# Secure a Managed ClickHouse® service

You can secure your Managed ClickHouse® service in a few different ways, for example by restricting network access and enabling service termination protection.

## Restrict network access to your service

One of the most fundamental ways to keep your service secure is managing its network access
properly. Access is controlled by the service IP filter, which lists the CIDR blocks allowed to
connect. Set it when you create the service, or update it at any time:

```bash
echo '{"ip-filter":["203.0.113.0/24"]}' | \
  exo x update-dbaas-service-clickhouse my-clickhouse -z ch-gva-2
```

Read the current filter back with:

```bash
exo x get-dbaas-service-clickhouse my-clickhouse -z ch-gva-2 -q '"ip-filter"'
```

> [!NOTE]
> The IP filter applies to every interface of the service, including the Prometheus scrape
> endpoint. A connection from an address that is not allowed times out rather than returning an
> authentication error.

## Protect a service from termination

Exoscale services can be protected against accidental deletion or powering
off by enabling the Termination Protection feature.

```bash
echo '{"termination-protection":true}' | \
  exo x update-dbaas-service-clickhouse my-clickhouse -z ch-gva-2
```

> [!NOTE]
> Termination Protection has no effect on service migrations or upgrades.

### Terminate a protected service

Before terminating a protected service, disable Termination Protection for this service:

```bash
echo '{"termination-protection":false}' | \
  exo x update-dbaas-service-clickhouse my-clickhouse -z ch-gva-2
```

> [!NOTE]
> Running out of free Exoscale sign-up credits stops your services unless a
> payment method has been added to your Exoscale organization.