Skip to main content
Most production databases block inbound traffic by default. For the Postgres-to-Postgres live release, MantrixFlow connects to databases from one static outbound IP address. Add that IP to your provider firewall or allowlist so only MantrixFlow can reach PostgreSQL port 5432.

​
Supported now

The supported private access path for this release is:
This works when the database has a public PostgreSQL endpoint and the provider lets you restrict access to specific IP addresses or CIDR ranges.

​
Not supported yet

These private-network patterns are planned for later releases:
  • SSH tunnel through a bastion host
  • self-hosted ELT agent inside your VPC
  • VPN-only or private-link-only access
  • databases with no public PostgreSQL endpoint
If your database is private-only, keep using a test/public reporting replica for the first launch and contact MantrixFlow before moving the production private database.

​
Copy the MantrixFlow IP

In the PostgreSQL connection form, open Private database access and copy the CIDR shown in the panel:
Use /32 so the rule allows exactly one IPv4 address. Restrict the rule to PostgreSQL port 5432; do not allow all ports or 0.0.0.0/0.

​
Provider quick setup

​
Validation

After adding the rule:
  1. Wait a few minutes for the provider firewall change to apply.
  2. Return to MantrixFlow and click Test Connection.
  3. If the test times out, re-check the provider public endpoint and allowlist.
  4. If the test authenticates but fails with permissions, update the database user grants.

​
Security checklist

  • Use a dedicated database user for MantrixFlow.
  • Use /32, not a broad subnet.
  • Restrict to port 5432.
  • Keep SSL enabled for managed PostgreSQL providers.
  • Name the provider firewall rule clearly, such as MantrixFlow ELT.
  • Remove the rule if you stop using the connection.