HDInsight management IP addresses
This article lists the IP addresses used by Azure HDInsight health and management services. If you use network security groups (NSGs) or user-defined routes (UDRs), you may need to add some of these IP addresses to the allowlist for inbound network traffic.
Introduction
Important
In most cases, you can now use service tags for network security groups, instead of manually adding IP addresses. IP addresses will not be published for new Azure regions, and they will only have published service tags. The static IP addresses for management IP addresses will eventually be deprecated.
If you use network security groups (NSGs) or user-defined routes (UDRs) to control inbound traffic to your HDInsight cluster, you must ensure that your cluster can communicate with critical Azure health and management services. Some of the IP addresses for these services are region-specific, and some of them apply to all Azure regions. You may also need to allow traffic from the Azure DNS service if you aren't using custom DNS.
If you need IP addresses for a region not listed here, you can use the Service Tag Discovery API to find IP addresses for your region. If you're unable to use the API, download the service tag JSON file and search for your desired region.
HDInsight does validation for these rules with cluster creation and scaling to prevent further errors. If validation doesn't pass, creation and scaling fail.
The following sections discuss the specific IP addresses that must be allowed.
Azure DNS service
If you're using the Azure-provided DNS service, allow access to 168.63.129.16 on port 53 for both TCP and UDP. For more information, see the Name resolution for VMs and Role instances document. If you're using custom DNS, skip this step.
Health and management services: All regions
Allow traffic from the following IP addresses for Azure HDInsight health and management services, which apply to all Azure regions:
| Source IP address | Destination | Direction |
|---|---|---|
| 168.61.49.99 | *:443 | Inbound |
| 23.99.5.239 | *:443 | Inbound |
| 168.61.48.131 | *:443 | Inbound |
| 138.91.141.162 | *:443 | Inbound |
Health and management services: Specific regions
Allow traffic from the IP addresses listed for the Azure HDInsight health and management services in the specific Azure region where your resources are located, refer the following note:
Important
We recommend to use service tag feature for network security groups. If you require region specific service tags, please refer the Azure IP Ranges and Service Tags - China Cloud
For more information, see Control network traffic.
If you're using user-defined routes (UDRs), you should specify a route and allow outbound traffic from the virtual network to the above IPs with the next hop set to "Internet".