We're sorry for the trouble. We're aware of an incident, External network blocks affecting access to Railway, affecting public networking in US East, US West, EU West and Southeast Asia as well as the dashboard, and we're working on it.

A third party is sending scanning traffic with forged Railway source IP addresses. That traffic does not come from our network. Because of it, some network providers and security services have blocked Railway IP addresses, so clients on those networks can't reach Railway-hosted applications. We've asked security vendors to review the blocks and are working with network operators to restore access. We don't have an estimated time yet for every affected network to lift its blocks.

To restore access for affected clients now, ask their network administrator or provider to review any blocks on Railway IP addresses and send them the incident notice. They can allow legitimate access to your application and keep their protections against unsolicited scanning. Using a different network can also work as a temporary fix. Follow updates at the incident page.

Hello Railway Support Team,

Thank you for the information.

Could you please clarify what exactly my clients need to do to restore access to my applications hosted on Railway?

Should they contact their internet service provider (ISP) and ask them to whitelist or allow Railway's IP addresses, or should their company's network administrator change firewall, DNS, or security settings?

Since some of my clients are unable to access my services, I need clear instructions that I can forward to them.

Could you also provide:

The specific Railway IP addresses or IP ranges that need to be allowed.

Any required domains, ports, or protocols that should be whitelisted.

Whether this is an issue that Railway can resolve on its side without requiring every affected client to make network changes.

We need a reliable solution as soon as possible, as this issue is affecting access to our production services and our client

The block sits with whoever filters your clients' traffic. For a company network that is usually the network administrator's firewall or security product. For home or mobile connections it is usually the ISP or a DNS/security filtering service they use. Your clients should send this request to that party: allow legitimate traffic to Railway IP addresses and remove any block or reputation listing added because of the forged scanning traffic. They can include the incident notice they already have.

The inbound ranges your clients reach are 66.33.22.0/24 and 69.46.46.0/24. Traffic is standard HTTPS on TCP 443, plus TCP 80 if they use plain HTTP. These are anycast addresses, the list is not exhaustive, and it can change. Where a filter supports it, allowing your application's hostname is more reliable than allowing IPs. No DNS changes are needed unless their resolver is filtering your domain.

On our side, we have submitted review requests to the security vendors and are working with network operators to get the blocks lifted. Each network still has to remove its own block, and we don't have an estimated time for all of them yet. Until a network removes its block, using a different network is the only temporary workaround.

Hello Support tteam!

All my services unreacheble from external networks since morning! Please share any details of restoring accssess.