Add the CIDR blocks of DTS servers to the IP address whitelist of an on-premises database when a data migration, data synchronization, change tracking, or data verification task is configured - Data Transmission Service

If you want to use Data Transmission Service (DTS) to transfer data and your source or destination database accepts connections only from specific IP addresses, you must configure the security settings of your database to allow access from DTS servers. For example, you must add the CIDR blocks of DTS servers to the security settings of your database, such as firewall, IP address whitelist, and security group.

Background information

Access methods

DTS supports the following six access methods:Alibaba Cloud Instance, Self-managed Database on ECS, Public IP Address, Express Connect, VPN Gateway, or Smart Access Gateway, Cloud Enterprise Network (CEN), and Database Gateway. The Access Method varies based on the task type, database type, and combination of the source and destination databases. The access methods displayed in the DTS console prevail.

You can select an Access Method to connect your database to DTS based on the database type.

Note

If the source or destination database of a data migration or change tracking instance is a self-managed database that resides in a region not supported by DTS, and you set Access Method to Public IP Address, you can select any region from the Instance Region drop-down list, and add the CIDR blocks of DTS servers to the security settings of your self-managed database. We recommend that you select the China (Hangzhou) region.

For Alibaba Cloud databases, such as ApsaraDB RDS for MySQL, PolarDB for MySQL, and ApsaraDB for MongoDB, we recommend that you set Access Method to Alibaba Cloud Instance to connect your database to DTS.
For self-managed databases that are deployed on Elastic Compute Service (ECS) instances, we recommend that you set Access Method to Self-managed Database on ECS.
For on-premises databases that are deployed in data centers, we recommend that you set Access Method to Public IP Address, Express Connect, VPN Gateway, or Smart Access Gateway, Cloud Enterprise Network (CEN), or Database Gateway based on your business requirements. We recommend that you enable public access for your on-premises database to accept access only from DTS servers, and set Access Method to Public IP Address to connect your database to DTS.
For third-party cloud databases, we recommend that you enable public access for your database and set Access Method to Public IP Address to connect your database to DTS.

Methods for adding the CIDR blocks of DTS servers

The CIDR blocks of DTS servers can be manually or automatically added. Whether you have to manually add the CIDR blocks depends on the Access Method parameter that is specified for the source or destination database.

Access method	Whether CIDR blocks must be manually added	Description
Alibaba Cloud Instance	No Note MaxCompute projects and ApsaraDB for OceanBase instances are excluded.	The system automatically adds the CIDR blocks of DTS servers to the whitelist of Alibaba Cloud database instances, excluding MaxCompute projects and ApsaraDB for OceanBase instances. Note You must manually add the CIDR blocks of DTS servers to the IP address whitelist of MaxCompute to allow DTS to access MaxCompute. For more information, see the Configure an IP address whitelist to allow access from Alibaba Cloud services to MaxCompute section of the Manage IP address whitelists topic. You must manually add the CIDR blocks of DTS servers to the IP address whitelist of ApsaraDB for OceanBase to allow DTS to access ApsaraDB for OceanBase. The CIDS blocks to be added are the same as those for databases whose Access Method is Express Connect, VPN Gateway, or Smart Access Gateway. For more information, see Create a whitelist group and the CIDR blocks of DTS servers section of this topic.
Self-managed Database on ECS	No Note Databases that are hosted on multiple ECS instances are excluded.	The system automatically adds the CIDR blocks of DTS servers to the security group rules of the ECS instance. Make sure that the ECS instance can access the database. Note If your self-managed database is deployed on multiple ECS instances, you must manually add the CIDR blocks of DTS servers to the security group rules of each ECS instance. For more information, see Create a security group and Associate security groups with an instance (primary ENI).
Public IP Address	Yes	You must manually add the CIDS blocks of DTS servers to the security settings of the database. For more information, see the Add CIDR blocks section of this topic. Note You must also make preparations before you configure a DTS instance. For more information, see Preparation overview.
Express Connect, VPN Gateway, or Smart Access Gateway
Cloud Enterprise Network (CEN)
Database Gateway	Yes	You must manually add the IP addresses of all gateway nodes to the security settings of the database. Note To obtain the IP address of a gateway node, go to the Gateway details page of a database gateway. In the Gateway node cluster section, view the IP address of a gateway node in the Host column. You must also make preparations before you configure a DTS instance. For more information, see Preparation overview.

Names of IP address whitelists that are automatically created by DTS

When DTS attempts to connect to an Alibaba Cloud database instance, such as when you click Test Connectivity and Proceed in the DTS console, DTS automatically creates an IP address whitelist that includes the CIDR blocks of DTS servers for the database instance. The following table lists the Alibaba Cloud database instances for which DTS can automatically create IP address whitelists and the names of the whitelists.

Important

The IP address whitelist that is automatically created for a database instance by DTS applies to only connections between DTS and the database instance. If you use the whitelist to control access from another service, the service may be interrupted.
The names of the IP address whitelists automatically created by DTS contain "dts" or "DTS".

Database instance	Access method	Whitelist or security group name
RDS MySQL RDS PostgreSQL RDS MariaDB RDS SQL Server	Alibaba Cloud Instance	rdsdts
PolarDB for MySQL cluster PolarDB for PostgreSQL cluster PolarDB for PostgreSQL (Compatible with Oracle) cluster		dtspolardb
AnalyticDB for MySQL V3.0 cluster		dts_adb_v3
AnalyticDB for PostgreSQL instance		dts
ApsaraDB for MongoDB instance		ddsdts
Tair (Redis OSS-Compatible)		dts_group
PolarDB-X 1.0		drdsdts
PolarDB-X 2.0		polardb_x_dts
ApsaraMQ for Kafka instance		dts_kafka
Elasticsearch cluster		dts_group
Lindorm instance		ali_dts_group
ApsaraDB for ClickHouse cluster		dts_clickhouse
ApsaraDB for SelectDB instance		dts_selectdb
ECS instance	Self-managed Database on ECS	SG-DTS-GROUP-****

Usage notes

If the source or destination database of a DTS instance is connected to DTS over Cloud Enterprise Network (CEN) or Express Connect, VPN Gateway, or Smart Access Gateway, you must add all the IP addresses and CIDR blocks of DTS servers to the following locations when you use DTS for the first time and receive DTS whitelist expansion notifications.
- The IP addresses or CIDR blocks of CEN. For more information, see the "Enable access to a cloud service from a Basic Edition transit router" section of the Manage access to cloud services topic.
- The local CIDR block of IPsec-VPN connections. For more information, see Create and manage IPsec-VPN connections in single-tunnel mode.
- The IP address whitelist of on-premises databases.
If the source or destination database of a DTS instance is connected to DTS by using a Public IP Address, you must add all the IP addresses and CIDR blocks of DTS servers to the IP address whitelist of the database instance when you use DTS for the first time and receive DTS whitelist expansion notifications.
Make sure that the CIDR blocks and IP addresses are added to the network environment of the corresponding region for the DTS instance. Otherwise, after a disaster recovery of the DTS task, new devices may not be able to connect to the instance. As a result, task delays or interruptions occur.
If the CIDR blocks of DTS servers are automatically or manually added to the IP address whitelist of a database instance or the security group rules of an ECS instance, security risks may arise. Therefore, before you use DTS to migrate data, you must understand the potential risks and take preventive measures, including but not limited to the following measures: enhance the security of your account and password, limit the ports that are exposed, authenticate API calls, regularly check the whitelist or ECS security group rules and forbid unauthorized CIDR blocks, and connect the database to DTS by using Express Connect, VPN Gateway, or Smart Access Gateway.
DTS may add or delete the automatically created IP address whitelists or security groups based on business requirements and security risks. Do not use the IP address whitelists or the security groups to control access from another service. The service level agreement (SLA) of DTS does not cover the issues caused by applying the IP address whitelists or security groups to another service. For information about the names of IP address whitelists or security groups automatically created by DTS, see the Names of IP address whitelists that are automatically created by DTS of this section.

Add CIDR blocks

Procedure

Check whether the CIDR blocks of DTS servers must be manually added to the IP address whitelist of the source or destination database.
Access Method

Check the regions to which the CIDR blocks of DTS servers belong.

Task type	Database whose security settings you want to add CIDR blocks to	Region to which the CIDR blocks of DTS servers to be added to the database security settings belong
Data Synchronization	Source database	The regions in which the source and destination databases reside.
Data Synchronization	Destination database	The region in which the destination database resides.
Data migration	Source database	The region in which the destination database resides.
Data migration	Destination database	The region in which the destination database resides.
Change tracking	Source database	The region in which the source database resides.
Data verification (separately configured)	Source database	The region in which the destination database resides.
Data verification (separately configured)	Destination database	The region in which the destination database resides.

View the CIDR blocks to be added based on the name or ID of the region to which the database instance resides.
For more information about the CIDR blocks of DTS servers, see the CIDR blocks of DTS servers table of this topic.
Add the CIDR blocks of DTS servers to the security settings of the database instance.
Check the configurations in the database instance and make sure that DTS can access the instance.
- If the database is a self-managed Kafka cluster and the listeners and advertised.listeners parameters are specified in the server.properties configuration file, make sure that DTS can connect to the Kafka cluster.
- If the database is a self-managed Redis database and the bind parameter is specified in the redis.conf configuration file, make sure that DTS can connect to the Redis database.

CIDR blocks of DTS servers