Service eligibility and regional restrictions
PuppyIP serves only compliant overseas businesses and their authorized personnel. Proxy services are not available in mainland China. The service may only be used for lawful business activities outside mainland China. Use of this service within mainland China is prohibited.
Hosting a proxy IP or server overseas does not change these restrictions. The service must not be provided to end users in mainland China through relaying, forwarding, sharing or resale. Before use, read the Terms of Service.
Key Takeaways
- Google Cloud announced Datastream availability in Johannesburg (africa-south1) and Bangkok (asia-southeast3) on November 2, 2026.
- For public IP allowlisting, configure the source database firewall and select the Datastream service egress addresses for the resource's creation region.
- Each new region has five documented public addresses; allow only the set matching the region where the resource will be created.
- Connection profiles hold reusable authentication and network settings, and a stream can use only a profile stored in the same region.
- RUN TEST checks Datastream-to-source communication. A profile can still be saved after a failed test, so saving does not prove connectivity or active replication.
New regions and the addresses to use
Google Cloud's November 2, 2026 release notes add Datastream in Johannesburg (africa-south1) and Bangkok (asia-southeast3). With public IP allowlisting, the source database firewall must accept incoming connections from Datastream's public IP set for the region where the Datastream resource is created. The resource region, not operator location, destination region, or client proxy egress, selects the set.
The documented Johannesburg (africa-south1) addresses are 34.35.2.230, 34.35.23.160, 34.35.28.2, 34.35.49.66, and 34.35.131.221. The Bangkok (asia-southeast3) addresses are 34.15.139.209, 34.15.150.17, 34.15.151.88, 34.15.157.119, and 34.15.161.236. Use only the five-address set for the region you plan to use.
These addresses are Datastream's source-side public egress addresses, not customer access addresses or a general proxy list. Recheck the official allowlists page before changing a firewall, and match the full set to the planned resource region.
Choose the stream and profile region first
Choose the stream region before creating its profile. Profiles hold reusable authentication and network settings, and a stream can use only a profile stored in the same region. Region alone does not decide source or destination reachability, though a regional outage can affect availability.
The November 2 announcement adds regional availability; it does not say existing streams migrate or resources change region. For an existing deployment, verify current resource regions and assess any new design separately.
Regional availability does not confirm that your project, source type, or account is ready. Check current documentation, supported sources, account access, pricing, and quotas in the target project; the release note does not verify project-specific conditions.
Keep source firewall rules narrow
Confirm the source database's public endpoint, listening port, TLS requirements, and replication privileges with the database or network owner. Add the matching Datastream addresses to the source firewall or managed database network rules. The direction is necessary incoming access from Datastream to the source, not an entry in an unrelated outbound proxy configuration.
Allow only the required source addresses and source service port. Do not use 0.0.0.0/0 as a troubleshooting shortcut. Having the five Datastream addresses in a rule does not provide a database login, network route, successful TLS verification, or replication privileges; complete the source-specific prerequisites in the relevant documentation.
Public IP allowlisting is one of Datastream's network connectivity methods. SSH forwarding and private connectivity have separate tunnel, host, or private-network requirements; they are not the same configuration under another name. Configure the method you actually selected, and do not switch connectivity types without reviewing the network design.
Create a profile and test the connection
In the connection profile, select the actual source database type and planned region, then enter the source hostname or IP, port, authentication details, and required encryption settings. For public IP allowlisting, point the profile at a public source endpoint Datastream can reach, then explicitly select IP allowlisting as the network connectivity method.
RUN TEST in the profile creation flow checks whether Datastream can communicate with the source database. If the test fails, its result identifies the stage with an issue. Use that signal to review connectivity settings, firewall rules, and source prerequisites, then test again. A saved firewall rule alone is not a substitute for this check.
Datastream lets you create a connection profile even when its test fails, so “saved” does not mean “connection passed.” The connection test also does not mean a stream has started or replication is running; check stream status and replication monitoring separately. This article did not connect to a project, database, or network and did not run a test.
Pre-launch checks and limits
Before launch, record the Datastream resource region, connection profile region, all five exact addresses, source firewall rule, and RUN TEST result. Confirm that the stream references that profile. Compare the complete africa-south1 or asia-southeast3 list address by address; a shared prefix is not a reason to allow a wider range.
The regional announcement establishes availability in Johannesburg and Bangkok. It does not guarantee account authorization, database compatibility, quota, price, or successful replication. Use current documentation, the target account's configuration, and actual test results as release evidence.
If Google updates the allowlist page, verify the full list again when planning a new network change and ask the database or network owner to review its scope. Keep source access to the minimum required; the regional launch is not a reason to broaden access to other sources or services.
Sources
Frequently Asked Questions
What if one source database serves streams in both regions?
Check each stream’s actual region and its complete address set separately; each stream still needs a connection profile in the same region. Source rules may need to retain necessary addresses for several regions in use. A new stream’s five addresses are not a reason to remove rules required by other working streams.
What should I provide when a connection test still fails?
Provide the resource and profile regions, source database type, test time and time zone, failed stage, redacted error, and the rule change being investigated. Do not publish database passwords, keys, or complete authentication connection strings. Follow the official diagnostic flow for the reported stage.