# Configure Egress for Redpanda Connect Pipelines

> For the complete documentation index, see [llms.txt](https://docs.redpanda.com/llms.txt). Component-specific: [cloud-data-platform-full.txt](https://docs.redpanda.com/cloud-data-platform-full.txt)

---
title: Configure Egress for Redpanda Connect Pipelines
latest-operator-version: v26.2.3
latest-console-tag: v3.11.0
latest-connect-version: 4.108.0
latest-redpanda-tag: v26.2.2
docname: connect-egress-allowlist
page-component-name: cloud-data-platform
page-version: master
page-component-version: master
page-component-title: Cloud
page-relative-src-path: connect-egress-allowlist.adoc
page-edit-url: https://github.com/redpanda-data/cloud-docs/edit/main/modules/networking/pages/connect-egress-allowlist.adoc
description: Allow Redpanda Connect pipelines on a BYOC or Dedicated cluster to reach private destinations that the data plane firewall blocks by default, such as a database in a peered network or a VPC endpoint inside the data plane VPC.
page-topic-type: how-to
personas: platform_admin
learning-objective-1: Identify which pipeline destinations the data plane firewall blocks by default
learning-objective-2: Add egress allowlist rules to a cluster using the Cloud API or Terraform
learning-objective-3: Troubleshoot a pipeline connection that the firewall blocks
page-git-created-date: "2026-08-12"
page-git-modified-date: "2026-09-01"
---

<!-- Source: https://docs.redpanda.com/cloud-data-platform/networking/connect-egress-allowlist.md -->

Redpanda Connect pipelines on BYOC and Dedicated clusters run behind a [data plane](https://docs.redpanda.com/cloud-data-platform/reference/glossary/#data-plane) firewall that blocks outbound connections to most private addresses. Add an egress allowlist to your cluster to let pipelines reach a private destination, such as a database in a peered network or a VPC endpoint that fronts a third-party service.

After reading this page, you will be able to:

-   Identify which pipeline destinations the data plane firewall blocks by default

-   Add egress allowlist rules to a cluster using the Cloud API or Terraform

-   Troubleshoot a pipeline connection that the firewall blocks


## [](#default-pipeline-egress)Default pipeline egress

On BYOC and Dedicated clusters, pipelines run as pods inside the data plane VPC or VNet. Each pipeline pod enforces a firewall that classifies every outbound connection by destination address and port:

| Destination | Default behavior |
| --- | --- |
| Your Redpanda cluster | Allowed on the Kafka API, HTTP Proxy, and Schema Registry ports. |
| DNS resolvers inside the data plane VPC or VNet | Allowed on port 53. |
| Public endpoints on the internet | Allowed. |
| Private addresses, whether inside the data plane VPC or VNet or in a peered network | Blocked on most ports. Redpanda permits only the ports it uses to operate the cluster, and the ranges it permits can change. Add an egress allowlist entry for any private destination your pipelines need. |
| Link-local addresses (169.254.0.0/16), including the cloud provider instance metadata service | Blocked. You cannot allow these destinations. |
| The Kubernetes API server, and the kubelet ports 10250 and 10255 on the data plane CIDR | Blocked. You cannot allow these destinations. |

This applies to your own networks. A database in a VPC you peer to the cluster, or anywhere in your own VPC CIDR on a BYOVPC cluster, needs an allowlist entry before pipelines can reach it.

An allowlist rule grants the pipeline permission to open the connection. It does not create a network path to the destination. If the destination sits outside the data plane VPC, you must also establish routing to it, for example through VPC peering or a transit gateway. See [Networking: BYOC](https://docs.redpanda.com/cloud-data-platform/networking/byoc/) or [Networking: Dedicated](https://docs.redpanda.com/cloud-data-platform/networking/dedicated/) for the peering and transit gateway options available for your cluster type and cloud provider.

## [](#prerequisites)Prerequisites

-   A BYOC or Dedicated cluster with Redpanda Connect enabled.

-   The destination address, expressed as an IPv4 CIDR block, and the TCP or UDP port or port range it listens on.

-   To use the Cloud API: a Cloud API service account with permission to update the cluster, and an access token. See [Get a Cloud API access token](#get-a-cloud-api-access-token).

-   To use Terraform: the [Redpanda Terraform provider](https://docs.redpanda.com/cloud-data-platform/manage/terraform-provider/) version 2.1.1 or later.


## [](#add-allowlist-rules-with-the-cloud-api)Add allowlist rules with the Cloud API

### [](#get-a-cloud-api-access-token)Get a Cloud API access token

1.  Save the base URL of the Redpanda Cloud API in an environment variable:

    ```bash
    export PUBLIC_API_ENDPOINT="https://api.cloud.redpanda.com"
    ```

2.  In the Redpanda Cloud UI, go to the [**Organization IAM**](https://cloud.redpanda.com/organization-iam) page, and select the **Service account** tab. If you don’t have an existing service account, you can create a new one.

    Copy and store the client ID and secret.

    ```bash
    export CLOUD_CLIENT_ID=<client-id>
    export CLOUD_CLIENT_SECRET=<client-secret>
    ```

3.  Get an API token using the client ID and secret. You can click the **Request an API token** link to see code examples to generate the token.

    ```bash
    export AUTH_TOKEN=`curl -s --request POST \
        --url 'https://auth.prd.cloud.redpanda.com/oauth/token' \
        --header 'content-type: application/x-www-form-urlencoded' \
        --data grant_type=client_credentials \
        --data client_id="$CLOUD_CLIENT_ID" \
        --data client_secret="$CLOUD_CLIENT_SECRET" \
        --data audience=cloudv2-production.redpanda.cloud | jq -r .access_token`
    ```


You must send the API token in the `Authorization` header when making requests to the Cloud API.

### [](#update-the-cluster)Update the cluster

1.  In the Redpanda Cloud Console, go to the cluster overview and copy the cluster ID from the page header.

    > 📝 **NOTE**
    >
    > On Dedicated clusters, the cluster ID is in the **Details** section.

    ```bash
    CLUSTER_ID=<cluster_id>
    ```

2.  Make a [`PATCH /v1/clusters/{cluster.id}`](https://docs.redpanda.com/api/doc/cloud-controlplane/operation/operation-clusterservice_updatecluster) request with the destinations you want to allow. This example allows pipelines to reach a VPC endpoint on port 443, and a service listening on ports 9000 to 9100:

    ```bash
    CLUSTER_PATCH_BODY=`cat << EOF
    {
      "redpanda_connect": {
        "allowed_destination_cidr_ports": [
          {
            "cidr": "10.0.32.0/20",
            "port_start": 443
          },
          {
            "cidr": "10.0.48.0/20",
            "port_start": 9000,
            "port_end": 9100
          }
        ]
      }
    }
    EOF`

    curl -sS -X PATCH \
      -H "Content-Type: application/json" \
      -H "Authorization: Bearer $AUTH_TOKEN" \
      -d "$CLUSTER_PATCH_BODY" $PUBLIC_API_ENDPOINT/v1/clusters/$CLUSTER_ID
    ```

3.  Check the state of the Update Cluster operation by calling [`GET /v1/operations/{id}`](https://docs.redpanda.com/api/doc/cloud-controlplane/operation/operation-operationservice_getoperation) with the operation ID returned by the previous call. When the state is `STATE_READY`, the allowlist is applied.


The request replaces the full allowlist. To add a rule to an existing allowlist, call [`GET /v1/clusters/{id}`](https://docs.redpanda.com/api/doc/cloud-controlplane/operation/operation-clusterservice_getcluster) first, then send the existing rules along with the new one.

## [](#add-allowlist-rules-with-terraform)Add allowlist rules with Terraform

Add the `redpanda_connect.allowed_destination_cidr_ports` attribute to your `redpanda_cluster` resource. Terraform updates the cluster in place without recreating it:

```hcl
resource "redpanda_cluster" "example" {
  # ... other cluster arguments ...

  redpanda_connect = {
    allowed_destination_cidr_ports = [
      {
        cidr       = "10.0.32.0/20"
        port_start = 443
      },
      {
        cidr       = "10.0.48.0/20"
        port_start = 9000
        port_end   = 9100
      }
    ]
  }
}
```

For a pipeline example that writes to a private PostgreSQL database, see [Enable egress to custom destinations](https://docs.redpanda.com/cloud-data-platform/manage/terraform-provider/#enable-egress-to-custom-destinations).

## [](#allowlist-rule-reference)Allowlist rule reference

Each rule allows outbound traffic to one CIDR block on one port or port range:

| Field or attribute | Required | Description |
| --- | --- | --- |
| cidr | Yes | Destination IPv4 CIDR block, for example 10.0.32.0/20. IPv6 is not supported. |
| port_start | Yes | First TCP or UDP port to allow, from 1 to 65535. |
| port_end | No | Last TCP or UDP port to allow, up to 65535. Omit this field to allow a single port. When set, the value must be greater than or equal to port_start. |

Limits:

-   A cluster accepts a maximum of 16 rules.

-   Each combination of `cidr`, `port_start`, and `port_end` must be unique.

-   Rules cannot override the destinations that Redpanda always blocks, such as link-local addresses and the Kubernetes API server. See [Default pipeline egress](#default-pipeline-egress).


## [](#when-allowlist-changes-take-effect)When allowlist changes take effect

A pipeline pod applies the firewall rules when it starts. When you change the allowlist, Redpanda restarts your existing pipelines so they pick up the new rules, so each pipeline stops processing briefly while it restarts. You do not need to restart pipelines yourself.

## [](#troubleshoot-a-blocked-connection)Troubleshoot a blocked connection

If a pipeline reports connection timeouts to a destination you allowed:

1.  Confirm the cluster update finished. Call `GET /v1/clusters/{id}` and check that `redpanda_connect.allowed_destination_cidr_ports` lists your rules.

2.  Confirm the pipeline restarted after the cluster update, because a pipeline picks up new rules only when it starts. See [When allowlist changes take effect](#when-allowlist-changes-take-effect).

3.  Confirm the destination address falls inside the CIDR block you allowed, and that the port matches. A rule for `port_start: 443` does not allow a connection to port 8443.

4.  Confirm a network path exists to the destination. An allowlist rule does not create routing. For destinations outside the data plane VPC, check your peering connection, transit gateway, or firewall rules.

5.  Confirm the destination is not one that Redpanda always blocks, such as a link-local address. See [Default pipeline egress](#default-pipeline-egress).


If the connection still fails, contact [Redpanda Support](https://support.redpanda.com/hc/en-us/requests/new).

## [](#next-steps)Next steps

-   [Build a data pipeline](https://docs.redpanda.com/cloud-data-platform/develop/connect/connect-quickstart/)

-   [Network Design and Ports](https://docs.redpanda.com/cloud-data-platform/networking/cloud-security-network/)

-   [Manage clusters with Terraform](https://docs.redpanda.com/cloud-data-platform/manage/terraform-provider/)