending in .local, .internal, or .corp, are checked the same way once they resolve. If you need AI Analyst to reach a private range, ask Actian support if you use Actian SaaS, or the team that runs the deployment if you use a self-managed deployment.

As you type such a host, Studio shows This looks like a local address. There are three versions of the message:

The host looks like What Studio tells you
localhost, 127.x, or ::1 These addresses point to the server AI Analyst connects from, not to your computer. Use an address that server can reach.
A private network address or internal name AI Analyst can only connect if its servers can reach that network, for example through a VPN, peering, or an allowlist. Studio's message is general: a connection to a private address also needs the deployment to allow that address range.
A host name without a domain The name usually only resolves inside a private network. Enter the full host name if the database is reachable from the internet.

The warning doesn't block the form. However, you can only save a connection after a successful test, so the address must actually be reachable and allowed.

Addresses that are always blocked

For security, AI Analyst never connects to:

  • link-local addresses (169.254.0.0/16 and fe80::/10), which include the 169.254.169.254 cloud metadata address. These are blocked even if a deployment allows private ranges.
  • cloud instance metadata endpoints
  • internal service-discovery host names

AI Analyst also refuses a host that doesn't resolve in DNS, and a Host value that contains a protocol (https://), a path, or a port. Enter the host name or IP address on its own, and put the port in the Port field.

The same checks apply to the LLM and embedding endpoint URLs your organization sets under Settings → Inference.

Troubleshooting

Symptom Likely cause What to do
Could not reach the warehouse The firewall or network policy blocks AI Analyst, or the host or port is wrong. Allow the addresses shown under Which IPs to allow, and check host and port.
Could not connect for a private or internal host AI Analyst refuses private addresses unless the deployment allows that range, or the host name doesn't resolve from AI Analyst's servers. A VPN or peering alone doesn't change this. Use a publicly reachable address. To use a private range, ask Actian support (Actian SaaS) or the team that runs your self-managed deployment to allow it.
Could not connect and the Host value includes https://, a path, or a port AI Analyst refuses host values in that form. Enter only the host name, and use the Port field.

For the other test messages, see If the test fails.