Simple FTP Service
Static IP addresses and ports
The connection and data IP addresses for each Simple FTP Service region, what to allowlist in your firewall or storage ACL, and which ports to open.
Updated August 27, 2026If your firewall only allows outbound connections to known addresses, or you lock your storage down with an ACL, these are the IP addresses the Simple FTP Service uses in each region.
Two kinds of address are involved:
- Connection IP addresses are where your client connects for FTP, FTPS
and SFTP - the addresses behind
static-sfs-<region>.docevent.io. - Data IP addresses are where FTP data connections come from once an FTP session is established.
This page covers what your users' firewalls need to allow. If you are restricting the storage bucket behind your service instead, that list is at Backend storage IP addresses.
What you need to allowlist depends on how your users connect - answer the two questions below and the lists, ports and lookup commands adjust to your setup:
How do your users connect to the service?
Which region does your service run in?
Allowlist BOTH the connection and data IP addresses and open every port row below - this covers SFTP, FTP and FTPS together.
IP addresses - us-east-1
| Connection IP addresses | Data IP addresses |
|---|---|
| 3.213.216.51 | 3.210.142.47 |
| 3.216.131.83 | 3.211.167.134 |
| 3.219.3.70 | 18.209.207.68 |
| 3.219.98.225 | 35.168.146.20 |
| 35.173.159.53 | 52.4.181.92 |
| 35.175.92.86 | 52.6.253.28 |
| 52.71.75.143 | |
| 52.71.138.25 | |
| 52.201.2.103 | |
| 52.206.73.31 |
Connection addresses resolve from
static-sfs-us-east-1.docevent.io.Restricting your backend storage bucket as well? That uses its own list, and it is the same for every protocol - see Backend storage IP addresses.
Ports to allow
| Service / protocol | Ports |
|---|---|
| SFTP / scp | 22 |
| FTP explicit (most FTP connections) | 21, plus data ports 9000-33279 |
| FTP implicit (FTPS on port 990) | 990, plus data ports 33280-51677 |
The explicit-FTP data range starts at 9000. An older allowlist using 2377-33279 still covers everything in use - the range was narrowed, not moved - but new entries should use 9000-33279.
Verify the connection addresses yourself
The connection addresses are exactly what
static-sfs-us-east-1.docevent.io resolves to - you can confirm them any time:Windows
macOS
Linux
dig +short static-sfs-us-east-1.docevent.iodig is preinstalled on macOS.