Server Fault is a question and answer site for system and network administrators. It's 100% free, no registration required.

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

I have some services - mysql, some HTTP services - which I would like to have open for Heroku exclusively. I can define IP adress / IP mask (I am not sure what it is in EC2 security groups). Which IP or mask fits only Heroku? I guess Heroku has more IPs it can possibly access my EC2 instance from.

How can I allow access to some EC2 ports only for Heroku?

share|improve this question

As described in Heroku's devcenter, to open your EC2 server to Heroku you can use the command:

$ ec2-authorize YOURGROUP -P tcp -p 3306 -u 098166147350 -o default

This will create a rule in the security group YOURGROUP from Heroku that will allow Heroku to connect to your server through TCP port 3306.

When connecting from the Heroku App to the EC2 server, instead of using the elastic IP, you should use the full public DNS record:


share|improve this answer
Related answer: – glarrain Oct 22 '13 at 14:47
Just wanted to add that Heroku no longer recommends using the account ID and security group name as a mechanism for granting access. See this changelog item for details: – friism Oct 24 '13 at 19:47

I've asked the same question to Heroku support. They said to use the same configuration used for Amazon RDS.

share|improve this answer
This answer doesn't seem quite relevant to me. The OP asks what block of IP addresses Heroku uses such that he can filter incoming connections to a variety of his own services. – ybakos Jan 4 '12 at 17:44

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.