> For the complete documentation index, see [llms.txt](https://mariadb.com/docs/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://mariadb.com/docs/galera-cluster/galera-security/connection-allowlist.md).

# Connection Allowlist

{% hint style="info" %}
The `wsrep_allowlist` system variable is available from MariaDB Enterprise Server 11.4.
{% endhint %}

MariaDB Enterprise Cluster can restrict which IP addresses are allowed to establish cluster connections. Incoming connections are checked by IP address against an allowlist. When no allowlist is configured, all addresses are allowed.

## Configuring the Allowlist

Allowed addresses can be specified in two ways:

* **`wsrep_allowlist` system variable** — a comma-separated list of allowed IP addresses, set at server startup. The variable is read-only and global, and defaults to empty.
* **`mysql.wsrep_allowlist` table** — a persistent allowlist stored in the system schema, consulted once the storage engines are initialized.

When an allowlist is configured, only the listed addresses may join the cluster; all other connection attempts are rejected.

```ini
[mariadb]
...
wsrep_allowlist = "10.0.0.11,10.0.0.12"
```

## How It Works

The allowlist is enforced through the wsrep allowlist service, which the Galera library calls to authorize each incoming connection by its IP address.

## See Also

* [Securing Communications in Galera Cluster](/docs/galera-cluster/galera-security/securing-communications-in-galera-cluster.md)
* [MariaDB Enterprise Cluster Security](/docs/galera-cluster/galera-security/mariadb-enterprise-cluster-security.md)

<sub>*This page is licensed: CC BY-SA / Gnu FDL*</sub>