---
sidebar_position: 5
title: Dedicated egress IP
---

# Dedicated egress IP

By default, every Zibby agent exits via a random AWS IP that changes every run.
For most customers that's fine — but if your agent needs to talk to a service
behind a firewall (private GitLab, Salesforce, Oracle Cloud, internal API behind a
corporate VPN), the random-IP behavior makes it unusable.

The **dedicated egress IP** addon pins all your agent's outbound traffic to a
single static IP that you can whitelist once on the destination service.

## Pricing

**$50/month per account.** All your projects share the same IP.

## How it works

```
   Your Fargate task (random IP per run)
        │
        │  All HTTPS traffic tunneled through:
        ▼
   ┌──────────────────────────────────┐
   │  Zibby's egress proxy            │
   │   - Validates your auth          │
   │   - Routes via YOUR static IP    │
   └──────────────────────────────────┘
        │
        ▼
   Internet (sees your static IP, e.g. 54.66.241.180)
```

Every outbound HTTPS call from your agent exits via your dedicated IP:

| What | Whether it tunnels |
|---|---|
| `fetch()` from agent code | ✅ via static IP |
| `git clone` private repos | ✅ via static IP |
| `npm install` from private registries | ✅ via static IP |
| `curl` / `wget` in shell scripts | ✅ via static IP |
| AWS SDK calls (S3, DynamoDB) | ❌ direct (AWS doesn't care about source IP) |

## Enabling

```bash
# 1. Enable the addon for your account (paid)
zibby deploy --dedicated-ip enable

# Output:
#   Provisioning your dedicated egress IP...
#   Done in 8s.
#
#   Your static IP: 54.66.241.180
#
#   Add this to your firewall allowlist, then opt projects in:
#     zibby deploy --dedicated-ip use --project <project-id>

# 2. Opt each project in (free)
zibby deploy --dedicated-ip use --project my-project
```

## Checking status

```bash
zibby deploy --dedicated-ip status

# Output:
#   Dedicated egress IP: active
#
#   Your static IP:  54.66.241.180
#   Provisioned:     2026-05-02
#
#   Projects opted in:
#     ✓ my-project
#     ✗ other-project (not opted in)
```

## Whitelisting on common services

**GitLab self-hosted:**
```
Admin → Settings → Network → Outbound requests
→ Allowlist: 54.66.241.180
```

**GitHub Enterprise:**
```
Site admin → Authentication → IP allowlist
→ Add: 54.66.241.180
```

**AWS Security Group (e.g. for a private RDS/ECS endpoint):**
```
Inbound rule → HTTPS → Source: 54.66.241.180/32
```

**Salesforce:**
```
Setup → Network Access → Trusted IP ranges
→ Add: 54.66.241.180 to 54.66.241.180
```

## What stays the same

Your IP is **stable for as long as you have the addon enabled**:

- Survives Zibby infrastructure changes (we replace proxy boxes regularly)
- Survives our region failovers
- Survives your own agent redeploys

The only way the IP changes is if **you** disable the addon, in which case the IP
is released back to AWS at the end of your billing period.

## Disabling

```bash
zibby deploy --dedicated-ip disable
```

The IP stays attached until the end of your current billing period (no immediate
proration). After that, the IP is released.

If you re-enable later, you'll get a **different** IP — we can't guarantee the
same one. Re-whitelist on your destination services if you re-enable.

## Per-project IPs

Currently every project on your account shares the same IP. If you need separate
IPs per project (for compliance isolation, dev/staging/prod separation, etc.),
contact support.

## Limitations

- Currently only available in `ap-southeast-2` (Sydney). Multi-region coming.
- Only IPv4. No IPv6 yet.
- Outbound only. We don't host inbound services on your IP.