---
title: "Configure network access to the Kafka cluster"
sidebar_label: "Configure network access to the cluster"
sidebar_position: 12
toc_max_heading_level: 3
description: "How to define a list of allowed IP addresses, basic information about security groups in a Kafka database cluster, and how to assign a security group"
---

import Formbricks from '@theme/MDXComponents/Formbricks'
import PlusIcon from '@selectel/docux/icons/plus'
import ShieldOkIcon from '@selectel/docux/icons/shield-ok'
import CheckIcon from '@selectel/docux/icons/check'

# Configure network access to the Kafka cluster

By default, in clusters with a public subnet, the connection is allowed for all IP addresses if a username and password are provided.

For a cluster in a private subnet, the connection is allowed from the cluster subnet and from subnets that are connected to the cluster subnet via a cloud router.

You can [define a list of allowed IP addresses](#define-allowed-ip-addresses-list) from which access to the Managed Database cluster will be allowed.

Also, to restrict access to a Managed Database cluster, you can use [security groups](#security-groups-in-managed-databases).

Any changes to network access settings are the customer's responsibility.

## Define a list of allowed IP addresses \{#define-allowed-ip-addresses-list}

When restoring a cluster from a backup, the list of allowed IP addresses will not be saved — for the new cluster, the allowed IP addresses will need to be specified again.

1. In the [Dashboard](https://my.selectel.ru/vpc/default/dbaas/) on the top menu, click **Products** and select **Managed Databases**.
2. Open the **Active** tab.
3. Open the database cluster page → **Settings** tab.
4. In the **Network access control** block, click the **Allowed addresses and subnet CIDRs** field.
5. At the bottom of the drop-down list, enter the CIDR of the subnet or the IP address from which access to the cluster should be allowed. Only IPv4 addressing is supported.
6. Click <PlusIcon />.
7. Repeat steps 5 and 6 for all allowed IP addresses.
8. Click **Save**. Connections from all IP addresses other than those specified in the allowed list will be blocked.

## Security groups in a Managed Database cluster \{#security-groups-in-managed-databases}

A security group in a Managed Database cluster is a set of rules for filtering incoming and outgoing traffic of the cluster.For security groups to work, [traffic filtering (port security](/cloud-servers/cloud-networks/about-networks.mdx#traffic-filtering-port-security)) must be enabled in the network.

If traffic filtering is enabled on the network, a [default security group](/cloud-servers/security-groups/about-security-groups.mdx#default-security-group) is assigned to all [ports](/cloud-servers/cloud-networks/ports.mdx) in that network, which allows all traffic through the ports.You can assign a different security group when [creating a cluster](/managed-databases/kafka/create-cluster.mdx) or in an [existing cluster](#assign-security-group-in-existing-cluster).

In addition to the security groups you select when creating a cluster, a service security group is automatically assigned to Managed Database cluster network ports. This group keeps the cluster running and cannot be changed or deleted. The service group appears only in the OpenStack CLI and Terraform.

Read more about security groups in the [Security Groups](/cloud-servers/security-groups/) section.

### Assign a security group in an existing cluster \{#assign-security-group-in-existing-cluster}

:::warning

After assigning the group, all active sessions that do not comply with the group's rules will be terminated.

:::

1. Ensure that [traffic filtering (port security](/cloud-servers/cloud-networks/about-networks.mdx#traffic-filtering-port-security)) is enabled in the cluster network. To do this, in the [Dashboard](https://my.selectel.ru/vpc/default/networks) on the top menu, click **Products** → **Cloud Servers** → **Network** → **Private networks** or **Public networks** tab. A network with filtering enabled is marked with <ShieldOkIcon />.

   If filtering is disabled, to use security groups, create a new cluster in a new subnet or in a subnet with traffic filtering enabled.

2. In the [Dashboard](https://my.selectel.ru/vpc/default/dbaas/) on the top menu, click **Products** and select **Managed Databases**.

3. Open the **Active** tab.

4. Open the database cluster page → **Settings** tab.

5. In the **Security** block, click **Edit**.

6. Select the security group to be assigned to all [ports](/cloud-servers/cloud-networks/ports.mdx) in the cluster network.

7. Click <CheckIcon />.

<Formbricks />