We're using iptables and have our server rather locked down to only specific ports and IPs. Recently we have a requirement to open traffic to a third party service.
However, the third party service uses AWS with their backend instances behind an ELB. Of course the backend instance IPs can change at any moment as they are not static. At the same time Amazon cannot give a certain IP range.
Ideally if we had the IP range then we could add this to iptables rules however we don't have it AND we cannot add the URL (for obvious reasons that this is not possible in iptables).
I can run the dig command against the two main URL's (api and main site) which will give me most of the IPs but the problem is that it doesn't pick up ALL of the backend instances.
The only way I was able to find the IPs was watching the logs to see which were being blocked. Once I added rules for those IPs then it started working....
Is there anyway that this could be scripted effectively? Or must we scrap using iptables....or find another third party service?
In case it helps, service we are trying to use is Mollom:
www.mollom.com , rest.mollom.com