Network Allowlist
Static outbound IP addresses MeshMesh sandboxes use, for firewall and API allowlist configuration
When MeshMesh agents run tasks, they make outbound API calls to Salesforce, Marketing Cloud, your custom endpoints, and other services on your behalf. This traffic originates from a small, fixed set of static IP addresses, so your security team can allowlist them in firewalls, API gateways, and IP-restricted Salesforce orgs.
For IP-restricted integrations (e.g. Marketing Cloud, GitHub Enterprise), allowlist all four addresses below.
IP addresses to allowlist
| IP Address | Purpose | Region |
|---|---|---|
100.61.61.143 | Sandbox egress (data/API calls) | US East |
44.198.225.5 | Sandbox egress (data/API calls) | US East |
54.197.82.120 | Sandbox egress (data/API calls) | US East |
209.71.102.179 | Platform egress (OAuth token refresh) | US East |
Allowlist all four. The three sandbox IPs carry the agents' data/API calls (a task may exit through any of them — we rotate across the pool for high availability). The fourth is the platform egress: some calls are made by the MeshMesh platform itself rather than the sandbox — most notably OAuth token exchange/refresh (e.g. Marketing Cloud's /v2/token). If you allowlist only the sandbox IPs, data calls succeed but token refresh can fail — so include the platform egress IP too.
Stability guarantees
- IPs are stable. Reserved at the cloud level and persist across host failures and infrastructure rotations. We do not change them without prior notice.
- We will notify you at least 30 days in advance via email if any IP needs to change for any reason.
- We may add IPs as we scale (additional regions, increased capacity). New IPs will be announced ahead of time. Existing IPs will continue to work.
Recommended allowlist entries
Use individual /32 entries — these IPs are not contiguous:
# Sandbox egress (data/API calls)
100.61.61.143/32
44.198.225.5/32
54.197.82.120/32
# Platform egress (OAuth token refresh, e.g. Marketing Cloud)
209.71.102.179/32Verifying connectivity
To confirm your allowlist is working, run a test task that calls your endpoint and check your edge logs for inbound traffic from one of the listed IPs. If you'd like help verifying the setup, contact your MeshMesh representative.
Regions
MeshMesh sandboxes currently run in US East. If your security policy requires data to remain in a specific region (EU, APAC, etc.), reach out — we can deploy dedicated regional infrastructure.
Frequently asked questions
Why do you use multiple IPs instead of one? For reliability. A single IP would mean a single point of failure: a hardware issue, network event, or maintenance window could cause sandbox traffic to drop. Multiple IPs let us route around any individual host without customer impact.
Will the same task always use the same IP? Not necessarily. A task that runs for an extended period or pauses and resumes may move between hosts and exit IPs. All exit IPs are within the listed pool.
Are these IPs shared with other MeshMesh customers? Yes — they are shared infrastructure. Your traffic is authenticated end-to-end (TLS to your endpoints) and never co-mingled with other tenants' data. The shared IPs are only the egress address.
What if my organization's security policy doesn't allow shared egress IPs? Contact your MeshMesh representative — we can discuss dedicated egress IPs for enterprise customers.