RocketMQ Network Connection Conditions

A client can connect to a RocketMQ instance over a public or private network. Notes before using a private network:

By default, a client and a RocketMQ instance are interconnected when they are deployed in a VPC.
If they are not in the same VPC, interconnect their VPCs. VPCs are isolated from each other.

Table 1 lists the modes of client connections to a RocketMQ instance.

**Table 1** Connection modes
Mode	Implementation	Reference
Public access	Enable public access on the RocketMQ console and configure elastic IPs (EIPs). The client can connect to the RocketMQ instance through EIPs.	Configuring Public Access for a RocketMQ Instance
Private access	A client and a RocketMQ instance are interconnected when they are deployed in a VPC.	-
Private access	When a client and a RocketMQ instance are deployed in different VPCs of the same region, interconnect the two VPCs using a VPC peering connection.	VPC Peering Connection

Before connecting a client to a RocketMQ instance, configure the following security group rules.

After a security group is created, its default inbound rule allows communication among ECSs within the security group and its default outbound rule allows all outbound traffic. In this case, you can access a RocketMQ instance within a VPC, and do not need to add rules according to Table 2 or Table 3.

**Table 2** Security group rules (RocketMQ 4.8.0)
Direction	Protocol	Port	Source	Description
Inbound	TCP	8100	IP address or IP address group of the RocketMQ client	The port is used for private network access to metadata nodes using TCP.
Inbound	TCP	8200		The port is used for public network access to metadata nodes using TCP.
Inbound	TCP	10100–10199		The port is used for private access to service nodes using TCP.
Inbound	TCP	10101–10199		The port is used for public access to service nodes using TCP.

**Table 3** Security group rules (RocketMQ 5.x)
Direction	Protocol	Port	Source	Description
Inbound	TCP	8100	IP address or IP address group of the RocketMQ client	The port is used for private network access to instances using TCP.
Inbound	TCP	8200		The port is used for public network access to instances using TCP.
Inbound	TCP	8080		The port is used for private network access to instances using gRPC.
Inbound	TCP	8081		The port is used for public network access to instances using gRPC.
Inbound	TCP	10100		The port is used for private access to service nodes using TCP.
Inbound	TCP	10101		The port is used for public access to service nodes using TCP.