# Network Access Control
![`smart`](TiDBCloudNetworkAccessControl_aa_001_20231025.png)
![`smart`](TiDBCloudAllowedIP_aa_001_20231025.png)
+ Project settings
  + Project CIDR
  + VPC Peering
+ Cluster settings
  + Private Endpoint
  + Allowed IP Access List

------------------------------------------------------------------------------
TiDB Cloud project uses project CIDR to set the network address range (CIDR) for each VPC in all regions. Choose the IP address range carefully to prevent overlapping CIDR with your existing VPCs or data centers.

IP Access List currently only supports IPv4 and cannot configured through Open API. 20 entries per cluster limit will be added soon. Also, it is not supported in TiDB Serverless.

By using a VPC peering connection, customers can access TiDB clusters in a private way. Currently, VPC peering is configured at the project level. Note that VPC peering is not available for TiDB Serverless clusters. VPC peering is not transitive, which means if A peers with B, B peers with C, A and C are not reachable from each other. If you need to access TiDB from multiple VPCs, multiple peers have to be established. TiDB Cloud CIDR at the project level and the CIDR of the peered VPC must not overlap. Currently TiDB Cloud only supports peering in the same region.

Private Endpoint is the preferred way for connecting to TiDB Cloud privately. By using private endpoint, no CIDR planning is necessary. The endpoint appears as a normal IP in the destination VPC. Also, there will be no overlapping CIDR issue any more. Moreover, by using private endpoint, two VPCs are still separate. The only traffic allowed is the one between TiDB clusters and the user applications.

The screenshot on the slide shows the IP Access List which is a allow list.