2

Our website is being accessed by a client who's firewall is setup with whitelisted IP addresses vs FQDN/DNS names. The trouble is that the website uses google's CDN to host jQuery and jQueryUI rather than storing them on our own server.

The challenge is that pinging google.com (and other variants of it) returns a different IP address depending on your location.

Is there a way to get the IP range of google's CDN (or any other CDN for that matter) to help configure an IP-based firewall?

JayTee
  • 105
  • 1
  • 1
  • 10

3 Answers3

7

The answer is way more complicated than ASN 15169. First Google has more than one ASN:

15169 Google Inc.
16591 Google Fiber Inc.
36039 Google Inc.
36040 Google Inc.
36384 Google Incorporated
36492 Google, Inc.
41264 Google Switzerland GmbH

Second, Google, Akamai, etc use IP ranges of their partner ASNs to host content. So if you are a Time Warner customer, you may see Google CDN content coming from a server close to you that has an IP associated with Time Warner (via ASN) and not Google.

After all the whole point of CDNs is to distribute content efficiently.

GregL
  • 9,370
  • 2
  • 25
  • 36
user1089933
  • 71
  • 1
  • 2
2

Their ASN is 15169; just have to look up the BGP table.

Chris S
  • 77,945
  • 11
  • 124
  • 216
0

Ultimately I doubt that your client will be will be willing to whitelist/unblock all of the google ASN as it contains so many IP's and will provide access to so much of the internet.

This is the problem you have with CDN's, they are made up of hundreds if not thousands of servers and consequently IP's.

Rather than using firewall rules, the normal way to limit interest access is to put a proxy server in front of your firewall which is configured to allow or block access to the internet/specific sites for all or specific users. Using this method your client can whitelist the hostname e.g cdn.google.com as allowed through the proxy and solve your problem but if they insist upon using firewall rules your only option is to either allow all the google IP's or alternatively use a different CDN with a much smaller amount of IP's e.g the rackspace cloud files CDN.

ccame
  • 1,059
  • 2
  • 11
  • 15
  • 1
    Those IPs all belong to Google... You're not opening yourself up to the Internet, just to one company (granted there's a ton of employees there, but that's quite different than "the Internet"). – Chris S Aug 13 '10 at 14:41
  • This is true, but... It's not the number of employees, but the amount of third party content hosted by Google, such as docs, YouTube and blogger. A proxy probably us smarter than IP based restrictions if you want to restrict outbound requests. – poolie Jun 02 '13 at 09:59