Skip to main content
If your organization uses a firewall to restrict access to your PSA, RMM, documentation system, or other integrated platforms, you need to whitelist Neo Agent’s IP address to ensure reliable connectivity.
This applies to any integration where your system is protected by a firewall or IP-based access control.

​
Neo Agent Static IPs

Add the following IP addresses to your firewall’s allowlist:
Add all of the addresses above, not just one. Different Neo services handle different work — verifying an integration when you connect it, and running the scheduled syncs afterwards — and they use different outbound IPs. Allowlisting only some of them produces an integration that connects successfully and then fails to sync, or the reverse.
If you don’t whitelist these IPs, Neo Agent may be unable to connect to your systems, resulting in failed syncs, API errors, or workflow interruptions.

​
Is an IP block actually your problem?

An IP block and a bad API key produce different errors, and the fixes don’t overlap. Neo’s error messages name which one you’re hitting:
Some platforms host the allowlist themselves rather than leaving it to your firewall, so Neo is blocked even though nothing on your own network is. IT Glue is the common one: Account → Settings → IP Access Control restricts both web login and API access to the addresses listed there. Lexful has the same kind of control under Platform → IP restrictions — if you use it, add the addresses above there too.Hudu has two of its own IP controls that can block the REST API, and either can be the cause. The API key’s own IP allow list (Admin → Account Administration → API Keys → your key → IP allow list) applies on cloud and self-hosted instances alike. Separately, account-level IP Access Control (Admin → Security → IP Access Control) also applies to REST API requests as of Hudu 2.45 — so if it is on, Neo’s addresses have to be listed there too. On a cloud instance (*.huducloud.com) you have no firewall of your own in front of Hudu, so these two Hudu controls are the places to check.ThreatLocker can also restrict Portal API access by geolocation rather than by address. The refusal reads Unauthorized - Request was made from a disallowed geolocation, and no key change fixes it: the restriction has to permit the United States — all three addresses above egress from US regions — or be turned off for your API user.

​
Where to Apply

You may need to whitelist this IP in several places depending on your setup:

PSA Systems

Autotask, ConnectWise, HaloPSA, and other PSA platforms that restrict API access by IP.

RMM Platforms

Datto RMM, NinjaRMM, ConnectWise Automate, and other RMM tools with IP restrictions.

Documentation Systems

IT Glue, Hudu, Lexful, and other documentation platforms with firewall rules or their own IP allowlist.

Other Integrations

Microsoft 365, Teams, Slack, and any other service with IP-based access controls.