0

What:

We're using iptables and have our server rather locked down to only specific ports and IPs. Recently we have a requirement to open traffic to a third party service.

However, the third party service uses AWS with their backend instances behind an ELB. Of course the backend instance IPs can change at any moment as they are not static. At the same time Amazon cannot give a certain IP range.

How:

Ideally if we had the IP range then we could add this to iptables rules however we don't have it AND we cannot add the URL (for obvious reasons that this is not possible in iptables).

I can run the dig command against the two main URL's (api and main site) which will give me most of the IPs but the problem is that it doesn't pick up ALL of the backend instances.

The only way I was able to find the IPs was watching the logs to see which were being blocked. Once I added rules for those IPs then it started working....

Is there anyway that this could be scripted effectively? Or must we scrap using iptables....or find another third party service?

In case it helps, service we are trying to use is Mollom:

www.mollom.com , rest.mollom.com

Improve this question

2 Answers 2

Reset to default
1

You're probably not getting all the IPs from DNS because some of the instances that communicate with your service are background workers or task boxes etc. Without a reliable way to determine what IPs are likely to attempt to access your service, you won't be able to limit access by IP.

You could use Amazon's IP range API to open up access to that entire AWS region, but that defeats the point somewhat. Perhaps there's something unique in the way they access your application that you could use a crude form of shared secret, and restrict access to requests that look similar (user-agent header, specific query parameters etc)?

Improve this answer
1
  • Thanks for your reply. I'd prefer not to open up to entire AWS region like you said would mostly defeat the purpose :)
    – Aaron
    Jun 27, 2016 at 6:59
1

If you're just using a REST API, it will typically respond from the IP address that you contacted, otherwise the HTTP TCP connection wouldn't work. But if you're actually using a service that creates out-of-band TCP connections back to your original client IP, or some other IP, then the owners of that API need to expose the list of source IPs to you so you can whitelist them, there's really no better way around it.

Improve this answer
2
  • Unfortunately it's not REST API and don't see the service owners exposes the list of source IPs as this would take some work on their part. AWS doesn't really have an easy way to provide that information. Seems are best bet will be to move to cloud provider (AWS or GCP) and use something other than iptables :)
    – Aaron
    Jun 27, 2016 at 7:01
  • @Aaron it's not supposed to be easy - as far as AWS is concerned, that information is private to the owners of those instances, it has no business advertizing it to third parties because doing so may expose them to security vulnerabilities. Only the instance owners can decide to advertize their specific IP addresses to their users.
    – Josip Rodin
    Jun 27, 2016 at 11:53

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .