Account and access

Internet access and allowed addresses

Your servers and apps can't reach the internet by default; how to request access and what gets opened. Opening your site and server only to specific addresses.

Open as plain text

This page covers two directions: your app or server going out to the internet, and who can reach your site or server.

#Why outbound access is closed

Servers and environments can't connect to the internet by default. If your app downloads packages or connects to an outside service (payments, e-mail, maps…), the connection doesn't open; the log shows a timeout or a "name could not be resolved" error. If you need such a connection, request access.

A server with closed access can't resolve domain names either.
An environment with closed access may also be unable to resolve outside domain names, depending on the platform's settings. The names of your app's own services and your database always resolve.

#Requesting access

Where to open the request:

Server: «İnternet erişimi iste» (Request internet access) on the server's row in the server list.
Environment: «İnternet erişimi iste» (Request internet access) in the Diğer işlemler (More actions) menu in the environment's header, or on the Dışarıya internet (Outbound internet) card in the Alan adı ve erişim (Domain and access) section of the Ayarlar (Settings) tab.

In the İnternet erişimi talep et (Request internet access) dialog that opens, write why you need it in the «Gerekçe» (Reason) field and press the «Talebi gönder» (Send request) button. A platform admin approves or rejects the request.

To open a request you need the «Kiracı yöneticisi» (Tenant admin) or «Geliştirici» (Developer) role; for a server, you also need write permission on that server; for an environment, on the project. A new request can't be opened while one is already pending for the same server or environment.

#What gets opened on approval

Environment: web connections (ports 80 and 443) and sending e-mail (ports 587 and 465) are opened. Port number 25 is closed; use 587 in your e-mail settings (465 if your mail server requires an encrypted connection from the start). An app that opens a large number of e-mail connections in a short time has its sending paused for a while. If your administrator has set up an organization mail server in your installation, environments can send through it too; ask your administrator for its address and port number. Other ports and private network addresses stay closed. To connect to an outside database, see the Connecting an existing database section.
Server: the server's outbound internet access is opened.

Only a platform admin can close access once it has been opened.

#Request status

The server list shows each server's internet status: open, request pending or closed. The environment's Dışarıya internet (Outbound internet) card says the same.
All your requests are in the İnternet talepleri (Internet requests) list on the Sunucular (Servers) page: «Beklemede» (Pending), «Onaylandı» (Approved) or «Reddedildi» (Rejected), with the administrator's decision note.
The decision arrives with the İnternet erişimi talebiniz sonuçlandı (Your internet access request was decided) notification.
A request can't be withdrawn once it has been opened.

#Opening your site and server only to specific addresses

Sites are open to everyone by default. To open a site, or a server's external SSH and web connections, only to the addresses of specific organisations, you use İzinli adresler (Allowed addresses) lists. Lists are managed by the «Kiracı yöneticisi» (Tenant admin); other roles can only view them.

Create a list
On the Erişim (Access) tab of the Ekip (Team) page, press the «Yeni adres listesi» (New address list) button. Enter a «Liste adı» (List name) and add addresses: a single IPv4 address or a block like 203.0.113.0/24. «Şu anki adresimi ekle» (Add my current address) adds the address of the place you're connecting from; if you're connecting from your organisation's network, this is usually your organisation's outbound address. If you're not sure, ask your IT department.
Apply the list to an environment
On the environment's Ayarlar (Settings) tab, in the Alan adı ve erişim (Domain and access) section, press the «Değiştir» (Change) button on the Kimler erişebilir? (Who can access?) card and open the environment only to the addresses in the lists you select. If no visitor should open the site (it only works through the API pool), choose Dışa kapalı (Closed to the outside) on the same card; no list is needed.
Or apply it to a server
In the server's details, the «Değiştir» (Change) button on the İzinli adresler (Allowed addresses) row sets external SSH and web connections together. To set the two separately, use «Ayrı ayarla» (Set separately).

A tenant can have at most 20 lists, and a list at most 100 addresses. At most 10 lists can be selected for a single site or server.
IPv6 addresses aren't supported.
A visitor coming from an address that isn't allowed can't open the site. Depending on the installation, they see either a plain “Forbidden” (no access) page or a “page not found” page, as if the address didn't exist; the Erişim (Access) tab of the Team page says which. The rule applies to new connections within a few seconds. A rule you save on a server also cuts open SSH sessions coming from addresses that aren't in the list.
When you change a list, the change applies right away everywhere the list is used. A list that's in use can't be deleted; remove it from the places using it first.
The Yeni ortam ve sunucular için (For new environments and servers) section on the tab sets the starting rule for environments and servers created from then on. It doesn't change existing ones.