When you add a new data source, is the connection from the local GD instance to the data source, or from one of these IPs to the data source? (The documentation doesn't say what they are for, just that they are needed)

It is applicable only for the GoodData Cloud. If you use GD.CN the connection is initiated from where you run the GD.CN.

Got it. thank you