Configure a whitelist

Notes

• A whitelist provides strong access security for your ApsaraDB for ClickHouse cluster. We recommend maintaining the whitelist regularly.

• To ensure data security, ApsaraDB for ClickHouse prohibits setting a whitelist to 0.0.0.0 or 0.0.0.0/0.

• The default whitelist group (default) contains only 127.0.0.1, which blocks all other IP addresses from accessing the ApsaraDB for ClickHouse cluster. It cannot be deleted, but can only be modified or cleared.

• Do not modify or delete system-generated groups to avoid affecting the functionality of related products.

  For example, dms is the whitelist group for Data Management Service (DMS).

• An ApsaraDB for ClickHouse cluster supports a maximum of 200 IP addresses in total across all whitelist groups, with a limit of 50 IP addresses per group.

Cluster impact

Configuring a whitelist does not affect the normal operation of your ApsaraDB for ClickHouse cluster.

Prerequisites

• You have an ApsaraDB for ClickHouse cluster that is in the Running state. For more information, see Create a cluster.

• You have the correct IP address to add to the whitelist.

  • The IP address cannot be empty.

  • IPv6 addresses are not supported in whitelists.

  Note

  Because IP addresses on corporate networks often change, your local IP address may not be your network's public IP address. We recommend finding your public IP address with a lookup service like https://www.ip.cn/ or by running the curl ifconfig.me command in your command-line interface.

Procedure

1. Log on to the ApsaraDB for ClickHouse console.

2. In the top-left corner of the page, select your cluster's region.

3. On the Clusters page, select the tab for your cluster's instance type, and then click the target cluster ID.

4. In the left-side navigation pane, click Data Security.

5. Click Create Whitelist Group.

6. Configure the following parameters.

   Parameter	Description	Example
   Group Name	The name of the whitelist group. The name must meet the following requirements: Consists of lowercase letters, digits, or underscores (_). Starts with a lowercase letter and ends with a lowercase letter or a digit. Is 2 to 32 characters in length.	test
   IP Addresses	The IP addresses in the whitelist. The IP addresses must meet the following requirements: An IP address. For example, 192.168.0.1 allows the IP address 192.168.0.1 to access ApsaraDB for ClickHouse. A CIDR block, such as 192.168.0.0/24, allows IP addresses from 192.168.0.1 to 192.168.0.255 to access ApsaraDB for ClickHouse. Note To add multiple IP addresses or CIDR blocks, separate them with a comma (,). A setting of 127.0.0.1 blocks all IP addresses from accessing the ApsaraDB for ClickHouse cluster. To ensure data security, do not set the whitelist to 0.0.0.0 or 0.0.0.0/0.	192.168.xx.xx

   Because this quick start tutorial provides an example of using DMS to create a database and table and using clickhouse-client to import data, you must add the IP addresses of the servers that host DMS and clickhouse-client to the whitelist of the ApsaraDB for ClickHouse cluster.

   Note

   When you create a new ApsaraDB for ClickHouse cluster, the system automatically adds a whitelist group named dms to the ApsaraDB for ClickHouse cluster and adds the IP addresses of DMS servers to this group. If the IP addresses are not automatically added, you must add them manually. For a list of DMS IP addresses for different regions, see List of DMS CIDR blocks.

7. Click OK.

Next steps

Connect to a cluster