---
name: Registry-registry_firewall
title: Accessing Container Registry through a firewall
description: To authorize worker nodes to communicate with IBM Cloud® Container Registry, you must allow outgoing network traffic from the worker nodes to IBM Cloud Container Registry regions.
last-updated: 2026-05-27
---

> ## Documentation Index
> The table of contents for this documentation set is at https://cloud.ibm.com/docs/Registry?format=markdown
> The index for all IBM Cloud docs is at: https://cloud.ibm.com/docs/llms.txt
> Use these files to discover more information as needed.

# Accessing Container Registry through a firewall
{: #registry_firewall}

To authorize worker nodes to communicate with IBM Cloud® Container Registry, you must allow outgoing network traffic from the worker nodes to IBM Cloud Container Registry [regions](https://cloud.ibm.com/docs/Registry?topic=Registry-registry_overview&format=markdown#registry_regions).
{: shortdesc}

If you're using IBM Cloud Kubernetes Service or Red Hat® OpenShift® on IBM Cloud®, by default the connection to Container Registry is private. Therefore, you don't need to allow public access to Container Registry. For more information about private connectivity, see [Private network connection to `icr.io` registries](https://cloud.ibm.com/docs/containers?topic=containers-registry&format=markdown#cluster_registry_auth_private).
{: note}

You can configure your firewall to allow connections to Container Registry by using a [Layer 7 firewall](https://nordlayer.com/learn/firewall/layer-7/){: external} with the domains listed in the following table.

When you access IBM Cloud Container Registry over the public internet, you must not have any allowlist restrictions that are based on IP addresses in place. If you are concerned about opening your allowlist, you can configure private access to IBM Cloud Container Registry by using the private IBM Cloud network, see [Securing your connection to Container Registry](https://cloud.ibm.com/docs/Registry?topic=Registry-registry_private&format=markdown). IP address lists are not provided because they can change frequently.
{: important}

In addition to the following regional subdomains, you must also allow traffic from your worker nodes to port `443` on all subdomains of `icr.io` so that they can be redirected to other subdomains for delivery optimization. You must allow `TCP port 443 FROM <each_worker_node_publicIP> TO *.icr.io`, where `<each_worker_node_publicIP>` is the public IP address for each worker node. If you use the deprecated domain names, you must allow those domains too.

| Location | Registry address | Deprecated addresses |
| ------ | ---------------- | -------------------- |
| Chennai - Airtel | `in.icr.io` | Not applicable |
| Dallas | `us.icr.io` | `registry.ng.bluemix.net` |
| Frankfurt | `de.icr.io` | `registry.eu-de.bluemix.net` |
| Global | `icr.io` | `registry.bluemix.net` |
| London | `uk.icr.io` | `registry.eu-gb.bluemix.net` |
| Madrid | `es.icr.io` | Not applicable |
| Montreal | `ca2.icr.io` | Not applicable |
| Mumbai - Airtel | `in2.icr.io` | Not applicable |
| Osaka | `jp2.icr.io` | Not applicable |
| Sao Paolo | `br.icr.io` | Not applicable |
| Sydney | `au.icr.io` | `registry.au-syd.bluemix.net` |
| Tokyo | `jp.icr.io` | Not applicable |
| Toronto | `ca.icr.io` | Not applicable |
{: caption="Addresses for Container Registry traffic" caption-side="bottom"}
{: #table_registry_firewall_traffic_addresses}

## Using a public network to access Container Registry
{: #registry_firewall_public}

### Using a public network to access Container Registry by using the domain `icr.io`
{: #registry_firewall_public_global}

If you use a public network to access the Container Registry by using the domain `icr.io`, you must add the following domains to your firewall rules:

- `dd0.icr.io`
- `dd2.icr.io`

Users that are located in China must also allow the following domains:

- `dd1-icr.ibm-zh.com`
- `dd3-icr.ibm-zh.com`

You can also add wildcard characters to domains in your allowlist, for example `*.icr.io` and `*.ibm-zh.com`.

### Using a public network to access Container Registry regions
{: #registry_firewall_public_regions}

If you use a public network and domain-based firewall rules to access IBM Cloud Container Registry, you must add the following domains to your firewall rules.

| Local Container Registry region | Domain name |
| ----------------------------------------------------- | ----------- |
| `au-syd` | `dd0.au.icr.io` |
| `br-sao` | `dd0.br.icr.io` |
| `ca-mon` | `dd0.ca2.icr.io` |
| `ca-tor` | `dd0.ca.icr.io` |
| `eu-de` | `dd0.de.icr.io` |
| `eu-es` | `dd0.es.icr.io` |
| `eu-gb` | `dd0.uk.icr.io` |
| `in-che` | `dd0.in.icr.io` |
| `in-mum` | `dd0.in2.icr.io` |
| `jp-osa` | `dd0.jp2.icr.io` |
| `jp-tok` | `dd0.jp.icr.io` |
| `us-south` | `dd0.us.icr.io` |
{: caption="Add these domains to your firewall rules for Container Registry" caption-side="bottom"}
{: #table_registry_firewall_domains}