Which External IP Addresses Does Hybrid Deployment Access?
Question
Which external IP addresses does Hybrid Deployment access?
Answer
In addition to connecting to your source and destination, Hybrid Deployment requires outbound TCP connections over port 443 to the following Fivetran services and supporting infrastructure:
Fivetran will retire the following Hybrid Deployment Agent hostnames on January 31, 2027:
gateway.fivetran.comreplacesldp.orchestrator.fivetran.comhdt.gateway.fivetran.comreplaceshdt.orchestrator.fivetran.com
Before then, add the new hostnames to your outbound firewall or security group rules. The associated IP addresses remain unchanged.
- mTLS connection to the Fivetran Orchestration Service
- Host:
gateway.fivetran.com - IP addresses:
35.188.225.82,136.107.81.248/29, and34.143.64.0/29
- Host:
- HTTPS with a secure token to the Fivetran Public API
- Host:
api.fivetran.com - IP addresses:
35.236.237.87,136.107.81.248/29, and34.143.64.0/29
- Host:
- Fivetran Orchestration Gateway
- Host:
hdt.gateway.fivetran.com - IP addresses:
136.107.81.248/29and34.143.64.0/29
- Host:
- Google Artifact Registry
- Host:
us-docker.pkg.dev - To determine the applicable IP range, run
nslookup us-docker.pkg.devfrom your Hybrid Deployment machine and use the returned IP address to identify the corresponding IP range through ICANN
- Host:
- (Only for Docker and Podman) GitHub repository hosting the automated installation script
- Host:
raw.githubusercontent.com/fivetran/hybrid_deployment - To determine the applicable IP range, run
nslookup raw.githubusercontent.comfrom your Hybrid Deployment machine and use the returned IP address to identify the corresponding IP range through ICANN
- Host:
- Fivetran Platform Connector logs
- Host:
storage.googleapis.com/fivetran-metrics-log-sr - Host:
storage.googleapis.com/sdk-logsif you have logs from a custom connector built with the Connector SDK
- Host:
- Unless specified otherwise, all HTTPS-based outbound connections use port
443. - If your firewall supports domain-based allowlisting, Fivetran recommends allowing hostnames instead of IP ranges wherever possible.
- To use Fivetran-hosted Transformations for dbt or Quickstart data models with Hybrid Deployment, your destination must allow connections from the Fivetran IP addresses. Fivetran runs these transformations in the Fivetran cloud, where they connect directly to your destination rather than through the Hybrid Deployment Agent.