tencent cloud

Data Transfer Service

Release Notes and Announcements
Release Notes
Announcements
Product Introduction
Overview
Data Migration
Data Sync
Data Subscription (Kafka Edition)
Strengths
Supported Regions
Specification Description
Purchase Guide
Billing Overview
Configuration Change Description
Payment Overdue
Refund
Getting Started
Data Migration Guide
Data Sync Guide
Data Subscription Guide (Kafka Edition)
Preparations
Business Evaluation
Network Preparation
Adding DTS IP Addresses to the Allowlist of the Corresponding Databases
DTS Service Permission Preparation
Database and Permission Preparation
Configuring Binlog in Self-Built MySQL
Data Migration
Databases Supported by Data Migration
Cross-Account TencentDB Instance Migration
Migration to MySQL Series
Migrating to PostgreSQL
Migrating to MongoDB
Migrating to SQL Server
Migrating to Tencent Cloud Distributed Cache
Task Management
Data Sync
Databases Supported by Data Sync
Cross-Account TencentDB Instance Sync
Sync to MySQL series
Synchronize to PostgreSQL
Synchronization to MongoDB
Synchronize to Kafka
Task Management
Data Subscription (Kafka Edition)
Databases Supported by Data Subscription
MySQL series Data Subscription
Data Subscription for TDSQL PostgreSQL
MongoDB Data Subscription
Task Management
Consumption Management
Fix for Verification Failure
Check Item Overview
Cutover Description
Monitoring and Alarms
Supported Monitoring Indicators
Supported Events
Configuring Metric Alarms and Event Alarms via the Console
Configuring Indicator Monitoring and Event Alarm by APIs
Ops Management
Configuring Maintenance Time
Task Status Change Description
Practical Tutorial
Synchronizing Local Database to the Cloud
Creating Two-Way Sync Data Structure
Creating Many-to-One Sync Data Structure
Creating Multi-Site Active-Active IDC Architecture
Selecting Data Sync Conflict Resolution Policy
Using CLB as Proxy for Cross-Account Database Migration
Migrating Self-Built Databases to Tencent Cloud Databases via CCN
Best Practices for DTS Performance Tuning
FAQs
Data Migration
Data Sync
FAQs for Data Subscription Kafka Edition
Regular Expressions for Subscription
Error Handling
Common Errors
Failed Connectivity Test
Failed or Alarmed Check Item
Inability to Select Subnet During CCN Access
Slow or Stuck Migration
Data Sync Delay
High Data Subscription Delay
Data Consumption Exception
API Documentation
History
Introduction
API Category
Making API Requests
(NewDTS) Data Migration APIs
Data Sync APIs
Data Consistency Check APIs
(NewDTS) Data Subscription APIs
Data Types
Error Codes
DTS API 2018-03-30
Service Agreement
Service Level Agreements
DokumentasiData Transfer ServicePreparationsAdding DTS IP Addresses to the Allowlist of the Corresponding DatabasesGranting IP Range of DTS Access IP for Batch Tasks

Granting IP Range of DTS Access IP for Batch Tasks

PDF
Mode fokus
Ukuran font
Terakhir diperbarui: 2026-04-01 09:45:07

Overview

When performing batch DTS tasks, if you opt to method for granting access to individual DTS access addresses (first conducting a connectivity test to obtain the DTS access IP address, then adding it to the allowlist of the source and destination databases one by one), the efficiency is lower. This section provides you with a more efficient method, adding the DTS access IP range at once.
Note:
The range of accessible IP ranges provided in this section is relatively large. In addition to the DTS access IPs, other IPs within the range can also access the source/target database, and there might be a risk of data exposure, so choose carefully.

Comparison of Access Methods

The differences between granting a batch of task IPs at once and granting individual task IP are as follows. Consider method 2 carefully.
Method
Description
Method 1 (Recommended): Granting access to individual DTS access IPs
First, perform a connectivity test, and upon failure, grant access to the specific IP as indicated by the pop-up notification.
Advantages: High Security, ensuring that only DTS access IPs can access the source/target database, and other IPs cannot access.
Disadvantages: Requires separate connectivity testing for each task, followed by adding the respective IPs one by one. The process can be cumbersome when there are many tasks.
Method 2: Granting access to the range where the DTS access IPs belong
Grant access to the range of the DTS Task.
Advantages: You can add the IP addresses at once and create multiple DTS tasks, which is convenient.
Disadvantages: The granting IP range is relatively wide. Besides the DTS access IPs, other IPs in the range can also access the source/target database, and there may be a risk of data exposure, so choose carefully.

Notes

When using DTS for multiple synchronization tasks on the same database, in the DTS task configuration, select the same parameters for Access Type, VPC, and subnet. Failure to do so may cause issues with network connection, preventing DTS from connecting to the database.

Operation Overview

Different connection methods require different network security investigation rules as follows.
Connection Method
Network Access Troubleshooting
Processing Description
Public Network
Check the network layer of the database to see if network ACL and security group rules have been set.
Check the server layer of the database deployment to see if a firewall (such as iptables) has been set.
Check the database layer to see if IP access restriction rules (e.g., only host addresses within authorization can access the database) have been set.
If security rules have been set, grant access to the IP of the DTS service region in the corresponding rules.
VPN Access/Direct Connect/CCN
Check the network layer of the database to see if network ACL and security group rules have been set.
Check the server layer of the database deployment to see if a firewall (such as iptables) has been set.
Check the database layer to see if IP access restriction rules (e.g., only host addresses within authorization can access the database) have been set.
If security rules have been set, grant access to a subnet under the VPC in the corresponding rules.
Self-Build on CVM
VPC (Self-built on CVM)
Check the server layer of database deployment to see if a firewall (such as iptables) has been set.
Check database layer to see if IP access restriction rules (e.g., only authorized host addresses can access the database) have been set.
If security rules have been set, then grant access to 169.254.1.1/16, 11.163.1.1/16
Database
VPC (Database)
Check if IP access restriction rules (e.g., restrict database access to host addresses within the authorization) have been set in the database layer.
If security rules have been set, then grant access to 169.254.1.1/16, 11.163.1.1/16

Directions

Public Network Access

When using public network access, users need to select the DTS region closest to the physical database when purchasing a DTS task, and then use DTS for the transfer task.
1. Obtain the ranges that need to be granted.
Locate the DTS IP address in the corresponding region according to your connection region.
For example, if your source database region is in region M, then choose the nearest DTS region X for access. You need to grant the X region DTS service IP in the network that the source database belongs to. If the target database region is in region Y, choose the region N for access, and grant the Y region DTS IP address in the network that the target database belongs to.
DTS Region
DTS IP Address
Guangzhou
111.230.198.143,118.89.34.161,123.207.84.254,139.199.74.159,119.29.130.214,119.29.77.83,119.29.73.249,106.55.253.232,119.29.77.192,106.55.14.30,106.55.14.118,106.55.17.239,81.71.6.166,106.52.142.171,106.52.180.113,106.55.18.96,106.52.148.50,106.55.18.65,106.52.201.205,106.53.125.4,106.52.178.138,81.71.1.123,106.52.183.45,106.52.138.148,118.89.30.186,106.55.173.124,106.52.32.74,119.29.72.101,119.29.74.24,118.89.64.186,119.29.73.4,119.29.105.136,119.29.73.107,42.194.145.137,81.71.6.252,106.55.14.49,106.52.172.126,106.52.165.159,42.194.134.116,119.29.74.236,42.194.168.157,119.29.130.139,106.52.187.29,43.139.65.64,43.144.107.149
Shanghai
111.231.139.59,111.231.142.94,115.159.71.186,182.254.153.245,121.4.194.114,121.4.194.236,106.54.194.151,121.4.131.42,49.234.211.247,49.235.254.209,175.24.122.244,49.235.245.212,175.24.117.241,49.235.248.123,49.235.255.182,49.234.127.99,49.235.242.160,175.24.121.160,175.24.121.211,175.24.120.20,49.235.243.233,49.235.75.163,101.34.52.28
Beijing
123.207.145.84,211.159.157.165,211.159.160.104,58.87.92.66,81.70.238.131,81.70.238.51,81.70.238.49,152.136.120.192,43.137.74.246,120.53.200.151
Chengdu
111.231.225.99,118.24.42.158,42.193.34.109,42.193.35.9,139.155.59.45,139.155.17.130,1.14.127.237,139.155.143.176
Chongqing
139.186.122.1/24,129.28.12.1/24,129.28.14.1/24,139.186.77.242,139.186.109.1/24,
139.186.131.1/23,94.191.102.144,94.191.98.210,129.28.12.90,139.186.122.43,129.28.12.220,129.28.12.29,139.186.109.115,139.186.77.242,129.28.14.220,129.28.12.78,139.186.130.130,139.186.122.185,139.186.242.227,139.186.242.102
Hangzhou
111.231.139.59,111.231.142.94,115.159.71.186,182.254.153.245,115.236.135.80,115.236.136.159
Nanjing
129.211.166.117,129.211.167.130,146.56.231.200,119.45.30.208,146.56.222.186,119.45.179.117,129.211.172.31,119.45.160.30,146.56.222.94,175.27.128.203,146.56.231.253,129.211.163.176,119.45.46.47,119.45.47.127,119.45.41.238,119.45.46.39,119.45.44.121,119.45.33.146,119.45.43.135,119.45.46.216,119.45.147.147,129.211.163.211,1.13.140.155,43.137.22.81
Tianjin
154.8.246.150,154.8.246.48,154.8.246.202,154.8.248.247,154.8.246.209,42.187.141.208,42.187.176.89
Shenzhen
118.126.124.6,118.126.124.83,118.126.124.71,118.126.124.197,118.126.124.200,118.126.124.73,114.117.120.227,114.117.120.216
Hong Kong
119.29.180.130,119.29.208.220,124.156.168.151,150.109.72.54,119.28.87.241,119.28.57.131,101.32.186.217,43.132.113.37,43.129.111.137
Beijing Finance
62.234.240.36,62.234.241.241,62.234.241.187,62.234.240.12,62.234.241.207,62.234.243.37,43.144.161.120
Shenzhen Finance
118.89.251.206,139.199.90.75,118.25.206.120,118.25.206.148
Shanghai Finance
115.159.237.246,211.159.242.74,212.129.183.254,115.159.235.181
Singapore
119.28.103.40,119.28.104.184,119.28.116.123,150.109.11.113,101.32.115.120,101.32.114.215,129.226.154.212,150.109.20.146,129.226.192.113,150.109.23.34,101.32.241.168,101.32.241.169,101.32.241.167,101.32.241.166,43.134.9.212,43.128.70.119
Jakarta
43.129.33.41,43.129.35.144,43.129.35.144,43.129.33.41,43.133.150.69,43.157.247.23
Bangkok
150.109.164.203,150.109.164.82,150.109.173.177,43.133.118.144
Seoul
119.28.150.71,119.28.157.173,119.28.156.56,150.109.84.34,150.109.244.159,150.109.233.228,43.128.147.206,43.155.246.64
Tokyo
150.109.195.201,150.109.196.137,150.109.203.200,124.156.226.45,150.109.198.106,43.167.238.29,43.167.247.133
Silicon Valley
49.51.38.216,49.51.39.189,170.106.177.233,170.106.81.114,170.106.81.79,170.106.98.28,170.106.98.49,170.106.101.94,170.106.98.140,49.51.250.101,170.106.64.252,49.51.245.168,43.135.191.122,43.135.191.62
Virginia
170.106.2.63,49.51.85.120,43.130.102.125,43.130.101.155,43.130.104.126,170.106.50.161,170.106.37.17,170.106.160.113,170.106.160.10,170.106.11.143,43.130.103.10,43.130.101.186,43.130.101.147,43.130.104.207,43.130.96.11,43.130.96.13,43.166.138.159
Frankfurt
49.51.132.38,49.51.133.85,162.62.57.94,162.62.55.228,162.62.57.30,49.51.170.91,162.62.55.94,162.62.58.93,162.62.53.29,162.62.58.243,43.157.58.59,162.62.62.209
Sao Paulo
43.135.195.207,43.157.161.20,43.157.161.26
Riyadh
43.164.75.225,43.164.75.58
2. Troubleshoot database-related security settings. If there are settings like the ones described, you need to grant the DTS IP address in the corresponding rules.
2.1 Check if network ACLs and security groups have been set in the network layer where the database belongs.
If yes, add the DTS IP address to the ACL and security group rules of the database's network.
2.2 Check if a firewall (such as iptables) has been set on the server where the self-built database is deployed.
If yes, grant the DTS IP address in the firewall rules.
2.3 Check if there are IP access restrictions (such as restricting access to the database to only host addresses within the authorization) set in the database layer.
If yes, grant the DTS IP address in the access restrictions.

VPN Access/Direct Connect

When using VPN for connection, users need to purchase a Tencent Cloud VPC and VPN gateway to connect their local IDC database to Tencent Cloud VPC via nearby access, then transfer tasks through DTS.
1. Obtain the ranges that need to be granted.
When configuring a DTS task, you will choose to access a subnet under the VPC, which indicates the IP address range that needs to be opened. The range of DTS access IP that needs to be granted for the source database is subnet1, and the range of DTS access IP that needs to be granted for the target database is subnet2.
2. Investigate the database-related security setting rules. If there are such settings as follows, the DTS access IP range needs to be granted in the corresponding rules.
2.1 Check if network ACLs and security groups have been set in database network layer.
If yes, add the DTS access IP range to the ACL and security group rules of the database's network.
2.2 Check if a firewall (such as iptables) has been set on the server where the self-built database is deployed.
If yes, grant the DTS access IP range in the firewall rules.
2.3 Check if there are IP access restrictions (such as restricting access to the database to only host addresses within the authorization) set in the database layer.
If yes, grant the DTS access IP range in the access restrictions.

CCN

When using CCN for connection, users need to connect their local IDC database to the Tencent Cloud VPC (such as VPC1) via nearby access, and then use CCN to connect VPC1 and access VPC2.
1. Obtain the ranges that need to be granted.
When configuring a DTS task, you will choose CCN-Associated VPC (i.e., VPC2) under a subnet, which is the IP range that needs to be granted. The source database needs to grant access to the subnet subnet2.
2. Investigate the database-related security setting rules. If there are such settings as follows, the DTS access IP range needs to be granted in the corresponding rules.
2.1 Check if network ACLs and security groups have been set in the database network layer.
If yes, add the DTS access IP range to the ACL and security group rules of the database's network.
2.2 Check if a firewall (such as iptables) has been set on the server where the self-built database is deployed.
If yes, grant the DTS access IP range in the firewall rules.
2.3 Check if there are IP access restrictions (such as restricting access to the database to only host addresses within the authorization) set in the database layer.
If yes, grant the DTS access IP range in the access restrictions.

Self-Build on CVM

If the source/target database is a self-built database on Tencent Cloud CVM, select Self-Build on CVM as access method. When a user initiates a DTS task, network ACLs and security groups can be automatically granted, and the user only needs to check other security rules and grant them.
1. Obtain the ranges that need to be granted.
The connection between the Self-Build on CVM and DTS occurs within the Tencent Cloud private network, sharing common IP ranges of 169.254.1.1/16, 11.163.1.1/16.
2. Investigate the database's security rules. If there are settings as follows, grant the DTS access IP range in the corresponding rules.
2.1 Check if a firewall (such as iptables) is set on the server where the self-built database deployment is.
If yes, grant the DTS access IP range in the firewall rules.

Database

The source/target database is a Tencent Cloud database instance, with the connection method selected as "cloud database". When a user initiates a DTS task, network ACLs and security groups can be automatically granted, and the user only needs to check other security rules and grant them.
1. Obtain the ranges that need to be granted.
The connectivity between cloud database and DTS occurs within the Tencent Cloud private network, sharing common IP ranges of 169.254.1.1/16, 11.163.1.1/16.
2. Investigate the database's security rules. If there are settings as follows, grant the DTS access IP range in the corresponding rules.
2.1 Check the database layer to see if IP access restriction rules have been set.
For some TencentDB instances (like MySQL), there's support for limiting access IPs for accounts. Once set up, accounts can only access the database through host addresses within the authorization. For details on this MySQL feature, see Modifying Authorized Access Host Address.
If there are similar settings, you need to grant the DTS access IP range.

VPC

For VPC access, depending on the database's deployment mode as either a self-built database on CVM (see above "Self-Build on CVM") or cloud database (see above "Database"), just follow the corresponding scenario operations.
Topik sebelumnya: Granting DTS Access IP for a Single TaskTopik selanjutnya: Create sub users and authorize the use of DTS

Bantuan dan Dukungan

Apakah halaman ini membantu?

masukan