Group Replication IP Address Permissions •IPv4 addresses (for example,  198.51.100.44 ) •IPv4 addresses with CIDR notation (for example,  192.0.2.21/24 ) •IPv6 addresses, from MySQL 8.0.14 (for example,  2001:db8:85a3:8d3:1319:8a2e:370:7348 ) •IPv6 addresses with CIDR notation, from MySQL 8.0.14 (for example,  2001:db8:85a3:8d3::/64 ) •Host names (for example,  example.org ) •Host names with CIDR notation (for example,  www.example.com/24 ) Before MySQL 8.0.14, host names could only resolve to IPv4 addresses. From MySQL 8.0.14, host names can resolve to IPv4 addresses, IPv6 addresses, or both. If a host name resolves to both an IPv4 and an IPv6 address, the IPv4 address is always used for Group Replication connections. You can use CIDR notation in combination with host names or IP addresses to permit a block of IP addresses with a particular network prefix, but do ensure that all the IP addresses in the specified subnet are under your control. When a connection attempt from an IP address is refused because the address is not in the allowlist, the refusal message always prints the IP address in IPv6 format. IPv4 addresses are preceded by  ::ffff:  in this format (an IPV4-mapped IPv6 address). You do not need to use this format to specify IPv4 addresses in the allowlist; use the standard IPv4 format for them. You must stop and restart Group Replication on a member in order to change its allowlist. A comma must separate each entry in the allowlist. For example: To join a replication group, a server needs to be permitted on the seed member to which it makes the request to join the group. Typically, this would be the bootstrap member for the replication group, but it can be any of the servers listed by the  group_replication_group_seeds  option in the configuration for the server joining the group. If any of the seed members for the group are listed in the  group_replication_group_seeds  option with an IPv6 address when a joining member has an IPv4  group_replication_local_address , or the reverse, you must also set up and permit an alternative address for the joining member for the protocol offered by the seed member (or a host name that resolves to an address for that protocol). This is because when a server joins a replication group, it must make the initial contact with the seed member using the protocol that the seed member advertises in the  group_replication_group_seeds  option, whether that is IPv4 or IPv6. If a joining member does not have a permitted address for the appropriate protocol, its connection attempt is refused. For more information on managing mixed IPv4 and IPv6 replication groups, see Section 18.5.5, “Support For IPv6 And For Mixed IPv6 And IPv4 Groups” . When a replication group is reconfigured (for example, when a new primary is elected or a member joins or leaves), the group members re-establish connections between themselves. If a group member is only permitted by servers that are no longer part of the replication group after the reconfiguration, it is unable to reconnect to the remaining servers in the replication group that do not permit it. To avoid this scenario entirely, specify the same allowlist for all servers that are members of the replication group. It is possible to configure different allowlists on different group members according to your security requirements, for example, in order to keep different subnets Note Note mysql> STOP GROUP_REPLICATION; mysql> mysql> START GROUP_REPLICATION; 3766