nav[aria-label="Primary Navigation"] { padding: 0; & ul { list-style: none; width: 100%; display: flex; flex-direction: row; justify-content: start; align-items: start; gap: 30px; padding: 0; & li { margin: 0; } & ul li { list-style: none; } } }

Undocumented pipeline runner IPs

Rob_h4hy6e

Hi,

We use the list of IP addresses that bitbucket publishes of "Valid IP addresses for Bitbucket Pipelines build environments" in our firewall. A few days ago we started to see pipelines fail because they were being denied connections.

After some investigation, we found that some runners seem to get IP addresses that are not in the list.

For example, yesterday we saw a runner get the IP 10.39.157.242/32, which is not in the list.

Anyone else seeing this? Anyone at Atlassian care to update the list of IP addresses?

Accepted answers

All comments

Rob_h4hy6e

Ok, I've realised that the IP 10.39.157.242 is in the 10.0.0.0/24 network, which is obviously a local network address space. So clearly there's some kind of routing or NAT going on internally within bitbucket for outgoing connections.

Now investigating whether the connection is trying to go out on IPv6 instead of IPv4. The page I linked to above doesn't list any outgoing IPv6 address spaces though, which is a shame...

Rob_h4hy6e

Ok -- yes, by confining our outgoing connection to IPv4, it all worked fine. So this question is now what are the outgoing IPv6 addresses for bitbucket pipeline runners?

Theodora Boudale

Hi Rob,

Please see the documentation below for runners:

https://support.atlassian.com/bitbucket-cloud/docs/pipelines-runners-frequently-asked-questions/

What IP address do I need to whitelist to get Runner to work?

Refer to the list of the IP addresses that you need to whitelist to get your runner connected with Pipeline behind your firewall.

It's also advisable to whitelist the following IPs here if there's an issue with your runner build.

Kind regards,
Theodora

Rob_h4hy6e

Hi Theodora,

Thanks for you answer, but unfortunately this doesn't quite address my question. My question is about the IP addresses that the bitbucket-provided runners use. In my question I've linked to the list that bitbucket publishes, but the problem is that this list only cover the IPv4 addresses, and does not include the IPv6 addresses. Where can I find the IPv6 address list?

Thanks,

Rob

Theodora Boudale

Hi Rob,

The list of "Valid IP addresses for Bitbucket Pipelines build environments" is for Pipelines builds that run in our own infrastructure, in case you need to make requests from these Pipelines builds to one of your servers that is behind a firewall.

For runners, you need to whitelist the IPs mentioned on this page https://ip-ranges.atlassian.com/, which also includes IPv6 addresses.

Kind regards,
Theodora

Rob_h4hy6e

Hi Theodora,

Yes, I'm talking about pipelines that run in your infrastructure. Not pipelines that run in mine.

The "Valid IP addresses for Bitbucket Pipelines build environments" page lists IPv4 addresses, but not IPv6 addresses. However those environments have IPv6 connectivity, so we need to know what those IPv6 address ranges are so we can allow them to connect to the services they need.

Thanks,

Rob

Welcome!

It looks like you're new here. Sign in or register to get started.

Quick Links

Find more posts tagged with

cloud

bitbucket

bitbucket-cloud