Source IP for Fetch Host Fingerprint

[Jacob Bushnell]

We are having issues getting our pipeline setup. It appears to be because our webservers firewall blocks port 22 by default.

When I opened the port to all inbound traffic it was able to successfully fetch the fingerprint. However we cannot leave our host exposed on port 22 to the world as that is too risky.

I added ALL the known Outgoing Connections IP ranges from this list here:
https://support.atlassian.com/organization-administration/docs/ip-addresses-and-domains-for-atlassian-cloud-products/

However even after doing that it still is not allowing BitBucket to Fetch the host fingerprint OR setup Pipelines. We get this error after setup.

ssh: connect to host 13.58.160.93 port 22: Connection timed out

Are there more IP addresses that are not on the list, or is there  a way to identify what IP BitBucket is using to establish the Pipelines?

Thank you,
Jacob

[Theodora Boudale]

Hi Jacob,

You can find the IPs used by Bitbucket Pipelines environments on this page, section Valid IP addresses for Bitbucket Pipelines build environments:

• https://support.atlassian.com/bitbucket-cloud/docs/what-are-the-bitbucket-cloud-ip-addresses-i-should-use-to-configure-my-corporate-firewall/#Valid-IP-addresses-for-Bitbucket-Pipelines-build-environments

You need to whitelist these IP ranges for a successful SSH connection from Pipelines.

Please feel free to reach out if you have any questions!

Kind regards,
Theodora

[Jacob Bushnell]

@Saxea _Flowie_ that is interesting...  How can I get terminal access to the BitBucket servers? I did not think such a thing was possible!

I will check into accessing the weblogs to see if I can identify the address in use.

[Saxea _Flowie_]

You can't access the terminal. My understanding is that you are trying to access this server via the pipelines? If that is the case you put the command in your pipeline script.

[Saxea _Flowie_]

Hi @Jacob Bushnell

You try 'curl icanhazip.com' to double check the ip, but additionally to that, I think it's more reliable to check the firewall logs.