4

Okay, so we implement Recaptcha in production. We get errors because it can't reach the IP address it needs to use the service. We open a port for the IP address to reach Google. No problem. We do that and configure that IP address explicitly to work. It works great. Then, the next day, we start getting errors again because Recaptcha is using a different IP address. I can allow requests from that IP address, too, but now I'm unsettled. Where are these addresses coming from? How do I configure this to work reliably?

Josh C
  • 341
  • 1
  • 6
  • 23

3 Answers3

4

Recatpcha from Google can use any Google IP address and there are lots of them.

Ran this from Windows:

_netblocks.google.com text = nslookup -type=TXT _netblocks.google.com "v=spf1 ip4:216.239.32.0/19 ip4:64.233.160.0/19 ip4:66.249.80.0/20 ip4:72.14.192.0/18 ip4:209.85.128.0/17 ip4:66.102.0.0/20 ip4:74.125.0.0/16 ip4:64.18.0.0/20 ip4:207.126.144.0/20 ip4:173.194.0.0/16 ?all"

That's all the network Google uses currently. These can change so check them often.

Google suggest allowing port 80 to all IPs outbound, this highly insecure. They recommend going through a proxy server but again that is highly insecure if your web server is an DMZ. Proxy aware trojans do exist. All that need to be done is exploit a vulnerability to execute arbitrary code and you can create reverse connection on port 80 through a proxy server to download the payload. Then it is trivial to escalate privileges and own the box. I don't mean just Windows servers but Linux as well. I've done it in lab environment on security was on. It's really easy to do.

This is the Google website I got this from:

http://code.google.com/p/recaptcha/wiki/FirewallsAndRecaptcha

Chris
  • 41
  • 2
3

I wanted to append to this answer with more recent information. The documentation that Chris is pointing to does not include all of the TXT records necessary to dig (thanks Google):

  • _netblocks2.google.com (IPv6 subnets)
  • _netblocks3.google.com (Additional IPv4 subnets)

In my particular case, the _netblocks3 entry contained 2 large /19's that made my initial rule ineffective

(I found additional references here: https://support.google.com/a/answer/60764?hl=en)

Community
  • 1
  • 1
Paul
  • 41
  • 3
-1

Perhaps you should be using a hostname rather than IP

ChrisBint
  • 12,773
  • 6
  • 40
  • 62
  • Yeah, but there's no way for me to configure this. The IP addresses just seem to come out of nowhere. – Josh C Oct 22 '12 at 20:16