Group Replication IP Address Permissions 18.6.1 Group Replication IP Address Permissions 3765 In the allowlist, you can specify any combination of the following: IP addresses specified as distributed recovery endpoints, and the IP address for the member’s standard SQL client connection if that is used for distributed recovery (which is the default), do not need to be added to the allowlist. The allowlist is only for the address specified by  group_replication_local_address for each member. A joining member must have its initial connection to the group permitted by the allowlist in order to retrieve the address or addresses for distributed recovery. The allowlist must contain the IP address or host name that is specified in each member’s group_replication_local_address  system variable. This address is not the same as the MySQL server SQL protocol host and port, and is not specified in the  bind_address  system variable for the server instance. If a host name used as the Group Replication local address for a server instance resolves to both an IPv4 and an IPv6 address, the IPv4 address is preferred for Group Replication connections. To specify an allowlist manually, use the  group_replication_ip_allowlist  (from MySQL 8.0.22) or group_replication_ip_whitelist  system variable. Before MySQL 8.0.24, you cannot change the allowlist on a server while it is an active member of a replication group. If the member is active, you must execute  STOP GROUP_REPLICATION  before changing the allowlist, and  START GROUP_REPLICATION afterwards. From MySQL 8.0.24, you can change the allowlist while Group Replication is running. The automatic allowlist of private addresses cannot be used for connections from servers outside the private network, so a server, even if it has interfaces on public IPs, does not by default allow Group Replication connections from external hosts. For Group Replication connections between server instances that are on different machines, you must provide public IP addresses and specify these as an explicit allowlist. If you specify any entries for the allowlist, the private and  localhost  addresses are not added automatically, so if you use any of these, you must specify them explicitly. An entry is added to the error log stating the addresses that have been allowed automatically for the host. If you do not specify an allowlist explicitly, the group communication engine (XCom) automatically scans active interfaces on the host, and identifies those with addresses on private subnetworks, together with the subnet mask that is configured for each interface. These addresses, and the  localhost  IP address for IPv4 and (from MySQL 8.0.14) IPv6 are used to create an automatic Group Replication allowlist. The automatic allowlist therefore includes any IP addresses that are found for the host in the following ranges after the appropriate subnet mask has been applied: The Group Replication plugin lets you specify an allowlist of hosts from which an incoming Group Communication System connection can be accepted. If you specify an allowlist on a server s1, then when server s2 is establishing a connection to s1 for the purpose of engaging group communication, s1 first checks the allowlist before accepting the connection from s2. If s2 is in the allowlist, then s1 accepts the connection, otherwise s1 rejects the connection attempt by s2. From MySQL 8.0.22, the system variable group_replication_ip_allowlist  is used to specify the allowlist, and for releases before MySQL 8.0.22, the system variable  group_replication_ip_whitelist  is used. The new system variable works in the same way as the old system variable, only the terminology has changed. IPv4 (as defined in RFC 1918) 10/8 prefix (10.0.0.0 - 10.255.255.255) - Class A 172.16/12 prefix (172.16.0.0 - 172.31.255.255) - Class B 192.168/16 prefix (192.168.0.0 - 192.168.255.255) - Class C IPv6 (as defined in RFC 4193 and RFC 5156) fc00:/7 prefix - unique-local addresses fe80::/10 prefix - link-local unicast addresses 127.0.0.1 - localhost for IPv4 ::1 - localhost for IPv6