Jira Cloud Outgoing Connections to On-Premis Application

[Ali Türkkan]

Hi,

We recently made the decision to migrate from Jira server to Jira Cloud. While using Jira Server, we integrated with an application that was closed to the outside. This app works on-premis and can only be accessed internally. Naturally, when we were going to switch to Jira Cloud, it was necessary to allow the ip ranges that Jira came to our application through the Firewall.

We found this document while researching these ip ranges. We allowed all the ip addresses in the document, but the REST operations we made to our application via Jira Cloud failed.

However, we wanted to try it in a different way. We opened our application completely to the outside and we wanted to see Jira, with which ip address it came to our on-premis application. As a result of our 4 different rest operations, we determined that Jira came to our local application from the following ip addresses.

• 18.193.7.22
• 3.69.45.100 x2
• 3.72.246.5

However, these ip addresses are not defined in the ip ranges document. In addition, it is not defined in AWS's ip ranges. That's why even allowing a large number of thread spacings in the relevant document does not solve it.

We opened a ticket to Atlassian regarding the case, but they could not provide a solution. Have you experienced similar situation? Has anyone tried accessing the application in the internal network via Jira Cloud and succeeded? If yes, can you help us on how to do it?

Regards,

[Craig Castle-Mead]

Hi @Ali Türkkan 

Using an IP allow list approach for a SaaS platform can be super problematic as the ranges can change at any time, so you’d want to have some automation on your firewall/app config to review the subnet lists and adjust when there’s any changes - this assumes that those lists are actually maintained correctly, and in a timely manner as well.

Depending on the way the integration is configured, you may be able to implement some form of request proxying, where the proxy is placed on the internet in a trusted location, allowing traffic from anywhere (or the subnet lists from Atlassian and/or AWS, automating the allow list syncing might be easier compared to a corporate firewall). This proxy could then authenticate the incoming requests from your Jira cloud environment (an auth token, user/pass, referrer checks - not reliable by themself as they can be spoofed, but could be a good extra layer), and then once the system verifies that it’s a legitimate request from your environment, pass the request to your internal application - which would then come from a known IP that you manage (obviously requires that the proxy application is configured with a static outbound IP/range).

this may not be viable given your company/application/etc, but worth considering IMO

CCM 

[Ali Türkkan]

Hi @Craig Castle-Mead

Thank you very much for the information you have provided.

As you mentioned, it will be necessary to automate the definition of permissions over the ip. However, we have doubts about whether the ip ranges are up to date.

 We have decided to use a tunnel server in this case. This structure will work like the Proxy method you mentioned. We will install Apache on the tunnel server. Jira cloud will make a request directly to the tunnel server. The tunnel server will check the incoming requests and send the valid ones to our application server.

In this way, we think that it will be sufficient to allow only the tunnel server to the Firewall rules on our application server.