Errors and FAQ about IP address whitelist settings in ApsaraDB RDS for PostgreSQL

No IP address whitelists are configured (most common)

The default whitelist contains only 127.0.0.1, which blocks all external connections. Add the IP addresses of the clients or servers that need access to an IP address whitelist.

0.0.0.0 entry added during a connectivity test

0.0.0.0 is an invalid format. Change it to the CIDR block 0.0.0.0/0.

Public IP addresses in the whitelist are inaccessible

Two common causes:

• The client's public IP address changes dynamically.

• The tool or website used to look up the public IP returns an inaccurate result.

For steps to find the correct IP address, see How to view the local IP address of an RDS PostgreSQL instance.

IP addresses added to an enhanced whitelist are inaccessible

In enhanced whitelist mode, ApsaraDB RDS distinguishes between the classic network and virtual private networks (VPCs). An IP address added to a VPC-type whitelist can only connect over VPC.

Add the IP address to a whitelist whose network type matches the network type of the connecting device.

Can I configure both IP address whitelists and security groups?

Yes. Both apply simultaneously — all IP addresses in the configured whitelists and all Elastic Compute Service (ECS) instances in the configured security groups are granted access to the RDS instance.

How long does it take for a whitelist to take effect?

About 1 minute after you save the configuration.

What are the ali_dms_group and hdm_security_ips whitelists?

When you connect to your RDS instance from Data Management (DMS) or Database Autonomy Service (DAS), the system automatically creates whitelists for these services upon your authorization. ali_dms_group is created for DMS; hdm_security_ips is created for DAS.

Do not modify or delete these whitelists. If you do, DMS or DAS will lose access to your RDS instance. Neither service performs operations on your business data.

How do I handle a dynamic IP address that changes frequently?

Use identity authentication instead of IP address whitelists for access control. If that is not an option, the following approaches can help:

• Dynamic DNS service: Use a dynamic DNS service to get a domain name that maps to the changing IP address, then add the domain name or its resolved IP address to the whitelist.

• Reverse proxy or load balancer: Route all application traffic through a reverse proxy or load balancer with a fixed IP address, then add only that fixed IP address to the whitelist.

• CIDR block: If the IP address changes within a known range — for example, broadband addresses assigned by an Internet service provider (ISP) — add the CIDR block that covers the range. For example, 192.168.0.0/16 allows all addresses in the 192.168.x.x range.