Skip to main content
Last updated on

Connect to public on-premises endpoints using outbound IP addresses

Preview

This feature is in Public Preview.

Databricks publishes the public IP ranges that serverless compute uses to reach services over public networks. You can allowlist these IP ranges on the firewalls that protect your public endpoints. This is the simplest option for connecting serverless compute to on-premises services that are reachable over the internet.

What problem it solves​

Databricks provides a regularly updated set of public IP ranges that serverless compute uses to connect to publicly accessible services protected by firewalls. You can get these IP ranges from a public JSON endpoint and filter them by region and cloud platform.

The serverless outbound IP ranges are different from the NAT gateway or stable egress IP addresses that you configure for classic compute in your workspace.

When to use outbound IP addresses​

Use outbound IP addresses when the target resources that you want to access from serverless compute have public endpoints protected by a firewall, and public access is acceptable. For example:

  • Software as a service (SaaS) services such as Workday, ServiceNow, Salesforce, and Confluence.
  • External APIs or databases.
  • Customer-hosted services.

How it works​

  1. Databricks publishes the outbound IP ranges for serverless compute in ip-ranges.json.
  2. You filter the file to the entries for your cloud platform and workspace region, and allowlist those IP ranges on the firewalls that protect your public endpoints.
  3. You automate updates to your allowlist as Databricks changes these IP ranges over time.

Serverless compute reaching publicly accessible on-premises or SaaS endpoints over the internet from published Databricks IP ranges.

For detailed steps, see Configure access to other resources using outbound IP addresses.

Considerations​

Review the following before you use outbound IP addresses:

  • Databricks can update the outbound IP ranges as often as every 30 days. See Automate updates to keep your allowlist current.
  • The legacy lists of stable IP addresses are decommissioned. Use the published JSON endpoint instead.
  • Automate updates to your firewall rules. Outdated firewall rules can disrupt serverless workloads.

Additional resources​

On this page