:Step 2: Configure whitelists

Methods for configuring a whitelist

Add public IP addresses to a whitelist

If you want to access a Tair instance from an on-premises device or if your ECS instance is not in the same virtual private cloud (VPC) as the Tair instance, perform the following steps to create a whitelist:

1. Log on to the Tair console and go to the Instances page. In the top navigation bar, select the region in which the instance that you want to manage resides. Then, find the instance and click the instance ID.

2. In the left-side navigation pane, click Whitelist Settings.

3. Find the default whitelist and click Modify in the Actions column.

   Note

   You can also click Add Whitelist to create a whitelist. The name of a whitelist must be 2 to 32 characters in length and can contain lowercase letters, digits, and underscores (_). It must start with a lowercase letter and end with a lowercase letter or digit.

4. Set Method to Add IP Address to Add Manually.

5. In the Whitelist field, enter IP addresses or CIDR blocks.

   Methods for querying the public IP addresses of on-premises devices and ECS instances

   Category	Method for querying public IP addresses
   ECS instance	How do I query the IP addresses of ECS instances?
   On-premises device	The method for querying the public IP address of an on-premises device may vary based on your network environment or operation. The following list provides reference methods for obtaining the public IP address of an on-premises device by using commands in different operating systems: Linux: Open the CLI, enter the curl ifconfig.me command, and then press Enter. Windows: Open Command Prompt, enter the curl ip.me command, and then press Enter. macOS: Start Terminal, enter the curl ifconfig.me command, and then press Enter.

   Separate multiple IP addresses with commas (,). A maximum of 1,000 unique IP addresses can be added. You can enter IP addresses and CIDR blocks in the following formats:

   • Specific IP addresses such as 10.23.12.24.

   • CIDR blocks such as 10.23.12.0/24. /24 indicates the length of the IP address prefix. An IP address prefix can be 1 to 32 bits in length. 10.23.12.0/24 indicates an IP address range from 10.23.12.0 to 10.23.12.255. For more information about CIDR blocks, see FAQ about CIDR blocks.

   Warning

   If you add 0.0.0.0/0 to a whitelist of a Tair instance, all IP addresses can connect to the instance. This operation poses security risks. Proceed with caution.

6. Click OK.

7. (Optional) To remove all IP addresses from a whitelist and delete the whitelist, click Delete in the Actions column corresponding to the whitelist.

   Default whitelists generated by the system cannot be deleted, such as default and hdm_security_ips.

Add private IP addresses of ECS instances to a whitelist

If your ECS instance belongs to the same VPC as a Tair instance, we recommend that you connect the ECS instance to the Tair instance over the VPC.

1. Log on to the Tair console and go to the Instances page. In the top navigation bar, select the region in which the instance that you want to manage resides. Then, find the instance and click the instance ID.

2. In the left-side navigation pane, click Whitelist Settings.

3. Find the default whitelist and click Modify in the Actions column.

   Note

   You can also click Add Whitelist to create a whitelist. The name of a whitelist must be 2 to 32 characters in length and can contain lowercase letters, digits, and underscores (_). It must start with a lowercase letter and end with a lowercase letter or digit.

4. If you set Method to Add IP Address to Import ECS Internal IP Address, the panel displays the private IP addresses of ECS instances that are deployed in the same region as the Tair instance.

5. Move the pointer over an IP address to view the ID and name of the ECS instance to which the IP address is assigned. Then, select the required IP addresses.

6. Click OK.

7. (Optional) To remove all IP addresses from a whitelist and delete the whitelist, click Delete in the Actions column corresponding to the whitelist.

   Default whitelists generated by the system cannot be deleted, such as default and hdm_security_ips.

Batch add public and private IP addresses of ECS instances by using security groups

If you want to connect multiple ECS instances to a Tair instance, you can add a security group as a whitelist for the Tair instance. After you add an ECS security group as a whitelist for a Tair instance, all ECS instances in the security group can access the Tair instance over an internal network or the Internet. If you want to access the Tair instance over the Internet, you must apply for a public endpoint for the Tair instance in advance. For more information, see Use a public endpoint to connect to a Tair instance.

1. Log on to the Tair console and go to the Instances page. In the top navigation bar, select the region in which the instance that you want to manage resides. Then, find the instance and click the instance ID.

2. In the left-side navigation pane, click Whitelist Settings.

3. Click the Security Groups tab.

4. On the Security Groups tab, click Create Security Group.

5. In the dialog box that appears, select the security groups that you want to add as whitelists.

   You can use a security group name or security group ID to perform fuzzy search.

   Figure 3. Add security groups

   Note

   You can add up to 10 security groups as whitelists for each Tair instance.

6. Click OK.

7. (Optional) To remove all security groups, click Delete.

Related API operations

FAQ

Escape character is '^]'.
Connection closed by foreign host.