ApsaraMQ for RocketMQ:Configure IP address whitelists

Prerequisites

Before you begin, make sure that you have:

• An ApsaraMQ for RocketMQ instance

• Permissions to manage access control settings for the instance

Notes

Before you configure an IP address whitelist, take note of the following items:

• Connection scope — The IP address whitelist controls only whether a client can establish a new connection to the instance. Removing an IP address from the whitelist does not immediately disconnect active client sessions. To isolate a specific client, assign different Group IDs or implement unified subscription logic.

• Version requirement — ApsaraMQ for RocketMQ 4.0 series instances do not support IP address whitelist configuration in the console. To use this feature, upgrade to the 5.0 series.

• Traffic tracking — The IP address whitelist does not provide real-time tracking of public internet traffic sources. The whitelist specifies only the IP address ranges that are permitted to access the instance. To identify specific traffic sources, refer to your application-side logs.

• Configuration target — The IP address whitelist and security group configurations apply to the ApsaraMQ for RocketMQ instance itself, not to the ECS instances used by your application. Incorrect configuration may result in connection failures.

Add IP addresses or CIDR blocks

1. Log on to the ApsaraMQ for RocketMQ console. In the left-side navigation pane, click Instances.

2. In the top navigation bar, select a region, such as China (Hangzhou). On the Instances page, click the name of the instance that you want to manage.

3. In the left-side navigation pane, click Access Control.

4. On the Access Control page, click the IP Address Whitelist tab, and then click Add IP Address.

5. In the Add IP Address panel, enter the IP addresses or CIDR blocks and click OK.

   Note

   Separate multiple entries with semicolons (;) or commas (,).

View the IP address whitelist

1. Log on to the ApsaraMQ for RocketMQ console. In the left-side navigation pane, click Instances.

2. In the top navigation bar, select a region, such as China (Hangzhou). On the Instances page, click the name of the instance that you want to manage.

3. In the left-side navigation pane, click Access Control.

4. On the Access Control page, click the IP Address Whitelist tab to view all entries.

Delete an IP address or CIDR block

1. On the Access Control page, click the IP Address Whitelist tab.

2. Find the entry that you want to remove and click Delete in the Actions column.

3. In the Confirm Deletion dialog box, click OK.

FAQ

Q: What should I do if connections time out or fail after configuring the IP address whitelist?

Follow these steps to troubleshoot:

1. If you are connecting over the public internet, verify that public network access has been enabled for the instance in the console.

2. Confirm that the local egress IP address exactly matches the IP address or CIDR block configured in the whitelist. Even a minor discrepancy blocks the connection.

3. Test network connectivity between the client and the instance by using telnet or nc. For example, run nc -zv <endpoint> 8080 or curl -v telnet://<endpoint>:8080.

4. If you receive a No route info error, verify that the Namespace (instance ID), username, and password specified in your application code are correct.

5. Consider the connection type:

   • Public internet connections: You must configure an AccessKey ID and AccessKey Secret for authentication.

   • VPC (internal network) connections: Authentication credentials are not required, but you must verify that VPC routing and security group configurations are correct.

Q: How do I test network connectivity between the client and an ApsaraMQ for RocketMQ instance?

You can use the following commands to test connectivity from a container or server environment:

• nc command: nc -zv <endpoint> 8080

• curl command: curl -v telnet://<endpoint>:8080

Replace <endpoint> with the actual endpoint address of your instance.

If the connection test fails, check the following:

• Container network configuration (if using a containerized deployment)

• ECS security group outbound rules

• Kubernetes NetworkPolicy configurations (if using Kubernetes)

Q: How can ECS instances in different VPCs under the same account connect to an ApsaraMQ for RocketMQ instance?

(Recommended) Use VPC Peering Connection to enable cross-VPC connectivity:

1. Create a VPC Peering Connection between the two VPCs. Connections within the same region are free of charge.

2. Add routes to the route tables of both VPCs. Set the destination CIDR block to the peer VPC CIDR block and set the next hop to the peering connection.

3. Configure the security groups on both sides to allow inbound traffic on the ApsaraMQ for RocketMQ ports, such as 9876 and 10911.

After you complete these steps, the ECS instances in both VPCs can connect to the ApsaraMQ for RocketMQ instance over the internal network.

Q: How should security groups be configured for Serverless instances?

(Recommended) Apply the following security group settings for Serverless instances:

• Do not use 0.0.0.0/0 as a security group inbound rule, as it allows traffic from any source.

• Allow inbound traffic only from the CIDR block of the VPC where your application resides.

• Allow inbound traffic on ports 8080 and 8081.

This configuration restricts access to known IP ranges and protects the instance from unauthorized connections.

Q: Does enabling ACL affect existing IP address whitelist configurations or usage?

No. Enabling ACL does not affect your existing IP address whitelist configuration. The two access control mechanisms are independent and can be used simultaneously.

Related API operations

Use the following API operations to manage IP address whitelists programmatically: