Integrating Jira Cloud with self-hosted Gitlab - IP ranges to allow

[Gerald Preissler]

I'm trying to configure the GitLab for Jira Cloud app to integrate our Jira instance with our self-hosted Gitlab.

I'm following the instructions here and think I've set up everything correctly, but when I try to get started with the app  and click on "Sign in to <our Gitlab instance>" I get the message "Failed to load Jira Connect Application ID. Please try again."

With

curl --include "https://git.<domain>/-/jira_connect/oauth_application_id"

I get the correct application_id, both from inside our CN and from my personal network at home.

I've since learned that access to /api/v4/* is blocked in our Firewall for security reasons, so I suspect that is the culprit. I might be able to convince people to open  this for a reasonable set of source IPs, hence my question:

Which IP ranges do I need to allow for the connection to work?

[Rilwan Ahmed]

Hi @Gerald Preissler ,

Atlassian apps and sites don't have fixed individual IP addresses. Instead, they use defined ranges of IP addresses. You should allowlist these IP ranges to maintain access to Atlassian cloud apps and sites.

More details in https://support.atlassian.com/organization-administration/docs/ip-addresses-and-domains-for-atlassian-cloud-products/

[Gerald Preissler]

Hi @Rilwan Ahmed ,

thanks for the fast reply. On the info page you linked I found the list for outgoing connections. Is my understanding correct that those would be sufficient for our usecase?

[Arkadiusz Wroblewski]

Hi @Gerald Preissler 

For Jira Cloud, there are no fixed IPs you can allowlist. Atlassian Cloud uses published IP ranges that can change, so the supported approach is to allowlist Atlassian’s official ranges (via their JSON feed):

https://support.atlassian.com/organization-administration/docs/ip-addresses-and-domains-for-atlassian-cloud-products/

And yes: if your firewall blocks GitLab’s /api/v4/*, that is very likely the blocker for the GitLab for Jira Cloud app. The setup/sign-in flow needs to call GitLab’s API in addition to /-/jira_connect/oauth_application_id.

Best practice is:

allowlist Atlassian Cloud IP ranges, and

restrict by URL/path to only what’s required (e.g. /-/jira_connect/* and the needed /api/v4 endpoints) over HTTPS (443).