{"meta":{"title":"Network details for GHE.com","intro":"Ensure client systems can access your resources on GHE.com.","product":"Enterprise administrators","breadcrumbs":[{"href":"/en/enterprise-cloud@latest/admin","title":"Enterprise administrators"},{"href":"/en/enterprise-cloud@latest/admin/data-residency","title":"Data residency"},{"href":"/en/enterprise-cloud@latest/admin/data-residency/network-details-for-ghecom","title":"Network details"}],"documentType":"article"},"body":"# Network details for GHE.com\n\nEnsure client systems can access your resources on GHE.com.\n\nTo access your enterprise on GHE.com, client systems must:\n\n* Trust GitHub's SSH key fingerprints\n* Have access to GitHub's hostnames and IP addresses\n\n## GitHub's SSH key fingerprints\n\nTo find these details, use the `/meta` API endpoint for your instance. For example, using the GitHub CLI:\n\n```shell\ngh api /meta --hostname octocorp.ghe.com\n```\n\nFor more information, see [REST API endpoints for meta data](/en/enterprise-cloud@latest/rest/meta/meta).\n\n## Using SSH with GHE.com\n\nTo clone a repository using Git over SSH from `SUBDOMAIN.ghe.com`, where SUBDOMAIN is your enterprise's dedicated subdomain on GHE.com, use the SUBDOMAIN as the SSH username instead of `git`.\n\n```shell\ngit clone SUBDOMAIN@SUBDOMAIN.ghe.com:OWNER/REPO.git\n```\n\n## GitHub's hostnames\n\n* `*.SUBDOMAIN.ghe.com`, where SUBDOMAIN is your enterprise's dedicated subdomain on GHE.com\n* `*.pages.SUBDOMAIN.ghe.com`\n* `*.actions.SUBDOMAIN.ghe.com`\n* `*.githubassets.com`\n* `*.githubusercontent.com`\n* `*.blob.core.windows.net`\n* `auth.ghe.com`\n\n## GitHub's IP addresses\n\nGitHub's IP address ranges for enterprises on GHE.com depend on your chosen region.\n\n### The EU\n\n| Ranges for egress traffic | Ranges for ingress traffic |\n| ------------------------- | -------------------------- |\n| 108.143.221.96/28         | 108.143.197.176/28         |\n| 20.61.46.32/28            | 20.123.213.96/28           |\n| 20.224.62.160/28          | 20.224.46.144/28           |\n| 51.12.252.16/28           | 20.240.194.240/28          |\n| 74.241.131.48/28          | 20.240.220.192/28          |\n| 20.240.211.176/28         | 20.240.211.208/28          |\n\n### Australia\n\n| Ranges for egress traffic | Ranges for ingress traffic |\n| ------------------------- | -------------------------- |\n| 20.5.34.240/28            | 4.237.73.192/28            |\n| 20.5.146.128/28           | 20.5.226.112/28            |\n| 68.218.155.16/28          | 20.248.163.176/28          |\n\n### US\n\n| Ranges for egress traffic | Ranges for ingress traffic |\n| ------------------------- | -------------------------- |\n| 20.221.76.128/28          | 74.249.180.192/28          |\n| 135.233.115.208/28        | 48.214.149.96/28           |\n| 20.118.27.192/28          | 172.202.123.176/28         |\n\n### Japan\n\n| Ranges for egress traffic | Ranges for ingress traffic |\n| ------------------------- | -------------------------- |\n| 74.226.88.192/28          | 74.226.88.240/28           |\n| 40.81.180.112/28          | 40.81.176.224/28           |\n| 4.190.169.192/28          | 4.190.169.240/28           |\n\n## Supported regions for Azure private networking\n\nIf you use Azure private networking for GitHub-hosted runners, the supported Azure regions on GHE.com differ from those on GitHub.com.\n\n### Supported regions in the EU\n\n| Runner type | Supported regions                                                     |\n| ----------- | --------------------------------------------------------------------- |\n| x64         | `francecentral`, `swedencentral`, `germanywestcentral`, `northeurope` |\n| arm64       | `francecentral`, `northeurope`, `germanywestcentral`                  |\n| GPU         | `italynorth`, `swedencentral`                                         |\n\n### Supported regions in Australia\n\n| Runner type | Supported regions                   |\n| ----------- | ----------------------------------- |\n| x64         | `australiaeast`, `australiacentral` |\n| arm64       | `australiaeast`, `australiacentral` |\n| GPU         | `australiaeast`, `australiacentral` |\n\n### Supported regions in the US\n\n| Runner type | Supported regions                 |\n| ----------- | --------------------------------- |\n| x64         | `centralus`, `eastus2`, `westus3` |\n| arm64       | `centralus`, `eastus2`, `westus3` |\n| GPU         | `centralus`, `eastus2`, `westus3` |\n\n### Supported regions in Japan\n\n| Runner type | Supported regions        |\n| ----------- | ------------------------ |\n| x64         | `japaneast`, `japanwest` |\n| arm64       | `japaneast`, `japanwest` |\n| GPU         | `japaneast`              |\n\n### IP ranges for Azure private networking\n\n#### EU\n\nActions IPs:\n\n* 74.241.192.231\n* 20.4.161.108\n* 74.241.204.117\n* 20.31.193.160\n\nEU region:\n\n* 108.143.197.176/28\n* 20.123.213.96/28\n* 20.224.46.144/28\n* 20.240.194.240/28\n* 20.240.220.192/28\n* 20.240.211.208/28\n\n#### Australia\n\nActions IPs:\n\n* 4.147.140.77\n* 20.53.114.78\n\nAustralia region:\n\n* 4.237.73.192/28\n* 20.5.226.112/28\n* 20.248.163.176/28\n\n#### Japan\n\nActions IPs:\n\n* 20.63.233.164\n* 172.192.153.164\n\nJapan region:\n\n74.226.88.241\n40.81.176.225\n4.190.169.240\n\n#### Required for all regions\n\n* `Storage` service tag\n* Communication requirements for github.com\n  * 192.30.252.0/22\n  * 185.199.108.0/22\n  * 140.82.112.0/20\n  * 143.55.64.0/20\n  * 20.201.28.151/32\n  * 20.205.243.166/32\n  * 20.87.245.0/32\n  * 4.237.22.38/32\n  * 20.207.73.82/32\n  * 20.27.177.113/32\n  * 20.200.245.247/32\n  * 20.175.192.147/32\n  * 20.233.83.145/32\n  * 20.29.134.23/32\n  * 20.199.39.232/32\n  * 20.217.135.5/32\n  * 4.225.11.198/32\n  * 4.208.26.197/32\n  * 20.26.156.215/32\n\n### Domains for Azure private networking\n\n#### Required for all regions\n\n* `*.<TENANT>.ghe.com`\n* `<TENANT>.ghe.com`\n* `github.com`\n* `*.githubusercontent.com`\n* `*.blob.core.windows.net` (can be further restricted by region, see below)\n* `*.web.core.windows.net`\n\n#### EU\n\n`*.blob.core.windows.net` can be replaced with:\n\n* `memoryalphaprodsdc01.blob.core.windows.net`\n* `memoryalphaprodweu01.blob.core.windows.net`\n* `prodsdc01resultssa0.blob.core.windows.net`\n* `prodsdc01resultssa1.blob.core.windows.net`\n* `prodsdc01resultssa2.blob.core.windows.net`\n* `prodsdc01resultssa3.blob.core.windows.net`\n* `prodweu01resultssa0.blob.core.windows.net`\n* `prodweu01resultssa1.blob.core.windows.net`\n* `prodweu01resultssa2.blob.core.windows.net`\n* `prodweu01resultssa3.blob.core.windows.net`\n\n#### Australia\n\n`*.blob.core.windows.net` can be replaced with:\n\n* `memoryalphaprodae01.blob.core.windows.net`\n* `prodae01resultssa0.blob.core.windows.net`\n* `prodae01resultssa1.blob.core.windows.net`\n* `prodae01resultssa2.blob.core.windows.net`\n* `prodae01resultssa3.blob.core.windows.net`\n\n#### Japan\n\n`*.blob.core.windows.net` can be replaced with:\n\n* `memoryalphaprodjpw01.blob.core.windows.net`\n* `prodjpw01resultssa0.blob.core.windows.net`\n* `prodjpw01resultssa1.blob.core.windows.net`\n* `prodjpw01resultssa2.blob.core.windows.net`\n* `prodjpw01resultssa3.blob.core.windows.net`\n\n### OAuth callback URL for connecting an Azure subscription for billing\n\nWhen you connect or update an Azure subscription for billing, you must allow access to the following URL:\n\n* `https://github.com/enterprises/oauth_callback`\n\nThis URL is required during the OAuth authentication flow that occurs when:\n\n* Connecting an Azure subscription to your enterprise for the first time\n* Changing or updating an existing Azure subscription connection\n\n> \\[!IMPORTANT]\n>\n> * The URL must be allowed with all query parameters, for example `https://github.com/enterprises/oauth_callback?code=...`\n> * After the Azure subscription is successfully connected and the subscription ID is stored, you can remove this URL from your allowlist\n> * To change or update your Azure subscription, you must add the URL back to your allowlist\n\nThe OAuth flow works as follows:\n\n1. The user starts the connection process on `SUBDOMAIN.ghe.com`\n2. Azure redirects to `https://github.com/enterprises/oauth_callback` to complete the OAuth flow\n3. The system redirects back to `SUBDOMAIN.ghe.com` to finalize the connection\n\n## IP ranges for GitHub Enterprise Importer\n\nIf you're running a migration to your enterprise with GitHub Enterprise Importer, you may need to add certain ranges to an IP allow list. See [Managing access for a migration between GitHub products](/en/enterprise-cloud@latest/migrations/using-github-enterprise-importer/migrating-between-github-products/managing-access-for-a-migration-between-github-products#configuring-ip-allow-lists-for-migrations)."}