Take the 2-minute tour ×
Server Fault is a question and answer site for system and network administrators. It's 100% free, no registration required.

Our website is being accessed by a client who's firewall is setup with whitelisted IP addresses vs FQDN/DNS names. The trouble is that the website uses google's CDN to host jQuery and jQueryUI rather than storing them on our own server.

The challenge is that pinging google.com (and other variants of it) returns a different IP address depending on your location.

Is there a way to get the IP range of google's CDN (or any other CDN for that matter) to help configure an IP-based firewall?

share|improve this question

2 Answers 2

up vote 2 down vote accepted

Their ASN is 15169; just have to look up the BGP table.

share|improve this answer
    
Excellent - how did you figure out their ASN? –  JayTee Aug 13 '10 at 14:24
1  
google.com/search?q=google+bgp+as –  Chris S Aug 13 '10 at 14:43

Ultimately I doubt that your client will be will be willing to whitelist/unblock all of the google ASN as it contains so many IP's and will provide access to so much of the internet.

This is the problem you have with CDN's, they are made up of hundreds if not thousands of servers and consequently IP's.

Rather than using firewall rules, the normal way to limit interest access is to put a proxy server in front of your firewall which is configured to allow or block access to the internet/specific sites for all or specific users. Using this method your client can whitelist the hostname e.g cdn.google.com as allowed through the proxy and solve your problem but if they insist upon using firewall rules your only option is to either allow all the google IP's or alternatively use a different CDN with a much smaller amount of IP's e.g the rackspace cloud files CDN.

share|improve this answer
1  
Those IPs all belong to Google... You're not opening yourself up to the Internet, just to one company (granted there's a ton of employees there, but that's quite different than "the Internet"). –  Chris S Aug 13 '10 at 14:41
    
This is true, but... It's not the number of employees, but the amount of third party content hosted by Google, such as docs, YouTube and blogger. A proxy probably us smarter than IP based restrictions if you want to restrict outbound requests. –  poolie Jun 2 '13 at 9:59

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.