We will be gradually migrating traffic to use new IP addresses for bitbucket.org from August 2023.
The migration is expected to be completed by the end of October.
There will not be any downtime for this migration, and most users will not have to do anything differently because of this migration.
Developers, teams and organizations that use a firewall, access list, security group or other network policy to restrict outgoing SSH access to a particular IP will need to update their rules to permit connections to our new addresses.
The change does not affect the IPs used by Bitbucket to connect to remote servers internet, such as for Webhooks.
Why are we doing this?
Bitbucket has seen amazing growth over recent years, with millions of developers and teams using it to build better software.
Continuing our commitment to performance and reliability we'll be making enhancements to our network edge, introducing additional points of presence in the US, Europe, and Asia.
This necessitates the addition of new IP addresses to our IPv4 A and IPv6 AAAA DNS records.
How will this affect you?
Most users will not have to do anything special for this change. Your DNS servers should pick up the new IPs within a few minutes, and your systems should start using the new IPs right away. We’ll keep the old IPs running for a few weeks afterward just in case, though.
Firewall considerations
If you control access to Bitbucket from your network with a firewall, then you may need to update your configuration. Please ensure these new IPs are allowed through your firewall.
New destination IP addresses for bitbucket.org, bitbucket.com, api.bitbucket.org, bitbucket.io, bytebucket.org, altssh.bitbucket.org will be:
- IPv4: 104.192.136.0/21, 185.166.140.0/22
- IPv6: 2401:1d80:3000::/36
These ranges are completely owned and controlled by Atlassian, however, they do include Atlassian products other than Bitbucket. As Bitbucket continues to grow we intend on adding more regions to our edge network, using more IP addresses from these ranges.
Atlassian strongly encourages that the above ranges are permitted through your firewall and recommends against allowing individual IPs. If you need them, here is the full list of individual IPs.
SSH considerations
Our server’s SSH key is not changing, so most SSH clients will continue to work without interruption. However, a small number of users may see a warning similar to this when they push or pull over SSH:
Warning: the RSA host key for 'bitbucket.org' differs from the key for the IP address '18.205.93.1'
The warning message will also tell you which lines in your ~/.ssh/known_hosts need to change. Open that file in your favorite editor, remove or comment out those lines, then retry your push or pull.
Additional resources
Atlassian Public IP ranges JSON: https://ip-ranges.atlassian.com/ (will be updated with the new addresses as part of the new IPs rollout)
https://confluence.atlassian.com/bitbucket/what-are-the-bitbucket-cloud-ip-addresses-i-should-use-to-configure-my-corporate-firewall-343343385.html (will be updated with the new addresses as part of the new IPs rollout)
