IP whitelist for migrating, synchronizing, subscribing to, or validating on-premises databases - Data Transmission Service: Central de Documentação do Alibaba Cloud

Ao usar o Data Transmission Service (DTS) com um banco de dados de origem ou destino protegido por firewall ou lista de permissões, adicione os blocos CIDR de endereços IP do DTS às configurações de segurança dele. Essa etapa costuma ser necessária para bancos de dados em data centers on-premises, em outras plataformas cloud ou para bancos de dados autogerenciados no ECS. Isso garante que o DTS acesse o banco de dados e permite a execução bem-sucedida das tarefas de transmissão de dados.

Quando o DTS se conecta a um banco de dados, o comportamento depende do Access Method selecionado:

Adição automática: se o banco de dados de origem ou destino for um banco de dados suportado da Alibaba Cloud, como RDS, PolarDB ou MongoDB, e o Access Method selecionado for Alibaba Cloud Instance, o DTS adiciona automaticamente os blocos CIDR de IP do servidor à lista de permissões do banco de dados.
Adição manual: se a conexão com o banco de dados usar um endereço Public IP Address, Express Connect, VPN Gateway, or Smart Access Gateway ou Cloud Enterprise Network (CEN), adicione manualmente os blocos CIDR de IP do servidor DTS às configurações de segurança do banco de dados.

Notas de uso

Origem da lista de IPs: os blocos CIDR de endereços IP exibidos na janela pop-up de autorização durante a configuração da tarefa no console podem estar desatualizados. Use sempre os blocos CIDR de endereços IP deste tópico como a fonte oficial.
Alterações de endereços IP: os blocos CIDR de endereços IP dos servidores DTS podem mudar. Ao usar o DTS pela primeira vez ou receber uma notificação sobre a expansão da lista de permissões, atualize as configurações com base nas informações fornecidas no console ou na notificação. Verifique e atualize os endereços IP periodicamente.
- Cloud Enterprise Network (CEN): atualize o Access Cloud Service Configuration no CEN.
- Express Connect, VPN Gateway, or Smart Access Gateway: atualize o local CIDR block no IPsec connection.
- Banco de dados on-premises: atualize as configurações de segurança do banco de dados.
Garantia de uma lista de IPs completa: adicione todos os blocos CIDR de endereços IP da região necessária. O DTS pode alternar nós do service para recuperação de desastres. Se a lista de IPs estiver incompleta, as tarefas serão interrompidas após um failover.

Nota
Se o banco de dados estiver implantado em um cluster (por exemplo, Kafka, Redis ou Doris), adicione a lista de permissões de IP do DTS às configurações de segurança de cada servidor no cluster.
Listas de permissões adicionadas automaticamente: não use listas de permissões criadas automaticamente pelo DTS (que geralmente têm nomes contendo dts ou DTS) para services não relacionados ao DTS. O DTS pode modificar essas listas a qualquer momento, portanto, usá-las para outras finalidades pode causar interrupções no service.
Instâncias de banco de dados cloud exigem configuração de lista de permissões, não grupos de segurança do ECS: para instâncias de banco de dados cloud, como o ApsaraDB RDS, adicione os blocos CIDR de IP do servidor DTS por meio das configurações de lista de permissões da própria instância, e não pelas regras de grupo de segurança do ECS. Por exemplo, para uma instância RDS, acesse o console do RDS e adicione os blocos CIDR de IP do servidor DTS em Allowlist Settings. As regras de grupo de segurança do ECS se aplicam no nível da instância ECS e não controlam o acesso de entrada para instâncias de banco de dados cloud.
Riscos de segurança:
- Adicionar os blocos CIDR de endereços IP públicos dos servidores DTS, seja de forma automática ou manual, pode introduzir riscos de segurança. Ao usar este service, você reconhece esses riscos e é responsável por implementar medidas de segurança fundamentais. Essas medidas incluem, mas não se limitam a, usar senhas fortes para contas, restringir portas abertas para cada bloco CIDR, usar autenticação para chamadas de API internas e revisar e remover regras de rede desnecessárias periodicamente. Como alternativa, conecte-se por uma rede privada usando Express Connect, VPN Gateway, or Smart Access Gateway.
- Para proteger a segurança do banco de dados, remova os blocos CIDR de endereços IP do DTS das configurações de segurança após a conclusão ou liberação da tarefa do DTS.
Risco de configuração incorreta de rota para a rede 100.104.0.0/16: o bloco CIDR 100.104.0.0/16 é uma rede de service interna da Alibaba Cloud e é a rede padrão que o DTS usa para se comunicar com o banco de dados. Não adicione rotas à tabela de rotas da VPC que direcionem o tráfego destinado a 100.104.0.0/16 ou suas sub-redes para um próximo salto por meio de Express Connect, VPN Gateway, VPC Peering Connection, Cloud Enterprise Network (CEN) ou outros túneis de rede personalizados. Essa configuração interromperá a conexão entre o DTS e o banco de dados, causando falhas nas tarefas de migração de dados, sincronização de dados e rastreamento de alterações.

Etapa 1: Confirme o método de acesso

Use a tabela abaixo para identificar o cenário e as ações necessárias. Se o método de acesso não exigir configuração manual (exceto em casos especiais) nem a adição manual de blocos CIDR de endereços IP do DTS, pule para o next steps.

Método de acesso	Cenário	Configuração manual necessária	Descrição
Alibaba Cloud Instance	Bancos de dados da Alibaba Cloud, como RDS, PolarDB e MongoDB.	Não (exceto em casos especiais)	O DTS adiciona automaticamente seus endereços IP à lista de permissões do banco de dados. Exceções: MaxCompute, OceanBase e tarefas de migração entre fronteiras ou entre regiões exigem configuração manual. MaxCompute: Configure a whitelist to allow all Alibaba Cloud services to access MaxCompute. OceanBase: use o valor de Express Connect, VPN Gateway, or Smart Access Gateway da tabela Appendix: IP address CIDR blocks of DTS servers para configure a whitelist group. Tarefas de migração entre fronteiras ou entre regiões: além de ativar um endpoint público para o banco de dados de origem, adicione os endereços Public IP Address da região onde o banco de dados de destino está localizado.
Self-managed Database on ECS	Um banco de dados implantado em uma instância ECS da Alibaba Cloud.	Não (exceto para clusters)	O DTS adiciona automaticamente seus endereços IP ao grupo de segurança do ECS. Exceção: se o banco de dados (como Kafka, Redis ou Doris) for um cluster implantado em várias instâncias ECS, o DTS configurará apenas o grupo de segurança do primeiro nó ao qual se conecta. Adicione manualmente as outras instâncias ECS do cluster ao grupo de segurança criado pelo DTS.
Public IP Address	Bancos de dados de IDC on-premises Bancos de dados de outros provedores cloud Qualquer banco de dados com um endereço IP público	Sim	Adicione os blocos CIDR de endereços IP do service DTS na região correspondente às configurações de segurança do banco de dados.
Express Connect, VPN Gateway, or Smart Access Gateway	Bancos de dados em IDCs on-premises conectados por meio de Express Connect ou VPN Gateway.
Cloud Enterprise Network (CEN)	Bancos de dados em IDCs on-premises conectados por meio da Cloud Enterprise Network.
Database Gateway	Bancos de dados conectados por meio do Database Gateway.	Sim (configure o IP do gateway)	Este método não exige a adição de blocos CIDR de endereços IP do DTS. Em vez disso, adicione os endereços IP de todos os Gateway node ID no Database Gateway (DG) às configurações de segurança do banco de dados.

Etapa 2: Determine a região do IP do servidor DTS

Com base no tipo de tarefa e na localização dos bancos de dados, use a tabela a seguir para determinar quais endereços IP do servidor DTS da região devem ser adicionados à lista de permissões correta do banco de dados.

Tipo de tarefa	Banco de dados para a lista de permissões	Região do IP do DTS
Data synchronization	Banco de dados de origem	Regiões dos bancos de dados de origem e destino
Data synchronization	Banco de dados de destino	Região do banco de dados de destino
Data migration	Banco de dados de origem	Região do banco de dados de destino
Data migration	Banco de dados de destino	Região do banco de dados de destino
Change tracking	Banco de dados de origem	Região do banco de dados de origem
Data validation (configurado como uma tarefa separada)	Banco de dados de origem	Região do banco de dados de destino
Data validation (configurado como uma tarefa separada)	Banco de dados de destino	Região do banco de dados de destino
Data preparation	Banco de dados de origem	Região do banco de dados de destino
Data preparation	Banco de dados de destino	Região do banco de dados de destino

Por exemplo, se você usar o access method de Public IP Address para migrate data from a self-managed MySQL database to an RDS for MySQL instance, adicione o public IP address CIDR blocks of DTS servers da região do banco de dados de destino à lista de permissões do banco de dados de origem.

Nota

Em uma tarefa de migração de dados, se o banco de dados de origem ou de destino usar o método de acesso por endereço IP público, o banco de dados conectado via IP público deve ter na lista de permissões os blocos CIDR de IP do servidor DTS de ambas as regiões: a do banco de dados de origem e a do banco de dados de destino.

Etapa 3: Adicione os endereços IP

Configuração automática

Casos de uso

Alibaba Cloud Instance: services de banco de dados da Alibaba Cloud, como ApsaraDB RDS e PolarDB. Este cenário exclui MaxCompute, OceanBase e tarefas de migração entre fronteiras ou entre regiões.
Self-managed Database on ECS: um banco de dados autogerenciado de nó único.

Detalhes da configuração

O DTS configura automaticamente a lista de permissões ou o grupo de segurança ao estabelecer uma conexão. Para mais informações, consulte o Whitelists automatically added by DTS abaixo.

Alibaba Cloud Instance: o DTS cria automaticamente um grupo de lista de permissões específico do product.
Self-managed Database on ECS: o DTS cria automaticamente um grupo de segurança chamado SG-DTS-GROUP-xxxx e o aplica à instância ECS.

Clique para expandir: Listas de permissões adicionadas automaticamente pelo DTS

Quando o DTS se conecta a uma instância de banco de dados da Alibaba Cloud (por exemplo, ao clicar em Test Connectivity and Proceed no console), ele adiciona automaticamente uma lista de permissões de IP à instância. A tabela a seguir lista as instâncias de banco de dados suportadas da Alibaba Cloud e os nomes das listas de permissões correspondentes.

Nota

A lista de permissões de IP adicionada automaticamente pelo DTS é exclusiva para a conexão do DTS com a instância do banco de dados. Usar essa lista de permissões para workloads não relacionados ao DTS pode causar interrupções no service.
Os nomes das listas de permissões de IP adicionadas automaticamente pelo DTS contêm dts ou DTS.

Método de acesso	Instância do banco de dados	Parâmetro
Alibaba Cloud Instance	ApsaraDB RDS for MySQL ApsaraDB RDS for PostgreSQL ApsaraDB RDS for MariaDB ApsaraDB RDS for SQL Server	`rdsdts`
	PolarDB for MySQL PolarDB for PostgreSQL PolarDB for PostgreSQL (compatible with Oracle)	`dtspolardb`
	AnalyticDB for MySQL 3.0	`dts_adb_v3`
	AnalyticDB for PostgreSQL	`dts`
	ApsaraDB for MongoDB	`ddsdts`
	Tair (Redis-compatible)	`dts_group`
	PolarDB-X 1.0	`drdsdts`
	PolarDB-X 2.0	`polardb_x_dts`
	ApsaraMQ for Kafka	`dts_kafka`
	Alibaba Cloud Elasticsearch	`dts_group`
	Lindorm	`ali_dts_group`
	ApsaraDB for ClickHouse	`dts_clickhouse`
	ApsaraDB for SelectDB	`dts_selectdb`
Self-managed Database on ECS	Instância ECS	`SG-DTS-GROUP-****`

Casos especiais

Implantação em cluster: se o banco de dados (como Kafka, Redis ou Doris) estiver implantado em várias instâncias ECS, o DTS configurará automaticamente apenas o grupo de segurança do primeiro nó conectado. Adicione manualmente as instâncias ECS dos nós restantes ao grupo de segurança SG-DTS-GROUP-xxxx criado pelo DTS.
MaxCompute, OceanBase e tarefas de migração entre fronteiras ou entre regiões:
- MaxCompute: Configure a whitelist to allow all Alibaba Cloud services to access MaxCompute.
- OceanBase: use o valor de Express Connect, VPN Gateway, or Smart Access Gateway da tabela Appendix: IP address CIDR blocks of DTS servers para configure a whitelist group.
- Tarefas de migração entre fronteiras ou entre regiões: além de ativar um endpoint público para o banco de dados de origem, adicione os endereços Public IP Address da região onde o banco de dados de destino está localizado.

Endereço IP público

Casos de uso

Bancos de dados autogerenciados em data centers on-premises.
Bancos de dados hospedados por outros provedores cloud.
Qualquer banco de dados que exponha services por meio de um endereço IP público.

Procedimento

Importante

Se o Access Method for Public IP Address, adicione os blocos CIDR de endereços IP dos servidores DTS das regiões dos bancos de dados de origem e destino às configurações de segurança da instância do banco de dados.

Obtenha a lista de IPs: na tabela IP address CIDR blocks of DTS servers, obtenha os blocos CIDR de endereços IP públicos para o region determined in Step 2.
Configure o firewall ou a lista de permissões: adicione esses blocos CIDR ao firewall do servidor de banco de dados ou às regras do grupo de segurança do seu provedor cloud. O DTS exige acesso a todas as portas a partir dos blocos CIDR de IP do servidor DTS, e não apenas à porta do service de banco de dados. Certifique-se de que a política de firewall ou grupo de segurança permita o tráfego dos blocos CIDR de IP do DTS em todas as portas para evitar falhas de conexão causadas por restrições de porta.

Recomendações de segurança

Princípio do menor privilégio: abra apenas as portas de banco de dados necessárias para os blocos CIDR de IP do DTS. Recomendamos não permitir o acesso a partir de 0.0.0.0/0.
Autenticação forte: use uma conta de banco de dados dedicada com as permissões mínimas necessárias e uma senha forte para o DTS.
Criptografia em trânsito: sempre que possível, ative e imponha conexões criptografadas SSL/TLS para o banco de dados.

Express Connect, VPN Gateway, Smart Access Gateway ou Cloud Enterprise Network (CEN)

Casos de uso

Este método é destinado a data centers on-premises conectados a uma VPC por meio do Alibaba Cloud Express Connect, VPN Gateway, Smart Access Gateway ou Cloud Enterprise Network (CEN).

Procedimento

Obtenha a lista de IPs: na tabela IP address CIDR blocks of DTS servers, obtenha os blocos CIDR do service cloud para o region determined in Step 2.
Configure rotas e firewalls:
- Cloud Enterprise Network (CEN): na sua instância CEN, configure the DTS private IP CIDR blocks as a cloud service.
- Express Connect, VPN Gateway, or Smart Access Gateway: adicione os blocos CIDR de IP privado do DTS ao Local CIDR Block do seu IPsec-VPN connection.
- Banco de dados on-premises: no firewall do seu data center on-premises, configure uma política para permitir o tráfego dos blocos CIDR de IP privado do DTS para acessar o banco de dados. O DTS exige acesso a todas as portas a partir dos blocos CIDR de IP do servidor DTS. Certifique-se de que a política de firewall permita o tráfego dos blocos CIDR de IP do DTS em todas as portas para evitar falhas de conexão causadas por restrições de porta.

Nota

Após adicionar os endereços IP, verifique a configuração da instância do banco de dados para identificar quaisquer configurações que possam restringir o acesso do DTS. Por exemplo, verifique os seguintes parâmetros nos arquivos de configuração de bancos de dados autogerenciados:

MySQL: bind-address.
PostgreSQL: listen_addresses.
MongoDB: bindIp.
Kafka: listeners e advertised.listeners.
Redis: bind.

Próximas etapas

Por segurança, remova os blocos CIDR de endereços IP do DTS correspondentes da lista de permissões ou do grupo de segurança do banco de dados após a conclusão da tarefa do DTS. Exclua os grupos de lista de permissões (como rdsdts) ou grupos de segurança (como SG-DTS-GROUP-xxxx) que o DTS cria automaticamente.

Blocos CIDR do DTS

Nota

Quando um banco de dados local se conecta ao DTS por meio do Cloud Enterprise Network (CEN) ou do Express Connect, VPN Gateway, or Smart Access Gateway, o DTS utiliza endereços IP de servidor do bloco CIDR interno da Alibaba Cloud 100.64.0.0/10.
Se o DTS adicionar novos servidores, atualize a lista de permissões do seu banco de dados autogerenciado. Caso contrário, a conexão do DTS com o banco de dados poderá falhar.

China Continental

China (Hangzhou)

ID da região	Método de acesso	Bloco CIDR
cn-hangzhou	Express Connect, VPN Gateway, or Smart Access Gateway	100.104.52.0/24,100.104.61.128/26,100.104.244.64/26,100.104.216.192/26,100.104.85.0/26,100.104.221.128/26,100.104.2.0/26,100.104.251.192/26,100.104.159.64/26,100.104.216.128/26,100.104.148.192/26,100.104.239.64/26,100.104.114.0/26,100.104.0.192/26,100.104.201.192/26,100.104.228.0/26,100.104.41.0/26,100.104.203.128/26,100.104.145.128/26,100.104.105.64/26,100.104.91.0/26,100.104.134.128/26,100.104.96.128/26,100.104.74.128/26,100.104.225.128/26,100.104.198.0/26
	Cloud Enterprise Network (CEN)
	Public IP Address	110.76.0.128/26,140.205.47.0/26,110.76.2.128/26,110.75.230.192/26,110.76.8.64/26,140.205.41.192/26,203.209.225.192/26,110.75.235.128/26,110.75.230.64/26,110.75.157.192/26,110.76.9.128/26,110.75.186.0/26,203.209.247.192/26,140.205.47.128/26,110.76.9.64/26,110.75.134.192/26,140.205.196.128/26,203.119.159.192/26,106.11.73.192/26,203.209.225.128/26,110.75.130.192/26,110.76.2.64/26,140.205.41.64/26,110.75.190.0/26,110.76.11.64/26,140.205.197.0/26,203.209.247.128/26,140.205.47.64/26,110.76.9.0/26,110.75.235.0/26,110.75.186.64/26,110.76.9.192/26,106.11.76.64/26,110.75.230.0/26,140.205.196.0/26,110.76.11.128/26,110.76.11.192/26,110.76.11.0/26,59.82.47.0/26,47.102.181.128/26,59.82.46.128/26,110.76.0.0/26,110.76.0.64/26,106.11.76.0/26,47.102.234.0/26,47.102.234.64/26,59.82.46.192/26,110.75.235.64/26,110.75.130.128/26,110.75.134.128/26,110.76.8.0/26,110.75.190.64/26,110.75.143.0/26,8.139.112.64/26,8.139.112.128/26,140.205.196.64/26,8.139.99.192/26,8.139.112.0/26,140.205.47.192/26,110.75.230.128/26,110.76.0.192/26,106.11.73.128/26,140.205.196.192/26,110.75.235.192/26,47.102.181.192/26,59.82.46.64/26,110.76.2.0/26,110.76.2.192/26,112.124.239.0/26

China (Shanghai)

ID da região	Método de acesso	Bloco de endereços IP
cn-shanghai	Express Connect, VPN Gateway, or Smart Access Gateway	100.104.205.0/24,100.104.226.128/26,100.104.149.64/26,100.104.241.128/26,100.104.177.128/26,100.104.203.192/26,100.104.113.0/26,100.104.187.0/26,100.104.17.0/26,100.104.33.192/26,100.104.3.192/26,100.104.107.0/26,100.104.29.192/26,100.104.187.192/26,100.104.177.64/26,100.104.93.128/26,100.104.174.64/26,100.104.160.0/26,100.104.147.128/26,100.104.247.192/26,100.104.225.192/26,100.104.158.128/26,100.104.35.64/26
	Cloud Enterprise Network (CEN)
	Public IP Address	110.76.0.128/26,140.205.47.0/26,110.76.2.128/26,110.75.230.192/26,110.76.8.64/26,140.205.41.192/26,203.209.225.192/26,110.75.235.128/26,110.75.230.64/26,110.75.157.192/26,110.76.9.128/26,110.75.186.0/26,203.209.247.192/26,140.205.47.128/26,110.76.9.64/26,110.75.134.192/26,140.205.196.128/26,203.119.159.192/26,106.11.73.192/26,203.209.225.128/26,110.75.130.192/26,110.76.2.64/26,140.205.41.64/26,110.75.190.0/26,110.76.11.64/26,140.205.197.0/26,203.209.247.128/26,140.205.47.64/26,110.76.9.0/26,110.75.235.0/26,110.75.186.64/26,110.76.9.192/26,106.11.76.64/26,110.75.230.0/26,140.205.196.0/26,110.76.11.128/26,110.76.11.192/26,110.76.11.0/26,59.82.47.0/26,47.102.181.128/26,59.82.46.128/26,110.76.0.0/26,110.76.0.64/26,106.11.76.0/26,47.102.234.0/26,47.102.234.64/26,59.82.46.192/26,110.75.235.64/26,110.75.130.128/26,110.75.134.128/26,110.76.8.0/26,110.75.190.64/26,110.75.143.0/26,8.139.112.64/26,8.139.112.128/26,140.205.196.64/26,8.139.99.192/26,8.139.112.0/26,140.205.47.192/26,110.75.230.128/26,110.76.0.192/26,106.11.73.128/26,140.205.196.192/26,110.75.235.192/26,47.102.181.192/26,59.82.46.64/26,110.76.2.0/26,110.76.2.192/26,59.82.32.64/26,117.185.224.192/26,59.82.32.192/26,106.11.224.64/26,112.65.93.64/26,59.82.32.128/26,106.11.224.192/26,59.82.32.0/26,117.185.224.64/26,47.103.166.192/26,8.128.64.64/26,47.101.109.64/26,47.101.109.192/26,8.128.66.128/26,8.128.64.128/26,117.185.224.0/26,47.103.170.0/26,106.11.224.0/26,8.128.64.0/26,8.128.64.192/26,8.128.66.192/26,101.91.141.64/26,101.91.141.128/26,47.101.109.0/26,106.11.224.128/26,112.65.93.0/26,8.128.66.64/26,47.103.166.128/26,112.65.93.128/26,101.91.141.0/26,47.101.109.128/26,47.103.166.64/26,140.206.221.64/26,8.128.66.0/26,117.185.224.128/26,101.91.139.192/26,101.133.205.192/26

China (Qingdao)

ID da região	Método de acesso	Bloco CIDR
cn-qingdao	Express Connect, VPN Gateway, or Smart Access Gateway	100.104.72.0/24,100.104.35.192/26,100.104.12.0/26,100.104.111.0/26,100.104.100.128/26,100.104.136.192/26,100.104.16.64/26,100.104.78.128/26
	Cloud Enterprise Network (CEN)
	Public IP Address	203.119.185.0/24,140.205.47.0/24,110.76.8.64/26,203.119.146.128/26,203.209.225.192/26,140.205.41.192/26,110.75.157.192/26,203.119.147.0/24,110.75.186.0/26,203.209.247.192/26,203.119.240.0/26,203.119.182.192/26,110.75.134.192/26,203.119.159.192/26,106.11.73.192/26,203.209.225.128/26,203.119.184.0/24,110.75.130.192/26,203.119.191.64/26,140.205.41.64/26,110.75.190.0/26,8.149.144.0/24,140.205.197.0/26,203.209.247.128/26,203.119.187.0/24,110.75.235.0/24,110.75.186.64/26,118.190.207.25,110.76.9.0/24,106.11.76.64/26,203.119.146.192/26,115.28.200.55,110.75.230.0/24,203.119.188.0/24,140.205.196.0/24,59.82.47.0/26,47.102.181.128/26,203.119.149.0/24,59.82.46.128/26,203.119.191.128/26,110.76.0.0/24,106.11.185.0/24,106.11.76.0/26,115.28.216.250,203.119.151.0/24,47.102.234.0/26,203.119.190.0/24,47.102.234.64/26,59.82.46.192/26,110.75.130.128/26,110.75.134.128/26,203.119.150.0/24,110.76.8.0/26,120.27.53.203,110.75.190.64/26,110.75.143.0/26,110.76.2.0/24,8.139.112.64/26,106.11.40.64/26,8.139.112.128/26,203.119.189.0/24,118.190.207.194,8.139.99.192/26,203.119.186.0/24,8.139.112.0/26,106.11.184.0/24,120.27.72.0/24,203.119.183.0/24,106.11.73.128/26,203.119.191.0/26,110.76.11.0/24,59.82.46.64/26,47.102.181.192/26,39.98.96.0/24,203.119.148.0/24,110.76.0.128/26,140.205.47.0/26,110.76.2.128/26,110.75.230.192/26,110.75.235.128/26,110.75.230.64/26,110.76.9.128/26,140.205.47.128/26,110.76.9.64/26,140.205.196.128/26,110.76.2.64/26,110.76.11.64/26,140.205.47.64/26,110.76.9.0/26,110.75.235.0/26,110.76.9.192/26,110.75.230.0/26,140.205.196.0/26,110.76.11.128/26,110.76.11.192/26,110.76.11.0/26,110.76.0.0/26,110.76.0.64/26,110.75.235.64/26,140.205.196.64/26,140.205.47.192/26,110.75.230.128/26,110.76.0.192/26,140.205.196.192/26,110.75.235.192/26,110.76.2.0/26,110.76.2.192/26,120.27.72.192/26,120.27.72.128/26,120.27.72.0/26,120.27.72.64/26

China (Beijing)

ID da região	Método de acesso	Intervalo de endereços IP
cn-beijing	Express Connect, VPN Gateway, or Smart Access Gateway	100.104.11.64/26,100.104.128.192/26,100.104.143.0/26,100.104.183.0/24,100.104.200.64/26,100.104.201.0/26,100.104.213.64/26,100.104.227.192/26,100.104.232.128/26,100.104.236.128/26,100.104.247.64/26,100.104.84.128/26,100.104.237.64/26,100.104.6.0/26,100.104.9.128/26,100.104.230.64/26,100.104.157.64/26,100.104.104.64/26,100.104.218.64/26,100.104.59.0/26,100.104.93.64/26,100.104.79.0/26,100.104.235.128/26,100.104.17.128/26,100.104.141.64/26,100.104.251.0/26,100.104.200.128/26,100.104.9.0/26
	Cloud Enterprise Network (CEN)
	Public IP Address	110.76.0.128/26,140.205.47.0/26,110.76.2.128/26,110.75.230.192/26,110.76.8.64/26,140.205.41.192/26,203.209.225.192/26,110.75.235.128/26,110.75.230.64/26,110.75.157.192/26,110.76.9.128/26,110.75.186.0/26,203.209.247.192/26,140.205.47.128/26,110.76.9.64/26,110.75.134.192/26,140.205.196.128/26,203.119.159.192/26,106.11.73.192/26,203.209.225.128/26,110.75.130.192/26,110.76.2.64/26,140.205.41.64/26,110.75.190.0/26,110.76.11.64/26,140.205.197.0/26,203.209.247.128/26,140.205.47.64/26,110.76.9.0/26,110.75.235.0/26,110.75.186.64/26,110.76.9.192/26,106.11.76.64/26,110.75.230.0/26,140.205.196.0/26,110.76.11.128/26,110.76.11.192/26,110.76.11.0/26,59.82.47.0/26,47.102.181.128/26,59.82.46.128/26,110.76.0.0/26,110.76.0.64/26,106.11.76.0/26,47.102.234.0/26,47.102.234.64/26,59.82.46.192/26,110.75.235.64/26,110.75.130.128/26,110.75.134.128/26,110.76.8.0/26,110.75.190.64/26,110.75.143.0/26,8.139.112.64/26,8.139.112.128/26,140.205.196.64/26,8.139.99.192/26,8.139.112.0/26,140.205.47.192/26,110.75.230.128/26,110.76.0.192/26,106.11.73.128/26,140.205.196.192/26,110.75.235.192/26,47.102.181.192/26,59.82.46.64/26,110.76.2.0/26,110.76.2.192/26,39.156.175.0/26,112.126.111.128/26,39.107.7.64/26,39.107.7.0/26,182.92.137.64/26,49.7.153.192/26,49.7.152.192/26,182.92.137.128/26,49.7.152.0/26,112.126.112.0/26,39.107.223.192/26,49.7.152.64/26,114.250.62.192/26,111.206.225.128/26,114.250.54.64/26,49.7.152.128/26,112.126.112.64/26,49.7.153.128/26,111.13.119.192/26,111.206.225.64/26,39.107.223.128/26,114.250.54.0/26,114.250.62.128/26,182.92.17.192/26,114.250.62.0/26,111.13.22.64/26,111.13.246.192/26,49.7.153.0/26,182.92.32.192/26,39.156.175.128/26,182.92.137.0/26,49.7.153.64/26,39.107.223.0/26,39.156.175.64/26,182.92.17.128/26,101.200.20.0/26,182.92.137.192/26,112.126.111.192/26,39.156.175.192/26,114.250.62.64/26,111.13.119.128/26,39.107.223.64/26,182.92.32.128/26,101.200.116.192/26,47.95.35.136/32,39.102.181.128/26,8.131.132.0/26

China (Zhangjiakou)

ID da região	Método de acesso	Bloco CIDR
cn-zhangjiakou	Express Connect, VPN Gateway, or Smart Access Gateway	100.104.144.128/26,100.104.175.0/24,100.104.180.192/26,100.104.249.0/26,100.104.32.64/26,100.104.52.0/26,100.104.84.128/26,100.104.133.128/26,100.104.211.192/26,100.104.196.192/26,100.104.13.128/26,100.104.75.64/26,100.104.174.192/26,100.104.195.64/26,100.104.106.128/26,100.104.76.64/26,100.104.18.128/26,100.104.237.128/26
	Cloud Enterprise Network (CEN)
	Public IP Address	110.76.0.128/26,140.205.47.0/26,110.76.2.128/26,110.75.230.192/26,110.76.8.64/26,140.205.41.192/26,203.209.225.192/26,110.75.235.128/26,110.75.230.64/26,110.75.157.192/26,110.76.9.128/26,110.75.186.0/26,203.209.247.192/26,140.205.47.128/26,110.76.9.64/26,110.75.134.192/26,140.205.196.128/26,203.119.159.192/26,106.11.73.192/26,203.209.225.128/26,110.75.130.192/26,110.76.2.64/26,140.205.41.64/26,110.75.190.0/26,110.76.11.64/26,140.205.197.0/26,203.209.247.128/26,140.205.47.64/26,110.76.9.0/26,110.75.235.0/26,110.75.186.64/26,110.76.9.192/26,106.11.76.64/26,110.75.230.0/26,140.205.196.0/26,110.76.11.128/26,110.76.11.192/26,110.76.11.0/26,59.82.47.0/26,47.102.181.128/26,59.82.46.128/26,110.76.0.0/26,110.76.0.64/26,106.11.76.0/26,47.102.234.0/26,47.102.234.64/26,59.82.46.192/26,110.75.235.64/26,110.75.130.128/26,110.75.134.128/26,110.76.8.0/26,110.75.190.64/26,110.75.143.0/26,8.139.112.64/26,8.139.112.128/26,140.205.196.64/26,8.139.99.192/26,8.139.112.0/26,140.205.47.192/26,110.75.230.128/26,110.76.0.192/26,106.11.73.128/26,140.205.196.192/26,110.75.235.192/26,47.102.181.192/26,59.82.46.64/26,110.76.2.0/26,110.76.2.192/26,39.101.252.128/26

China (Hohhot)

ID da região	Método de acesso	Bloco de endereços IP
cn-huhehaote	Express Connect, VPN Gateway, or Smart Access Gateway	100.104.72.0/24,100.104.145.64/26,100.104.132.64/26,100.104.177.192/26,100.104.12.0/26,100.104.37.128/26,100.104.218.128/26,100.104.250.0/26,100.104.122.128/26,100.104.158.192/26
	Cloud Enterprise Network (CEN)
	Public IP Address	39.102.199.64/26,39.104.72.87,39.104.78.173,39.104.62.152,39.99.77.64/26,39.102.199.128/26,39.104.199.192/26,39.104.79.122,39.102.224.0/26,39.99.77.0/26,39.104.220.0/24,39.104.86.0,39.102.199.192/26,39.99.77.128/26

China (Ulanqab)

ID da região	Método de acesso	Bloco de endereços IP
cn-wulanchabu	Express Connect, VPN Gateway, or Smart Access Gateway	100.104.182.128/26,100.104.100.128/26,100.104.136.192/26,100.104.16.64/26,100.104.78.128/26,100.104.205.192/26,100.104.152.128/26,100.104.199.192/26,100.104.120.0/26,100.104.37.64/26
	Cloud Enterprise Network (CEN)
	Public IP Address	140.205.47.0/24,8.130.69.168,110.76.8.64/26,203.209.225.192/26,140.205.41.192/26,39.101.5.0/26,110.75.157.192/26,110.75.186.0/26,203.209.247.192/26,110.75.134.192/26,8.130.69.173,39.101.0.192/26,203.119.159.192/26,106.11.73.192/26,203.209.225.128/26,110.75.130.192/26,140.205.41.64/26,110.75.190.0/26,8.149.144.0/24,140.205.197.0/26,203.209.247.128/26,110.75.235.0/24,110.75.186.64/26,110.76.9.0/24,106.11.76.64/26,110.75.230.0/24,59.82.126.0/24,8.130.121.252,39.101.7.0/24,140.205.196.0/24,59.82.47.0/26,47.102.181.128/26,59.82.46.128/26,110.76.0.0/24,106.11.76.0/26,47.102.234.0/26,47.102.234.64/26,59.82.46.192/26,110.75.130.128/26,110.75.134.128/26,110.76.8.0/26,110.75.190.64/26,121.89.103.128/26,110.75.143.0/26,110.76.2.0/24,8.139.112.64/26,8.139.112.128/26,8.139.99.192/26,121.89.103.192/26,8.139.112.0/26,39.101.0.64/26,39.101.0.128/26,121.89.103.64/26,106.11.73.128/26,121.89.104.0/26,110.76.11.0/24,59.82.46.64/26,47.102.181.192/26,8.130.48.34,8.130.122.110,110.76.0.128/26,140.205.47.0/26,110.76.2.128/26,110.75.230.192/26,110.75.235.128/26,110.75.230.64/26,110.76.9.128/26,140.205.47.128/26,110.76.9.64/26,140.205.196.128/26,110.76.2.64/26,110.76.11.64/26,140.205.47.64/26,110.76.9.0/26,110.75.235.0/26,110.76.9.192/26,110.75.230.0/26,140.205.196.0/26,110.76.11.128/26,110.76.11.192/26,110.76.11.0/26,110.76.0.0/26,110.76.0.64/26,110.75.235.64/26,140.205.196.64/26,140.205.47.192/26,110.75.230.128/26,110.76.0.192/26,140.205.196.192/26,110.75.235.192/26,110.76.2.0/26,110.76.2.192/26

China (Shenzhen)

ID da região	Método de acesso	Bloco CIDR
cn-shenzhen	Express Connect, VPN Gateway, or Smart Access Gateway	100.104.75.64/26,100.104.235.192/26,100.104.205.0/24,100.104.41.64/26,100.104.171.128/26,100.104.161.192/26,100.104.172.192/26,100.104.168.0/26,100.104.160.128/26,100.104.179.128/26,100.104.98.192/26,100.104.168.128/26,100.104.247.64/26,100.104.17.64/26,100.104.87.0/26,100.104.105.128/26,100.104.114.192/26,100.104.213.64/26
	Cloud Enterprise Network (CEN)
	Public IP Address	110.76.0.128/26,140.205.47.0/26,110.76.2.128/26,110.75.230.192/26,110.76.8.64/26,140.205.41.192/26,203.209.225.192/26,110.75.235.128/26,110.75.230.64/26,110.75.157.192/26,110.76.9.128/26,110.75.186.0/26,203.209.247.192/26,140.205.47.128/26,110.76.9.64/26,110.75.134.192/26,140.205.196.128/26,203.119.159.192/26,106.11.73.192/26,203.209.225.128/26,110.75.130.192/26,110.76.2.64/26,140.205.41.64/26,110.75.190.0/26,110.76.11.64/26,140.205.197.0/26,203.209.247.128/26,140.205.47.64/26,110.76.9.0/26,110.75.235.0/26,110.75.186.64/26,110.76.9.192/26,106.11.76.64/26,110.75.230.0/26,140.205.196.0/26,110.76.11.128/26,110.76.11.192/26,110.76.11.0/26,59.82.47.0/26,47.102.181.128/26,59.82.46.128/26,110.76.0.0/26,110.76.0.64/26,106.11.76.0/26,47.102.234.0/26,47.102.234.64/26,59.82.46.192/26,110.75.235.64/26,110.75.130.128/26,110.75.134.128/26,110.76.8.0/26,110.75.190.64/26,110.75.143.0/26,8.139.112.64/26,8.139.112.128/26,140.205.196.64/26,8.139.99.192/26,8.139.112.0/26,140.205.47.192/26,110.75.230.128/26,110.76.0.192/26,106.11.73.128/26,140.205.196.192/26,110.75.235.192/26,47.102.181.192/26,59.82.46.64/26,110.76.2.0/26,110.76.2.192/26,120.24.136.0/26,119.23.166.64/26,8.129.151.192/26,47.121.45.0/26,47.112.83.192/26,47.106.63.192/26,47.112.84.64/26,8.129.151.0/26,47.112.84.0/26,47.106.63.0/26,8.129.151.128/26,47.106.63.64/26,47.112.84.128/26,47.120.229.128/26,8.129.151.64/26,47.106.63.128/26,47.113.76.192/26

China (Heyuan)

ID da região	Método de conexão	Bloco de endereços IP
cn-heyuan	Express Connect, VPN Gateway, or Smart Access Gateway	100.104.147.192/26,100.104.76.192/26,100.104.246.192/26,100.104.106.192/26,100.104.210.128/26,100.104.48.128/26
	Cloud Enterprise Network (CEN)
	Public IP Address	110.76.0.128/26,140.205.47.0/26,110.76.2.128/26,110.75.230.192/26,110.76.8.64/26,140.205.41.192/26,203.209.225.192/26,110.75.235.128/26,110.75.230.64/26,110.75.157.192/26,110.76.9.128/26,110.75.186.0/26,203.209.247.192/26,140.205.47.128/26,110.76.9.64/26,110.75.134.192/26,140.205.196.128/26,203.119.159.192/26,106.11.73.192/26,203.209.225.128/26,110.75.130.192/26,110.76.2.64/26,140.205.41.64/26,110.75.190.0/26,110.76.11.64/26,140.205.197.0/26,203.209.247.128/26,140.205.47.64/26,110.76.9.0/26,110.75.235.0/26,110.75.186.64/26,110.76.9.192/26,106.11.76.64/26,110.75.230.0/26,140.205.196.0/26,110.76.11.128/26,110.76.11.192/26,110.76.11.0/26,59.82.47.0/26,47.102.181.128/26,59.82.46.128/26,110.76.0.0/26,110.76.0.64/26,106.11.76.0/26,47.102.234.0/26,47.102.234.64/26,59.82.46.192/26,110.75.235.64/26,110.75.130.128/26,110.75.134.128/26,110.76.8.0/26,110.75.190.64/26,110.75.143.0/26,8.139.112.64/26,8.139.112.128/26,140.205.196.64/26,8.139.99.192/26,8.139.112.0/26,140.205.47.192/26,110.75.230.128/26,110.76.0.192/26,106.11.73.128/26,140.205.196.192/26,110.75.235.192/26,47.102.181.192/26,59.82.46.64/26,110.76.2.0/26,110.76.2.192/26,47.113.157.64/26,47.113.157.192/26,47.113.157.128/26,47.113.158.0/26

China (Guangzhou)

ID da região	Método de acesso	Bloco CIDR
cn-guangzhou	Express Connect, VPN Gateway, or Smart Access Gateway	100.104.132.64/26,100.104.240.128/26,100.104.122.128/26,100.104.233.0/26,100.104.166.64/26,100.104.100.128/26,100.104.136.192/26,100.104.16.64/26,100.104.11.64/26
	Cloud Enterprise Network (CEN)
	Public IP Address	110.76.0.128/26,140.205.47.0/26,110.76.2.128/26,110.75.230.192/26,110.76.8.64/26,140.205.41.192/26,203.209.225.192/26,110.75.235.128/26,110.75.230.64/26,110.75.157.192/26,110.76.9.128/26,110.75.186.0/26,203.209.247.192/26,140.205.47.128/26,110.76.9.64/26,110.75.134.192/26,140.205.196.128/26,203.119.159.192/26,106.11.73.192/26,203.209.225.128/26,110.75.130.192/26,110.76.2.64/26,140.205.41.64/26,110.75.190.0/26,110.76.11.64/26,140.205.197.0/26,203.209.247.128/26,140.205.47.64/26,110.76.9.0/26,110.75.235.0/26,110.75.186.64/26,110.76.9.192/26,106.11.76.64/26,110.75.230.0/26,140.205.196.0/26,110.76.11.128/26,110.76.11.192/26,110.76.11.0/26,59.82.47.0/26,47.102.181.128/26,59.82.46.128/26,110.76.0.0/26,110.76.0.64/26,106.11.76.0/26,47.102.234.0/26,47.102.234.64/26,59.82.46.192/26,110.75.235.64/26,110.75.130.128/26,110.75.134.128/26,110.76.8.0/26,110.75.190.64/26,110.75.143.0/26,8.139.112.64/26,8.139.112.128/26,140.205.196.64/26,8.139.99.192/26,8.139.112.0/26,140.205.47.192/26,110.75.230.128/26,110.76.0.192/26,106.11.73.128/26,140.205.196.192/26,110.75.235.192/26,47.102.181.192/26,59.82.46.64/26,110.76.2.0/26,110.76.2.192/26,8.134.0.64/26,8.134.0.128/26,8.134.0.192/26,8.134.5.0/26,8.134.79.141/32,8.134.79.143/32

China (Wuhan)

ID da região	Método de acesso	Bloco de endereços IP
cn-wuhan-lr	Express Connect, VPN Gateway, or Smart Access Gateway	100.104.182.128/26,100.104.127.0/26,100.104.48.128/26,100.104.69.0/26,100.104.87.192/26,100.104.145.64/26
	Cloud Enterprise Network (CEN)
	Public IP Address	110.76.0.128/26,140.205.47.0/26,110.76.2.128/26,110.75.230.192/26,110.76.8.64/26,140.205.41.192/26,203.209.225.192/26,110.75.235.128/26,110.75.230.64/26,110.75.157.192/26,110.76.9.128/26,110.75.186.0/26,203.209.247.192/26,140.205.47.128/26,110.76.9.64/26,110.75.134.192/26,140.205.196.128/26,203.119.159.192/26,106.11.73.192/26,203.209.225.128/26,110.75.130.192/26,110.76.2.64/26,140.205.41.64/26,110.75.190.0/26,110.76.11.64/26,140.205.197.0/26,203.209.247.128/26,140.205.47.64/26,110.76.9.0/26,110.75.235.0/26,110.75.186.64/26,110.76.9.192/26,106.11.76.64/26,110.75.230.0/26,140.205.196.0/26,110.76.11.128/26,110.76.11.192/26,110.76.11.0/26,59.82.47.0/26,47.102.181.128/26,59.82.46.128/26,110.76.0.0/26,110.76.0.64/26,106.11.76.0/26,47.102.234.0/26,47.102.234.64/26,59.82.46.192/26,110.75.235.64/26,110.75.130.128/26,110.75.134.128/26,110.76.8.0/26,110.75.190.64/26,110.75.143.0/26,8.139.112.64/26,8.139.112.128/26,140.205.196.64/26,8.139.99.192/26,8.139.112.0/26,140.205.47.192/26,110.75.230.128/26,110.76.0.192/26,106.11.73.128/26,140.205.196.192/26,110.75.235.192/26,47.102.181.192/26,59.82.46.64/26,110.76.2.0/26,110.76.2.192/26,8.148.11.160/32,8.148.12.15/32,8.148.11.99/32,8.148.10.43/32,8.148.10.61/32

China (Chengdu)

ID da região	Método de acesso	Bloco de endereços IP
cn-chengdu	Express Connect, VPN Gateway, or Smart Access Gateway	100.104.76.192/26,100.104.145.64/26,100.104.235.192/26,100.104.127.0/26,100.104.166.64/26,100.104.100.128/26,100.104.136.192/26,100.104.16.64/26,100.104.149.128/26,100.104.177.0/26,100.104.120.192/26
	Cloud Enterprise Network (CEN)
	Public IP Address	47.109.5.0/26,110.75.225.0/26,110.75.225.64/26,110.75.225.128/26,110.75.225.192/26,223.4.187.192/26,223.5.153.0/26,223.5.153.64/26,223.5.153.128/26,110.75.134.128/26,110.75.134.192/26,110.75.143.0/26,110.75.157.192/26,110.75.186.0/26,110.75.186.64/26,110.75.190.0/26,110.75.190.64/26,8.139.99.192/26,8.139.112.0/26,8.139.112.64/26,8.139.112.128/26,47.108.33.192/26,47.109.170.0/26,47.109.170.64/26,47.109.170.128/26,47.102.181.128/26,47.102.181.192/26,47.102.234.0/26,47.102.234.64/26

Outras regiões

China (Hong Kong)

ID da região	Método de acesso	Bloco de endereços IP
cn-hongkong	Express Connect, VPN Gateway, or Smart Access Gateway	100.104.233.0/24,100.104.177.192/26,100.104.158.192/26,100.104.180.192/26,100.104.120.0/26,100.104.2.64/26,100.104.242.64/26,100.104.187.64/26,100.104.169.0/26,100.104.37.0/26,100.104.6.128/26,100.104.142.192/26,100.104.144.128/26
	Cloud Enterprise Network (CEN)
	Public IP Address	140.205.47.0/24,110.76.8.64/26,47.240.180.192/26,203.209.225.192/26,140.205.41.192/26,110.75.157.192/26,110.75.186.0/26,203.209.247.192/26,110.75.134.192/26,203.119.159.192/26,106.11.73.192/26,203.209.225.128/26,47.240.211.0/26,110.75.130.192/26,140.205.41.64/26,110.75.190.0/26,8.149.144.0/24,47.90.37.175,140.205.197.0/26,203.209.247.128/26,110.75.235.0/24,110.75.186.64/26,110.76.9.0/24,106.11.76.64/26,110.75.230.0/24,47.240.210.192/26,140.205.196.0/24,59.82.47.0/26,47.243.0.32/28,47.102.181.128/26,59.82.46.128/26,110.76.0.0/24,106.11.76.0/26,47.89.39.119,47.102.234.0/26,47.90.38.29,47.102.234.64/26,59.82.46.192/26,110.75.130.128/26,110.75.134.128/26,110.76.8.0/26,110.75.190.64/26,110.75.143.0/26,110.76.2.0/24,8.139.112.64/26,8.139.112.128/26,47.240.195.0/26,8.139.99.192/26,8.139.112.0/26,47.240.195.128/26,106.11.73.128/26,110.76.11.0/24,59.82.46.64/26,47.102.181.192/26,47.90.24.64/26,47.240.195.64/26,47.240.210.64/26,47.240.210.128/26,110.76.0.128/26,140.205.47.0/26,110.76.2.128/26,110.75.230.192/26,110.75.235.128/26,110.75.230.64/26,110.76.9.128/26,140.205.47.128/26,110.76.9.64/26,140.205.196.128/26,110.76.2.64/26,110.76.11.64/26,140.205.47.64/26,110.76.9.0/26,110.75.235.0/26,110.76.9.192/26,110.75.230.0/26,140.205.196.0/26,110.76.11.128/26,110.76.11.192/26,110.76.11.0/26,110.76.0.0/26,110.76.0.64/26,110.75.235.64/26,140.205.196.64/26,140.205.47.192/26,110.75.230.128/26,110.76.0.192/26,140.205.196.192/26,110.75.235.192/26,110.76.2.0/26,110.76.2.192/26

Singapore

ID da região	Método de acesso	Bloco CIDR
ap-southeast-1	Express Connect, VPN Gateway, or Smart Access Gateway	100.104.188.0/24,100.104.207.128/26,100.104.12.0/26,100.104.179.64/26,100.104.41.64/26,100.104.59.64/26,100.104.91.64/26,100.104.111.64/26,100.104.44.0/26,100.104.238.64/26
	Cloud Enterprise Network (CEN)
	Public IP Address	161.117.146.192/26,161.117.164.64/26,161.117.164.0/26,161.117.172.0/28,161.117.146.128/26,47.102.181.128/26,47.102.181.192/26,47.102.234.64/26,47.102.234.0/26,8.139.112.64/26,8.139.112.0/26,8.139.112.128/26,8.139.99.192/26,47.89.72.128/26,47.89.73.128/26,47.89.73.192/26,47.89.75.192/26,47.89.88.64/26,47.89.90.64/26,47.246.74.192/26,47.246.107.0/26,47.89.88.0/26,47.89.90.0/26,47.246.108.64/26,47.246.164.64/26,47.89.88.128/26,47.246.73.64/26,47.246.74.0/26,47.246.175.192/26,110.76.0.128/26,47.88.233.192/26,140.205.47.0/26,110.76.2.128/26,110.75.230.192/26,110.76.8.64/26,140.205.41.192/26,203.209.225.192/26,110.75.235.128/26,47.88.233.128/26,110.75.230.64/26,110.75.157.192/26,110.76.9.128/26,110.75.186.0/26,203.209.247.192/26,47.74.206.0/26,140.205.47.128/26,110.76.9.64/26,110.75.134.192/26,47.88.233.0/26,140.205.196.128/26,203.119.159.192/26,106.11.73.192/26,203.209.225.128/26,110.75.130.192/26,110.76.2.64/26,140.205.41.64/26,110.75.190.0/26,110.76.11.64/26,140.205.197.0/26,47.74.206.192/26,203.209.247.128/26,140.205.47.64/26,110.76.9.0/26,110.75.235.0/26,110.75.186.64/26,110.76.9.192/26,106.11.76.64/26,110.75.230.0/26,140.205.196.0/26,110.76.11.128/26,110.76.11.192/26,110.76.11.0/26,59.82.47.0/26,59.82.46.128/26,110.76.0.0/26,110.76.0.64/26,106.11.76.0/26,59.82.46.192/26,110.75.235.64/26,110.75.130.128/26,110.75.134.128/26,110.76.8.0/26,110.75.190.64/26,110.75.143.0/26,140.205.196.64/26,47.74.206.128/26,140.205.47.192/26,110.75.230.128/26,47.74.206.64/26,110.76.0.192/26,106.11.73.128/26,47.88.233.64/26,140.205.196.192/26,110.75.235.192/26,59.82.46.64/26,110.76.2.0/26,110.76.2.192/26

Malaysia (Kuala Lumpur)

ID da região	Método de acesso	Bloco de endereços IP
ap-southeast-3	Express Connect, VPN Gateway, or Smart Access Gateway	100.104.5.0/24,100.104.36.0/26,100.104.234.192/26,100.104.76.192/26,100.104.69.0/26,100.104.87.192/26,100.104.158.192/26,100.104.250.0/26,100.104.62.64/26
	Cloud Enterprise Network (CEN)
	Public IP Address	47.250.30.0/24,47.250.34.128/28,47.250.29.0/24,47.87.205.0/26,47.250.30.128/26,47.250.30.0/26,47.250.30.64/26,47.250.29.64/26,47.87.205.192/26,47.87.205.128/26,47.250.30.192/26,47.250.29.192/26,47.250.29.0/26,47.87.205.64/26,47.250.29.128/26,47.87.206.192/26,47.87.206.64/26,47.87.206.128/26,47.87.206.0/26

Indonesia (Jakarta)

ID da região	Método de acesso	Endereços IP
ap-southeast-5	Express Connect, VPN Gateway, or Smart Access Gateway	100.104.175.0/24,100.104.35.192/26,100.104.235.192/26,100.104.12.0/26,100.104.111.0/26,100.104.158.192/26,100.104.37.128/26,100.104.218.128/26,100.104.57.192/26
	Cloud Enterprise Network (CEN)
	Public IP Address	8.215.147.0/28,147.139.132.101,149.129.230.192/26,147.139.156.64/26,147.139.165.206,147.139.133.46,147.139.179.168,147.139.156.0/26,147.139.156.128/26

Philippines (Manila)

ID da região	Método de acesso	Bloco CIDR
ap-southeast-6	Express Connect, VPN Gateway, or Smart Access Gateway	100.104.153.64/26,100.104.76.192/26,100.104.246.192/26,100.104.158.192/26,100.104.37.128/26,100.104.218.128/26,100.104.250.0/26,100.104.199.192/26
	Cloud Enterprise Network (CEN)
	Public IP Address	8.212.137.0/26,8.212.136.192/26,8.212.136.128/26,8.212.136.64/26

Thailand (Bangkok)

ID da região	Método de acesso	Bloco CIDR
ap-southeast-7	Express Connect, VPN Gateway, or Smart Access Gateway	100.104.150.192/26,100.104.75.64/26,100.104.132.64/26,100.104.177.192/26,100.104.12.0/26,100.104.180.192/26
	Cloud Enterprise Network (CEN)
	Public IP Address	8.213.163.0/26,8.213.162.64/26,8.213.162.128/26,8.213.162.192/26,47.81.23.64/26,47.81.23.128/25

Japan (Tokyo)

ID da região	Método de acesso	Bloco CIDR
ap-northeast-1	Express Connect, VPN Gateway, or Smart Access Gateway	100.104.112.0/24,100.104.117.192/26,100.104.12.0/26,100.104.166.64/26,100.104.179.64/26,100.104.108.128/26,100.104.100.128/26,100.104.136.192/26,100.104.111.64/26
	Cloud Enterprise Network (CEN)
	Public IP Address	47.91.0.128/26,47.245.51.0/24,47.245.18.192/26,47.245.18.128/26,47.91.0.192/26,8.209.192.160/28,47.245.51.64/26,47.245.51.0/26,47.87.192.64/26,47.245.51.192/26,47.87.192.192/26,47.245.51.128/26,47.87.192.0/26,47.87.192.128/26

US (Silicon Valley)

ID da região	Método de acesso	Bloco de endereços IP
us-west-1	Express Connect, VPN Gateway, or Smart Access Gateway	100.104.175.0/24,100.104.48.128/26,100.104.166.64/26,100.104.108.128/26,100.104.100.128/26,100.104.136.192/26,100.104.16.64/26,100.104.242.64/26,100.104.57.192/26,100.104.11.64/26,100.104.24.192/26,100.104.67.64/26
	Cloud Enterprise Network (CEN)
	Public IP Address	140.205.47.0/24,110.76.8.64/26,203.209.225.192/26,140.205.41.192/26,110.75.157.192/26,110.75.186.0/26,203.209.247.192/26,47.88.98.0/24,110.75.134.192/26,203.119.159.192/26,47.88.15.174,106.11.73.192/26,203.209.225.128/26,110.75.130.192/26,47.252.71.192/26,140.205.41.64/26,110.75.190.0/26,8.149.144.0/24,140.205.197.0/26,203.209.247.128/26,110.75.235.0/24,47.252.90.64/26,110.75.186.64/26,110.76.9.0/24,106.11.76.64/26,47.88.6.196,110.75.230.0/24,140.205.196.0/24,59.82.47.0/26,47.102.181.128/26,59.82.46.128/26,110.76.0.0/24,106.11.76.0/26,47.88.10.217,47.102.234.0/26,47.252.71.128/26,47.102.234.64/26,59.82.46.192/26,110.75.130.128/26,110.75.134.128/26,110.76.8.0/26,110.75.190.64/26,110.75.143.0/26,110.76.2.0/24,47.88.1.17,8.139.112.64/26,8.139.112.128/26,47.252.90.0/26,8.139.99.192/26,47.251.136.112/28,8.139.112.0/26,106.11.73.128/26,110.76.11.0/24,59.82.46.64/26,47.102.181.192/26,47.88.98.128/26,47.88.98.192/26,47.88.98.64/26,47.88.98.0/26,47.251.17.180,47.77.112.0/20,47.87.192.0/18

US (Virginia)

ID da região	Método de acesso	Bloco CIDR de IP
us-east-1	Express Connect, VPN Gateway, or Smart Access Gateway	100.104.233.0/24,100.104.240.128/26,100.104.132.64/26,100.104.177.192/26,100.104.12.0/26,100.104.111.0/26,100.104.122.128/26,100.104.87.192/26,100.104.179.64/26,100.104.41.64/26,100.104.238.64/26,100.104.171.128/26
	Cloud Enterprise Network (CEN)
	Public IP Address	110.76.0.128/26,140.205.47.0/26,110.76.2.128/26,110.75.230.192/26,110.76.8.64/26,140.205.41.192/26,203.209.225.192/26,110.75.235.128/26,110.75.230.64/26,110.75.157.192/26,110.76.9.128/26,110.75.186.0/26,203.209.247.192/26,140.205.47.128/26,110.76.9.64/26,110.75.134.192/26,140.205.196.128/26,203.119.159.192/26,106.11.73.192/26,203.209.225.128/26,110.75.130.192/26,110.76.2.64/26,140.205.41.64/26,110.75.190.0/26,110.76.11.64/26,140.205.197.0/26,203.209.247.128/26,140.205.47.64/26,110.76.9.0/26,110.75.235.0/26,110.75.186.64/26,110.76.9.192/26,106.11.76.64/26,110.75.230.0/26,140.205.196.0/26,110.76.11.128/26,110.76.11.192/26,110.76.11.0/26,59.82.47.0/26,47.102.181.128/26,59.82.46.128/26,110.76.0.0/26,110.76.0.64/26,106.11.76.0/26,47.102.234.0/26,47.102.234.64/26,59.82.46.192/26,110.75.235.64/26,110.75.130.128/26,110.75.134.128/26,110.76.8.0/26,110.75.190.64/26,110.75.143.0/26,8.139.112.64/26,8.139.112.128/26,140.205.196.64/26,8.139.99.192/26,8.139.112.0/26,140.205.47.192/26,110.75.230.128/26,110.76.0.192/26,106.11.73.128/26,140.205.196.192/26,110.75.235.192/26,47.102.181.192/26,59.82.46.64/26,110.76.2.0/26,110.76.2.192/26,47.252.91.128/26,47.88.98.128/26,47.250.29.192/26,47.252.71.192/26,47.252.90.0/26,47.252.91.192/26,47.250.29.64/26,47.88.98.192/26,47.252.90.64/26,47.252.71.128/26,47.88.98.64/26,47.250.29.0/26,47.250.29.128/26,47.252.91.0/26,47.88.98.0/26,47.252.91.64/26,47.253.64.0/28,47.87.206.192/26,47.87.206.64/26,47.87.206.128/26,47.87.206.0/26,47.90.220.124,47.77.112.0/20,47.87.192.0/18

Germany (Frankfurt)

ID da região	Método de acesso	Bloco CIDR
eu-central-1	Express Connect, VPN Gateway, or Smart Access Gateway	100.104.5.0/24,100.104.193.128/26,100.104.161.64/26,100.104.89.128/26,100.104.177.0/26,100.104.224.0/26,100.104.92.128/26,100.104.62.64/26,100.104.216.192/26
	Cloud Enterprise Network (CEN)
	Public IP Address	8.209.86.0/26,47.254.165.128/26,47.245.155.0/28,47.254.165.64/26,47.254.165.192/26,47.254.180.0/24,110.76.0.128/26,140.205.47.0/26,110.76.2.128/26,110.75.230.192/26,110.76.8.64/26,140.205.41.192/26,203.209.225.192/26,110.75.235.128/26,110.75.230.64/26,110.75.157.192/26,110.76.9.128/26,110.75.186.0/26,203.209.247.192/26,140.205.47.128/26,110.75.134.192/26,110.76.9.64/26,140.205.196.128/26,203.119.159.192/26,106.11.73.192/26,203.209.225.128/26,110.75.130.192/26,110.76.2.64/26,140.205.41.64/26,110.75.190.0/26,110.76.11.64/26,140.205.197.0/26,203.209.247.128/26,140.205.47.64/26,110.76.9.0/26,110.75.235.0/26,110.75.186.64/26,110.76.9.192/26,106.11.76.64/26,110.75.230.0/26,140.205.196.0/26,110.76.11.128/26,110.76.11.192/26,110.76.11.0/26,59.82.47.0/26,47.102.181.128/26,59.82.46.128/26,110.76.0.0/26,110.76.0.64/26,106.11.76.0/26,47.102.234.0/26,47.102.234.64/26,59.82.46.192/26,110.75.235.64/26,110.75.130.128/26,110.75.134.128/26,110.76.8.0/26,110.75.190.64/26,110.75.143.0/26,8.139.112.64/26,8.139.112.128/26,8.139.99.192/26,140.205.196.64/26,8.139.112.0/26,140.205.47.192/26,110.75.230.128/26,110.76.0.192/26,106.11.73.128/26,140.205.196.192/26,110.75.235.192/26,47.102.181.192/26,59.82.46.64/26,110.76.2.0/26,110.76.2.192/26,47.87.212.0/26,47.87.212.64/26,47.87.212.128/26,47.87.212.192/26

UK (London)

ID da região	Método de acesso	Bloco de endereços IP
eu-west-1	Express Connect, VPN Gateway, or Smart Access Gateway	100.104.133.64/26, 100.104.207.128/26, 100.104.87.192/26, 100.104.145.64/26, 100.104.235.192/26, 100.104.75.64/26, 100.104.132.64/26, 100.104.92.128/26
	Cloud Enterprise Network (CEN)
	Public IP Address	8.208.72.0/24, 8.208.73.0/24, 8.208.75.64/28, 47.88.98.0/24, 47.88.98.128/26, 47.88.98.192/26, 47.88.98.64/26, 47.88.98.0/26, 8.208.73.64/26, 8.208.72.64/26, 8.208.72.0/26, 8.208.72.128/26, 8.208.73.0/26, 8.208.73.128/26, 8.208.72.192/26, 8.208.73.192/26, 47.87.236.128/26, 47.87.236.0/26, 47.87.236.64/26, 47.87.236.192/26

UAE (Dubai)

ID da região	Método de acesso	Bloco CIDR
me-east-1	Express Connect, VPN Gateway, or Smart Access Gateway	100.104.205.0/24,100.104.161.0/26,100.104.53.0/26,100.104.111.128/26,100.104.248.128/26
	Cloud Enterprise Network (CEN)
	Public IP Address	8.209.86.0/26,47.254.165.128/26,47.254.165.64/26,47.254.165.192/26,47.87.212.0/26,47.87.212.64/26,47.87.212.128/26,47.87.212.192/26

South Korea (Seoul)

ID da região	Método de acesso	Bloco CIDR
ap-northeast-2	Express Connect, VPN Gateway, or Smart Access Gateway	100.104.119.128/26, 100.104.153.64/26, 100.104.76.192/26, 100.104.246.192/26, 100.104.106.192/26, 100.104.210.128/26, 100.104.62.64/26
	Cloud Enterprise Network (CEN)
	Public IP Address	149.129.14.128/26, 149.129.13.64/26, 149.129.14.192/26, 149.129.13.0/26

Saudi Arabia (Riyadh)

ID da região	Método de acesso	Blocos CIDR
me-central-1	Express Connect, VPN Gateway, or Smart Access Gateway	100.104.106.192/26,100.104.145.64/26,100.104.210.128/26,100.104.48.128/26,100.104.69.0/26,100.104.76.192/26,100.104.87.192/26,100.104.242.64/26
	Cloud Enterprise Network (CEN)
	Public IP Address	8.213.0.192/26,8.213.5.0/26,8.213.16.59,8.213.16.111,8.213.16.123,8.213.16.17,8.213.16.91,8.213.5.64/26,8.213.6.0/24,8.213.0.128/26,8.213.6.64/26,8.213.6.192/26,8.213.6.0/26,8.213.6.128/26

Mexico (Mexico City)

ID da região	Método de acesso	Bloco de endereços IP
na-south-1	Express Connect, VPN Gateway, or Smart Access Gateway	100.104.35.192/26,100.104.122.128/26
	Cloud Enterprise Network (CEN)	100.104.35.192/26,100.104.122.128/26
	Public IP Address	47.246.169.0/26,47.87.0.64/26,47.89.89.64/26,47.246.171.0/26,47.87.196.128/26,47.246.170.128/26,47.246.168.64/26,47.89.75.0/26,47.87.1.0/26,47.89.89.192/26,47.87.196.0/26,47.246.170.64/26,47.89.74.192/26,47.235.1.64/26,47.89.75.64/26,47.87.196.64/26,47.87.196.192/26,47.87.0.192/26,47.246.170.192/26,47.246.169.128/26,47.246.168.0/26,47.89.89.128/26,47.235.1.128/26,47.89.74.128/26,47.246.168.192/26,47.246.169.192/26,47.87.0.128/26,47.235.0.192/26,47.246.171.64/26,47.246.164.192/26,47.246.169.64/26,47.235.1.192/26

Perguntas frequentes

Qual porta abrir para os blocos CIDR de endereços IP do DTS?

Abra a porta que o seu banco de dados utiliza. Por exemplo, a porta padrão do MySQL é 3306, e a porta padrão do PostgreSQL é 5432.
Como lidar com a lista de permissões de IP após a conclusão de uma tarefa do DTS?

Por questões de segurança, após a conclusão de uma tarefa do DTS, remova os blocos CIDR de endereços IP do DTS da lista de permissões de IP ou do grupo de segurança do seu banco de dados. Exclua os grupos da lista de permissões (por exemplo, rdsdts) ou os grupos de segurança (por exemplo, SG-DTS-GROUP-xxxx) que o DTS cria automaticamente.
Por que o acesso por endereço IP público exige endereços IP das regiões de source e de destino?

Isso é necessário apenas para tarefas de sincronização de dados. O DTS implanta nós de trabalho nas regiões de source e de destino para executar heartbeats bidirecionais e comparações de dados. Isso garante a consistência dos dados e a estabilidade do link. Outros tipos de tarefa, como migração e rastreamento de alterações, seguem a regra de região única.
Como evitar a adição de um grande número de blocos CIDR de IP do DTS à lista de permissões (por exemplo, se a aprovação de segurança for difícil)?

Para tarefas de migração de dados, geralmente é necessária uma lista de permissões de IP completa, pois o DTS precisa se conectar diretamente aos bancos de dados de source e de destino. Não é possível contornar a lista de permissões usando uma conexão VPC para esse tipo de tarefa. Se a aprovação de segurança dificultar a adição de um grande número de blocos CIDR de IP, considere as seguintes alternativas:
- Mudar para sincronização de dados: as tarefas de sincronização de dados aceitam conexões de rede privada, como Express Connect, VPN Gateway, or Smart Access Gateway ou Cloud Enterprise Network (CEN). O acesso por rede privada utiliza blocos CIDR internos da Alibaba Cloud (sub-redes 100.64.0.0/10), o que reduz significativamente a quantidade de blocos CIDR de IP a serem adicionados ou elimina totalmente a necessidade de configurar a lista de permissões.
- Mudar para um método de acesso por rede privada: se o seu ambiente oferecer suporte, conecte o banco de dados de source ou de destino à Alibaba Cloud por meio de Express Connect, VPN Gateway, or Smart Access Gateway, VPN Gateway ou Cloud Enterprise Network (CEN). Isso reduz os blocos CIDR de IP necessários para um pequeno intervalo interno.
- Usar 0.0.0.0/0 (acesso a todas as redes): se o banco de dados de source tiver um limite para o número de entradas na lista de permissões e não for possível adicionar todos os blocos CIDR de IP do DTS, configure 0.0.0.0/0 para permitir o acesso de todos os endereços IP. Aviso de segurança: essa abordagem apresenta riscos significativos à segurança. Caso escolha esta opção, implemente medidas de segurança adicionais, como senhas fortes para a conta, uma conta de banco de dados dedicada com privilégios mínimos para o DTS e conexões criptografadas.
Como resolver o código de erro DTS-999999 (falha de conexão) do DTS?

O código de erro DTS-999999 geralmente indica que o DTS não consegue se conectar ao banco de dados de source ou de destino. A causa mais comum é uma lista de permissões incompleta, em que nem todos os blocos CIDR de IP do servidor DTS necessários foram adicionados às configurações de segurança do banco de dados.

Para resolver esse problema:
1. Consulte a Etapa 2: Determinar a região do IP do servidor DTS para confirmar quais blocos CIDR de IP do DTS de quais regiões precisam ser adicionados, com base no tipo de tarefa e na localização dos bancos de dados. Observe que diferentes tipos de tarefa possuem requisitos diferentes. Por exemplo:
  - Migração de dados: o banco de dados de source requer blocos CIDR de IP da região do banco de dados de destino.
  - Sincronização de dados: o banco de dados de source requer blocos CIDR de IP das regiões dos bancos de dados de source e de destino.
2. Verifique se você adicionou todos os blocos CIDR de IP das regiões necessárias por completo. A ausência de um único bloco CIDR pode causar falhas de conexão.
3. Após atualizar a lista de permissões, tente executar a tarefa do DTS novamente.
Se o erro persistir após a verificação da lista de permissões, verifique as regras de firewall para garantir que os blocos CIDR de IP do DTS tenham acesso a todas as portas. Restrições de porta também podem causar o erro DTS-999999.

APIs relacionadas

API	Descrição
Get DTS server IP addresses	Retorna os endereços IP dos servidores DTS.