Can't connect to GitHub - 'Can't connect, blocked by your IP allow list.'

[Mathias Jacob]

I can't connect from Jira to GitHub. I already installed the Atlassian Github app in my Organization and the IP addresses are listed in Github's allow list.

Nonetheless, I only get 'Can't connect, blocked by your IP allow list.' - how can I check what actual IP address Jira is using?

[Mathias Jacob · Accepted solution]

It turned out that on an Enterprise organisation, the IP allowlist for the API access have to be applied on the enterprise level already. It's no sufficient to only add the Atlassian IPs to the organisation's allow list only.

[Arkadiusz Wroblewski]

@Mathias Jacob 

Glad you figured that out.

[Arkadiusz Wroblewski]

Hello and Welcome @Mathias Jacob 

I would look at the GitHub allowlist setup itself, not at a single Jira IP.

@Gor Greyan  is right that Jira Cloud does not use one fixed outbound IP, but Atlassian also documents a current GitHub allowlist issue where some requests can still be blocked even if the correct IPs are already listed. Their workaround is to either:

• enable “IP allow list configuration for installed GitHub apps” in the GitHub org, or
• add the Atlassian IPs manually as individual entries, not as CIDR ranges.

Set up a GitHub IP allow list | Atlassian Support

[Mathias Jacob]

I already have enabled “IP allow list configuration for installed GitHub apps” and I can see the entries in the allow list as 'Managed by the Atlassian GitHub App'. I also added some entries that are contained in the support documentation, that have not been set by the app...

Still no luck. 

As my GitHub-Organization is part of a larger Enterprise-Organization, does the larger one also need to have the allow list?

[Gor Greyan]

Hi @Mathias Jacob

Welcome to the Atlassian Community!

Jira Cloud doesn’t use a single fixed IP address for outbound connections; it uses a range of IPs depending on the region and service. That’s why even if you’ve whitelisted one IP in GitHub, the connection can still be blocked.

To resolve this, you need to allow Atlassian’s full set of IP ranges used for outbound connections. Find it there.
https://ip-ranges.atlassian.com/

Once the full range is whitelisted, the connection should work.