Static IPs and regional DNS endpoints
Coralogix publishes static IP ranges and regionalized DNS endpoints so you can allowlist us once and keep ingestion working through infrastructure changes on our side. This page gives you the complete allowlist for your region in both directions, and identifies which hostnames actually carry ingestion traffic.
The tables on this page display information for your selected region. Use the domain selector in the upper right corner to switch regions.
Regional DNS endpoints
Coralogix uses the endpoint format <region>.coralogix.com. Point your integrations and SDKs at the regional endpoint for your account.
| Region | Environment | Country | Current DNS suffix | Regional DNS endpoint |
|---|---|---|---|---|
Inbound: traffic you send to Coralogix
Allow the following in your egress firewall or security group so your shippers, SDKs, and integrations can reach Coralogix.
| What to allow | Addresses for |
|---|---|
Region CIDR range, covering the ingress and syslog endpoints | |
| Additional direct endpoints still live in DNS | |
| Real User Monitoring ingestion |
Allow every row that applies to you:
- Region CIDR range: covers the
ingressandsyslogendpoints. Allowlist the full CIDR block rather than individual addresses, so upgrades, scaling, and rebalancing on our side don't interrupt your ingestion. - Additional direct endpoints: the endpoints on your region's earlier domain, which are still live in DNS. If any of your integrations still use those hostnames, you need these addresses in addition to the CIDR range. Keep them until we announce their deprecation.
- Real User Monitoring ingestion: served from outside the region CIDR range. Allowlist it separately if you send Real User Monitoring data. These addresses span multiple availability zones and can change when the load balancer is replaced, so allow the whole set.
The region CIDR range on its own is not a complete inbound allowlist. It covers ingress and syslog. Real User Monitoring ingestion and the API endpoints sit outside it.
API endpoints
The API endpoints (api, ng-api-grpc, and ng-api-http) are served through a content delivery network. Their addresses are not part of the region CIDR range, are shared across the provider's network, and change without notice, so pinning them in an allowlist is unreliable.
Allow the API endpoints by hostname. If your firewall can only match on addresses, contact Support for the provider's current published ranges.
Outbound: traffic Coralogix sends to you
Coralogix originates outbound traffic when it calls your systems, for example to deliver webhook notifications or to collect data from an endpoint you host. Allow the following addresses as source addresses on your side.
| What to allow | Addresses for |
|---|---|
| Coralogix outbound source addresses |
Outbound traffic leaves a region over more than one network path, and a given request can use any of them. Allow every address listed for your region.
Outbound addresses are not covered by the region CIDR range. Allowlisting only the CIDR range leaves Coralogix-originated traffic blocked. Allow the addresses in the table above as well.
Endpoints you should not allowlist
Under <region>.coralogix.com, only ingress, syslog, and the Real User Monitoring ingestion endpoint resolve directly to Coralogix addresses. Every other hostname in that domain resolves to the content delivery network that serves the Coralogix web application. That includes otel-ingress, cdn-ingress, integrations-ingress, firehose-ingress, webapi, logstashserver, and syslogserver.
Those addresses serve the web application only, and they change without notice. A configuration built on them appears correct while your data is still being dropped, so allow only what the tables above list.
These hostnames are real endpoints on your region's earlier domain, where they resolve to the addresses in the Additional direct endpoints still live in DNS row. The guidance in this section applies to the <region>.coralogix.com domain.
Region-specific exceptions
- EU2 and AP3: the
ingressandsyslogendpoints have not yet moved onto the region CIDR range. Add the CIDR range to your allowlist now and keep the addresses in the Additional direct endpoints row. We'll announce the cutover and the deprecation of the earlier addresses in advance. - US2 and AP3: some outbound addresses in these regions can still change. Allow the full list for the region, and re-check this page if outbound connections from Coralogix start failing.
- US3: this region runs on Google Cloud and has no CIDR range. Inbound endpoints are individual addresses, listed in the Additional direct endpoints row. Outbound addresses are allocated dynamically and shared across a wider cloud network, so they cannot be published as a stable allowlist yet. Contact Support if you need an interim set.
Action required
- Update your allowlists: add the inbound and outbound addresses for your region to your firewall or security group configuration.
- Move to the regional DNS endpoints: update your integrations and SDKs to use
<region>.coralogix.com. - Keep your earlier addresses in place: add the CIDR range without removing the addresses you already allow. We'll announce deprecations in advance.