Documentation +

Static IP guide

Connecting to an SFTP server with a static IP from a Node app on Heroku

Plenty of partner integrations still end in a nightly file drop to an SFTP server that only accepts known IPs. Rather than teaching an SFTP client about SOCKS, run Fixie-Wrench in your dyno: it forwards a local port through Fixie Socks, and your Node code (ssh2, ssh2-sftp-client) connects to localhost as if the server were local.

RuntimeNode.js and JavaScript
PlatformHeroku
DestinationSFTP
Fixie productFixie Socks Heroku add-on

Recommended setup

Use Fixie Socks Heroku add-on for SFTP transfers or SSH-based file workflows that require a fixed source IP. Store the proxy value in FIXIE_SOCKS_HOST, then configure Node.js to route outbound traffic through Fixie before connecting to SFTP.

Set up Fixie on Heroku

Heroku is a native Fixie marketplace flow. Install the Fixie Socks Heroku add-on or attach it from the Heroku CLI. Heroku will create FIXIE_SOCKS_HOST as a config var for the app.

Attach fixie-socks to your Heroku app

heroku addons:create fixie-socks
heroku config:get FIXIE_SOCKS_HOST

Implementation

The example below shows the core application-side change. Keep credentials in environment variables and avoid committing proxy, database, or API secrets.

Forward a local port to SFTP through Fixie Socks

# Install Fixie-Wrench in your app build or deploy process.
/bin/bash -c "$(curl -fsSL https://raw.githubusercontent.com/usefixie/fixie-wrench/HEAD/install.sh)"

# Start a tunnel from localhost:2222 to sftp.example.com:22.
# Your Node app connects to localhost:2222; Fixie handles the outbound static IP.
./bin/fixie-wrench 2222:sftp.example.com:22

Good to know

  • Start the tunnel in your Procfile ahead of the app, e.g. worker: ./bin/fixie-wrench 2222:sftp.example.com:22 & node upload.js.
  • Point your SFTP client at host 127.0.0.1, port 2222 — the tunnel delivers the connection to the real server's port 22 from a Fixie IP.
  • SSH host-key verification still works through the tunnel, but the client records the key under localhost; pin the server's key explicitly if your library supports it.

Allowlist and test the static IPs

  1. Open the Fixie dashboard and copy the outbound IP addresses for this proxy.
  2. Add both IPs to the SFTP server firewall.
  3. Deploy the updated Node.js app on Heroku.
  4. Run a small connection test before sending production traffic.

Related guides

Related docs

Is this guide useful?