1

I have denied all outgoing traffic, but need to allow some of them in order to allow the installation of certain software packages. One of such packages resides on github and that means that the ip range of github-production-release-asset-2e65be.s3.amazonaws.com has to be allowed, but after adding a couple of ip addresses it turns out that there are multiple ips.

Attempt to solve the issue

https://api.github.com/meta was found and returns the ips, but not those of AWS

Current approach

As a workaround I have allow outgoing connection to 52.216/16, but that it is too open

  • 1
    IP filtering is quite 'old school' and absolutely not adapted... Targeting S3, take aws S3 endpoints IP at worst. Better use an artifact proxy like nexus or a proxy to filter on urls IMO – Tensibai Mar 4 '18 at 23:33
  • See: docs.aws.amazon.com/general/latest/gr/aws-ip-ranges.html if you really want to go this way, but there's quite large ranges, the 52.216.0.0 is a /15 for us-east-1 and not a /16 btw { "ip_prefix": "52.216.0.0/15", "region": "us-east-1", "service": "S3" }, – Tensibai Mar 5 '18 at 10:09
  • Side question: outgoing from where ? internal network ? – Tensibai Mar 5 '18 at 13:32
0

@Tensibai indicated that:

See: https://docs.aws.amazon.com/general/latest/gr/aws-ip-ranges.html if you really want to go this way, but there's quite large ranges, the 52.216.0.0 is a /15 for us-east-1 and not a /16 btw { "ip_prefix": "52.216.0.0/15", "region": "us-east-1", "service": "S3" },

| improve this answer | |

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.