> AI agents: this is one page from Mammoth Analytics documentation. The index of all pages as Markdown is https://mammoth.io/docs/llms.txt. Append `.md` to any docs URL, or send `Accept: text/markdown`, to get Markdown.

# Allow Mammoth through your firewall: IP address and ports

> Find the IP address Mammoth connects from, default ports and firewall steps for database, warehouse, SFTP, Kafka, MQTT and IMAP connectors, plus SSH tunnels.

Database and file server connectors need Mammoth's servers to reach your systems over the internet. If your database, warehouse or SFTP server sits behind a firewall, add the IP address shown on the connector's connection form to your allowlist before you click **Connect**. OAuth connectors such as Google Drive, Salesforce, HubSpot and Shopify reach vendor-managed APIs and need no firewall rule on your side.

## Which connectors need a firewall rule

These connectors connect directly to your systems. Their connection forms show a message with the IP address Mammoth connects from.

| Connector | Default port | Protocol |
| --- | --- | --- |
| PostgreSQL | 5432 | TCP |
| MySQL | 3306 | TCP |
| SQL Server | 1433 | TCP |
| MongoDB | 27017 | TCP |
| Snowflake | 443 | HTTPS |
| Apache Hadoop | 10000 | TCP |
| Databricks | 443 | HTTPS |
| SAP HANA | 443 (form default); confirm with your admin | TCP |
| Oracle Database | 1521 | TCP |
| Amazon Redshift | 5439 | TCP |
| SFTP | 22 | SSH |
| SendGrid | 443 | HTTPS |
| Apache Kafka | Your brokers' ports | TCP |

These connectors also connect out to a server you run, so allow Mammoth through your firewall for them too. Their connection forms don't show the IP address (see [Find Mammoth's IP address](#find-mammoths-ip-address)).

| Connector | Default port | Protocol |
| --- | --- | --- |
| MQTT | 1883, or 8883 for TLS | TCP |
| Email (IMAP) | 993 (SSL/TLS) or 143 (STARTTLS) | TCP |

Google BigQuery and Parquet (Azure) connect over standard HTTPS and don't need a firewall rule in typical set-ups. See their sections below if you restricted access on your side.

## Find Mammoth's IP address

When you connect one of the connectors in the first table, the connection form shows the IP address Mammoth connects from:

- Database forms: "Please make sure IP 203.0.113.10 is whitelisted in your database settings."
- The SFTP form: "Mammoth connects from IP 203.0.113.10. Add it to your server's allowlist if needed."

(203.0.113.10 is an example; use the address your form shows.) For MQTT and Email (IMAP), copy the address from another connector's form in the same workspace, or ask Mammoth support.

Allow that IP address in your firewall before you click **Connect**. In the examples below, `<MAMMOTH_IP>` stands for the address shown on the form.

## Allow Mammoth to reach PostgreSQL

1. Open your `pg_hba.conf` file (typically at `/etc/postgresql/16/main/pg_hba.conf`, where 16 is your version).
2. Add a line for Mammoth's IP:

   ```plaintext
   host    your_database    your_user    <MAMMOTH_IP>/32    md5
   ```
3. Reload PostgreSQL: `sudo systemctl reload postgresql`.
4. If the server is behind a cloud security group (AWS, GCP, Azure), also open port **5432** inbound from Mammoth's IP in the security group.

### Connect PostgreSQL through an SSH tunnel

If your PostgreSQL server is reachable only through an SSH bastion host:

1. Open **Connection options** on the PostgreSQL form.
2. Tick **Connect through an SSH tunnel**.
3. Enter the **SSH host**, **SSH port** (default `22`), **SSH user**, and a password or private key under **SSH sign-in**.

Mammoth then connects to the bastion, so allow Mammoth's IP on the bastion's SSH port instead of opening the database port. See the [PostgreSQL connector](https://mammoth.io/docs/learn/get-data-in/connectors/postgresql/).

## Allow Mammoth to reach MySQL

1. Sign in to MySQL as an admin user.
2. Create a user that can connect from Mammoth's IP and grant it read access:

   ```sql
   CREATE USER IF NOT EXISTS 'your_user'@'<MAMMOTH_IP>' IDENTIFIED BY 'password';
   GRANT SELECT ON your_database.* TO 'your_user'@'<MAMMOTH_IP>';
   ```
3. Open port **3306** inbound in your firewall or cloud security group.

## Allow Mammoth to reach SQL Server

1. Open **SQL Server Configuration Manager**.
2. Under **SQL Server Network Configuration → Protocols**, make sure **TCP/IP** is enabled.
3. In your firewall or Windows Firewall, add an inbound rule allowing port **1433** from Mammoth's IP.
4. For cloud-hosted instances (Azure SQL, AWS RDS), update the inbound security group rules too.

## Allow Mammoth to reach MongoDB

1. Open your `mongod.conf` file.
2. Under `net:`, make sure `bindIp` allows connections from outside the host (or restrict access at the network level with a firewall).
3. Add an inbound rule allowing port **27017** from Mammoth's IP in your firewall or cloud security group.
4. Give your MongoDB user at least `read` access on the database.

## Allow Mammoth to reach other databases and warehouses

| Connector | What to do |
| --- | --- |
| Oracle Database | Open port **1521** (or your listener's port) inbound from Mammoth's IP in your firewall or cloud security group. See the [Oracle Database connector](https://mammoth.io/docs/learn/get-data-in/connectors/oracle/). |
| Amazon Redshift | Add an inbound rule for port **5439** (or your cluster's port) from Mammoth's IP to the cluster's VPC security group, and make sure the cluster is publicly reachable. See the [Amazon Redshift connector](https://mammoth.io/docs/learn/get-data-in/connectors/redshift/). |
| Snowflake | If your account has a **network policy** that restricts IP access, add Mammoth's IP address to that policy's allowed IP list. |
| Apache Hadoop (Hive) | Open port **10000** inbound from Mammoth's IP in your firewall or cloud security group. |
| Databricks | If your workspace restricts access by IP, add Mammoth's IP address to the workspace's IP access list. See the [Databricks connector](https://mammoth.io/docs/learn/get-data-in/connectors/databricks/). |
| SAP HANA | Open your HANA instance's listening port inbound from Mammoth's IP. The port varies by instance: confirm it with your HANA administrator. See the [SAP HANA connector](https://mammoth.io/docs/learn/get-data-in/connectors/sap-hana/). |
| Google BigQuery | No firewall rule. BigQuery authenticates with a Google Cloud service account JSON key over HTTPS, and access is controlled by IAM permissions on the service account. |
| Parquet (Azure) | Reads from Azure Data Lake Storage over HTTPS. If you restricted the storage account with Azure storage firewalls or virtual networks, allow Mammoth's outbound IP address there. Contact Mammoth support to confirm the address for your workspace. |

## Allow Mammoth to reach SFTP, Kafka, MQTT, IMAP and SendGrid

| Connector | What to do |
| --- | --- |
| SFTP | Open the port your SFTP server listens on (default **22**) inbound from Mammoth's IP. For password sign-in, make sure the SFTP user exists and can read the directory. For key-based sign-in, see the [SFTP connector](https://mammoth.io/docs/learn/get-data-in/connectors/sftp/). |
| Apache Kafka | Allow Mammoth's IP to reach every broker listed in **Bootstrap Servers**, on the ports in that list. See the [Apache Kafka connector](https://mammoth.io/docs/learn/get-data-in/connectors/kafka/). |
| MQTT | Allow Mammoth's IP to reach your broker's port: `1883` by default, or `8883` for TLS. See the [MQTT connector](https://mammoth.io/docs/learn/get-data-in/connectors/mqtt/). |
| Email (IMAP) | Mammoth signs in over IMAP: port `993` for **SSL/TLS (port 993)** or `143` for **STARTTLS (port 143)**. Hosted mail services such as Gmail need no firewall rule; a self-hosted mail server needs that port open to Mammoth's IP. See the [Email (IMAP) connector](https://mammoth.io/docs/learn/get-data-in/connectors/email-imap/). |
| SendGrid | If your account restricts API access by IP, add Mammoth's IP address (shown on the SendGrid connection form) to the allowed list. Otherwise Mammoth's requests to your account may be blocked. |

## Use a custom port

If your database runs on a non-standard port, enter it in the **Port** field of the connection form, and make sure that port is open inbound from Mammoth's IP.

## Test the connection after allowing the IP address

1. Fill in the connection form.
2. Click **Connect**.

Mammoth checks the credentials and saves the connection. If the check fails, the error message appears at the bottom of the form.

## Troubleshooting firewall and network errors

| Symptom | Cause | Fix |
| --- | --- | --- |
| An error at the bottom of the connection form after **Connect** | Mammoth's IP isn't in your allowlist | Add the IP shown on the form to your firewall, security group or network policy |
| The connection times out or is refused | The port isn't open | Open the port from the tables above, or your custom port, inbound from Mammoth's IP |
| Sign-in is refused although the IP is allowed | The database user can't connect from an external host | Allow the user to connect from Mammoth's IP (for example the MySQL `'your_user'@'<MAMMOTH_IP>'` user, or a `pg_hba.conf` line) |
| The PostgreSQL server is only reachable through a bastion | The database port isn't public | Use **Connect through an SSH tunnel** and allow Mammoth on the bastion's SSH port |

For other connection problems, see [Troubleshooting](https://mammoth.io/docs/learn/help/).

## Related

- [Connect a database or app](https://mammoth.io/docs/learn/get-data-in/connect-a-source/): the connection form and connector workspace.
- [Manage saved connections](https://mammoth.io/docs/learn/get-data-in/connections/): health status and fixing a connection.
- [Query a database and choose how it refreshes](https://mammoth.io/docs/learn/get-data-in/query-a-database/): what to do once you are connected.
- [Security](https://mammoth.io/docs/learn/workspace/security/): how Mammoth protects your data.

---
Source: https://mammoth.io/docs/learn/get-data-in/network-requirements.md · Updated: 2026-11-08