Showing results for 
Search instead for 
Did you mean: 
Sign up Log in

Earn badges and make progress

You're on your way to the next level! Join the Kudos program to earn points and save your progress.

Deleted user Avatar
Deleted user

Level 1: Seed

25 / 150 points

Next: Root


1 badge earned


Participate in fun challenges

Challenges come and go, but your rewards stay with you. Do more to earn more!


Gift kudos to your peers

What goes around comes around! Share the love by gifting kudos to your peers.


Rise up in the ranks

Keep earning points to reach the top of the leaderboard. It resets every quarter so you always have a chance!


Come for the products,
stay for the community

The Atlassian Community can help you and your team get more value out of Atlassian products and practices.

Atlassian Community about banner
Community Members
Community Events
Community Groups

Jira Cloud Outgoing Connections to On-Premis Application


We recently made the decision to migrate from Jira server to Jira Cloud. While using Jira Server, we integrated with an application that was closed to the outside. This app works on-premis and can only be accessed internally. Naturally, when we were going to switch to Jira Cloud, it was necessary to allow the ip ranges that Jira came to our application through the Firewall.

We found this document while researching these ip ranges. We allowed all the ip addresses in the document, but the REST operations we made to our application via Jira Cloud failed.

However, we wanted to try it in a different way. We opened our application completely to the outside and we wanted to see Jira, with which ip address it came to our on-premis application. As a result of our 4 different rest operations, we determined that Jira came to our local application from the following ip addresses.

  • x2

However, these ip addresses are not defined in the ip ranges document. In addition, it is not defined in AWS's ip ranges. That's why even allowing a large number of thread spacings in the relevant document does not solve it.

We opened a ticket to Atlassian regarding the case, but they could not provide a solution. Have you experienced similar situation? Has anyone tried accessing the application in the internal network via Jira Cloud and succeeded? If yes, can you help us on how to do it?



1 comment

Craig Castle-Mead
Rising Star
Rising Star
Rising Stars are recognized for providing high-quality answers to other users. Rising Stars receive a certificate of achievement and are on the path to becoming Community Leaders.
Apr 13, 2023

Hi @Ali Türkkan 

Using an IP allow list approach for a SaaS platform can be super problematic as the ranges can change at any time, so you’d want to have some automation on your firewall/app config to review the subnet lists and adjust when there’s any changes - this assumes that those lists are actually maintained correctly, and in a timely manner as well.

Depending on the way the integration is configured, you may be able to implement some form of request proxying, where the proxy is placed on the internet in a trusted location, allowing traffic from anywhere (or the subnet lists from Atlassian and/or AWS, automating the allow list syncing might be easier compared to a corporate firewall). This proxy could then authenticate the incoming requests from your Jira cloud environment (an auth token, user/pass, referrer checks - not reliable by themself as they can be spoofed, but could be a good extra layer), and then once the system verifies that it’s a legitimate request from your environment, pass the request to your internal application - which would then come from a known IP that you manage (obviously requires that the proxy application is configured with a static outbound IP/range).

this may not be viable given your company/application/etc, but worth considering IMO


Like Ali Türkkan likes this

Hi @Craig Castle-Mead

Thank you very much for the information you have provided.

As you mentioned, it will be necessary to automate the definition of permissions over the ip. However, we have doubts about whether the ip ranges are up to date.

 We have decided to use a tunnel server in this case. This structure will work like the Proxy method you mentioned. We will install Apache on the tunnel server. Jira cloud will make a request directly to the tunnel server. The tunnel server will check the incoming requests and send the valid ones to our application server.

In this way, we think that it will be sufficient to allow only the tunnel server to the Firewall rules on our application server.

Like # people like this


Log in or Sign up to comment