Automattic IP Ranges: offer IP list via API endpoint. #1719

MarceloPedra · 2015-03-07T15:26:43Z

Hello guys. I was under a heavy xmlrpc attack, and had to block access to xmlrpc.php using the iThemes Security plugin. But to allow JetPack to work in the meantime, I allowed this IP range:

<files xmlrpc.php>
    Order allow,deny
    Deny from all
    Allow from 192.0.64.0/18
</files>

My question is: is there any other IP range that should be allowed for JetPack to work properly?

Thank you!

georgestephanis · 2015-03-07T19:51:15Z

Our list of IP ranges do change, so I really couldn't recommend whitelisting. Nearly all of our requests do come in with the ?for=jetpack get string on the end.

Plus, you can use the add_filter( 'xmlrpc_enabled', '__return_false' ); filter to turn off xmlrpc from with WordPress safely without negatively affecting Jetpack.

jeherve · 2015-03-07T19:54:14Z

Here are the IPs you can use:
http://whois.arin.net/rest/org/AUTOM-93/nets
You'll also need to add 185.64.140.0/22 and a04:fa80::/29 to the list.

Overall, we don't suggest this approach since our IP block will change over time, changing the possible IP addresses and this would prevent any of the mobile apps or other desktop clients from working.

Alternatively, Jetpack requests are routed to /xmlrpc.php?for=jetpack , so matching that string and allowing that is another option. Jetpack has protocols in place to only accept incoming requests that have been signed by our servers.

I believe iThemes Security includes an option to block XML-RPC pingback requests only. Since this is the most common vector of attack to XML-RPC today, you could block only that while still allowing other XML-RPC requests from plugins and mobile apps.
You can also use this plugin to disable XML-RPC pingback requests:
https://wordpress.org/plugins/disable-xml-rpc-pingback/

Jany-M · 2017-02-15T18:45:10Z

@jeherve I'm not too good at regex, could you maybe share a snippet to effectively match the string, so I can also use that method, rather then IPs?

jeherve · 2017-02-15T20:38:12Z

@Jany-M This should help: http://www.analyticsmarket.com/freetools/ipregex

Jany-M · 2017-02-16T10:20:16Z

@jeherve I think the link only helps with IP ranges, am I mistaken? I meant a snippet to match the /xmlrpc.php?for=jetpack string, or anything jetpack related (or even WP API related), you think should be allowed.

jeherve · 2017-02-16T13:37:57Z

I think the link only helps with IP ranges, am I mistaken?

That's correct.

Overall, we don't recommend that approach though. You can check a possible alternative in my comment above.

kymc · 2017-04-11T11:08:15Z

How about a dynamic endpoint somewhere that could be polled? With this, everyone could programatically maintain their whitelists.. 👌

jeherve · 2017-04-19T19:15:21Z

I like that idea. That's not on our roadmap right now, but I'll reopen that issue so we can go back to it later.

MarceloPedra · 2017-06-13T18:55:44Z

Hi! Any news on this request?

Retriev3r · 2017-09-13T17:30:58Z

@MarceloPedra
Here are the new addresses (2017) to block all XMLRPC requests and allow only Jetpack (Wordpress.com) + also working with your website behind Cloudflare.

`

<files xmlrpc.php>
	Order deny,allow
	Deny from all
	
    # Whitelist Jetpack / Automattic CIDR IP Address Blocks (source: http://whois.arin.net/rest/org/AUTOM-93/nets )
	Allow from 192.0.64.0/18
	Allow from 185.64.140.0/22
	Allow from 76.74.255.0/25
	Allow from 76.74.248.128/25
	Allow from 198.181.116.0/24
	Allow from 64.34.206.0/24
	Allow from 2620:115:C000::/40
	Allow from 122.248.245.244
	Allow from 54.217.201.243
	Allow from 54.232.116.4

    # Whitelist Cloudflare CIDR IP Address Blocks (source: https://www.cloudflare.com/ips/ )
	Allow from 103.21.244.0/22
	Allow from 103.22.200.0/22
	Allow from 103.31.4.0/22
	Allow from 104.16.0.0/12
	Allow from 108.162.192.0/18
	Allow from 131.0.72.0/22
	Allow from 141.101.64.0/18
	Allow from 162.158.0.0/15
	Allow from 172.64.0.0/13
	Allow from 173.245.48.0/20
	Allow from 188.114.96.0/20
	Allow from 190.93.240.0/20
	Allow from 197.234.240.0/22
	Allow from 198.41.128.0/17
</files>

`

tfpdeveloper · 2018-02-08T14:42:03Z

What's the status of this issue ?

As IP range might change over time, any doable solution to block all xml-rpc requests except from automattic?

jeherve · 2018-02-08T20:34:16Z

What's the status of this issue ?

We have not made any progress on this, but will update this issue when we do.

curtisbelt · 2018-03-20T23:11:47Z

Looks like the IPs have a changed a bit, just posting in case anyone was about to copy from the other list.

Only way to know for sure is to go to http://whois.arin.net/rest/org/AUTOM-93/nets
Then use a converter with the bulk range -> CIDR, such as https://www.cidrcalculator.com/

Automatic CIDR ranges as of March 20th 2018

192.0.64.0/18
198.181.116.0/22
2001:1978:1e00:3::/64
2620:115:c000::/40
64.34.206.0/24
66.155.105.128/26
69.90.253.0/24
76.74.248.128/25
76.74.255.0/25

Cloudflare offers dynamic plain text endpoints here:

https://www.cloudflare.com/ips-v4
https://www.cloudflare.com/ips-v6

+1 to Automatic getting something like this! Thanks.

pipdig · 2018-03-21T11:39:22Z

+1 A plaintext file like Cloudflare would be extremely useful for automation

stale · 2018-09-17T11:50:14Z

This issue has been marked as stale. This happened because:

It has been inactive in the past 6 months.
It hasn’t been labeled `[Pri] Blocker`, `[Pri] High`.

No further action is needed. But it's worth checking if this ticket has clear reproduction steps and it is still reproducible. Feel free to close this issue if you think it's not valid anymore — if you do, please add a brief explanation.

jonathanspw · 2019-01-04T23:23:36Z

This would be extremely beneficial to hosts trying to help their customers.

stephengroat-dd · 2019-03-26T18:56:02Z

in case anyone's interested, i made a little script that pulls the ip addresses using ARIN's api: stephengroat/clacl@bb0874f

stale · 2019-09-22T19:01:10Z

This issue has been marked as stale. This happened because:

It has been inactive in the past 6 months.
It hasn’t been labeled `[Pri] Blocker`, `[Pri] High`.

No further action is needed. But it's worth checking if this ticket has clear reproduction steps and it is still reproducible. Feel free to close this issue if you think it's not valid anymore — if you do, please add a brief explanation.

mjangda · 2020-02-11T20:16:32Z

This page includes details about IPs: https://jetpack.com/support/hosting-faq/

And also mentions two endpoints that can be used:

https://jetpack.com/ips-v4.json
https://jetpack.com/ips-v4.txt

The caveat noted on the page is important:

These IP addresses are subject to change. If you are writing IP-based firewall rules, you’ll need to update those rules any time the addresses change.

jonathanspw · 2020-02-12T00:41:50Z

Thank you!

iamkingsleyf · 2020-03-07T07:39:40Z

This is confusing

GwynethLlewelyn · 2021-11-11T19:20:07Z

In case that someone comes here via Google and needs the latest lists of official IP addresses:

Jetpack:
- https://jetpack.com/ips-v4.txt (only IPv4 though)
- IPv6 addresses as before:
  2001:1978:1e00:3::/64
  2620:115:c000::/40
Akismet: (as of 2021-04-06; this is manually updated...)
192.0.80.244
192.0.80.246
192.0.96.247
192.0.96.248
192.0.123.250
195.234.111.251
195.234.111.252
Cloudflare: (as posted above, their endpoints have not changed)
- https://www.cloudflare.com/ips-v4
- https://www.cloudflare.com/ips-v6

Source: https://jetpack.com/support/hosting-faq/

jeherve closed this as completed Mar 7, 2015

jeherve reopened this Apr 19, 2017

jeherve added General [Pri] Low [Type] Enhancement Changes to an existing feature — removing, adding, or changing parts of it labels Apr 19, 2017

jeherve changed the title ~~What IP ranges should be whitelisted when blocking xmlrpc.php?~~ Automattic IP Ranges: offer IP list via API endpoint. Apr 19, 2017

stale bot added the [Status] Stale label Sep 17, 2018

stale bot removed the [Status] Stale label Jan 4, 2019

stale bot added the [Status] Stale label Sep 22, 2019

ypcs mentioned this issue Oct 28, 2019

Whitelist Jetpack IP addresses from XML-RPC blocker Seravo/seravo-plugin#297

Closed

mjangda closed this as completed Feb 11, 2020

stephengroat mentioned this issue Feb 11, 2020

Automattic fix stephengroat/clacl#11

Open

anomiex removed the [Status] Stale label Jul 7, 2023

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Automattic IP Ranges: offer IP list via API endpoint. #1719

Automattic IP Ranges: offer IP list via API endpoint. #1719

MarceloPedra commented Mar 7, 2015

georgestephanis commented Mar 7, 2015

jeherve commented Mar 7, 2015 •

edited

Loading

Jany-M commented Feb 15, 2017 •

edited

Loading

jeherve commented Feb 15, 2017

Jany-M commented Feb 16, 2017

jeherve commented Feb 16, 2017

kymc commented Apr 11, 2017

jeherve commented Apr 19, 2017

MarceloPedra commented Jun 13, 2017

Retriev3r commented Sep 13, 2017

tfpdeveloper commented Feb 8, 2018

jeherve commented Feb 8, 2018

curtisbelt commented Mar 20, 2018

pipdig commented Mar 21, 2018

stale bot commented Sep 17, 2018

jonathanspw commented Jan 4, 2019

stephengroat-dd commented Mar 26, 2019

stale bot commented Sep 22, 2019

mjangda commented Feb 11, 2020

jonathanspw commented Feb 12, 2020

iamkingsleyf commented Mar 7, 2020

GwynethLlewelyn commented Nov 11, 2021

Automattic IP Ranges: offer IP list via API endpoint. #1719

Automattic IP Ranges: offer IP list via API endpoint. #1719

Comments

MarceloPedra commented Mar 7, 2015

georgestephanis commented Mar 7, 2015

jeherve commented Mar 7, 2015 • edited Loading

Jany-M commented Feb 15, 2017 • edited Loading

jeherve commented Feb 15, 2017

Jany-M commented Feb 16, 2017

jeherve commented Feb 16, 2017

kymc commented Apr 11, 2017

jeherve commented Apr 19, 2017

MarceloPedra commented Jun 13, 2017

Retriev3r commented Sep 13, 2017

tfpdeveloper commented Feb 8, 2018

jeherve commented Feb 8, 2018

curtisbelt commented Mar 20, 2018

pipdig commented Mar 21, 2018

stale bot commented Sep 17, 2018

jonathanspw commented Jan 4, 2019

stephengroat-dd commented Mar 26, 2019

stale bot commented Sep 22, 2019

mjangda commented Feb 11, 2020

jonathanspw commented Feb 12, 2020

iamkingsleyf commented Mar 7, 2020

GwynethLlewelyn commented Nov 11, 2021

jeherve commented Mar 7, 2015 •

edited

Loading

Jany-M commented Feb 15, 2017 •

edited

Loading