What IP address range do URLFetch queries come from?

Question

I want to set my firewall to only allow HTTP connections that originate from Apps Script. My Google Spreadsheets project uses URLFetch make queries back to my server. For development, that "server" is just my desktop at home. To allow that, I had to set a rule in the firewall to allow TCP on port 80. Restricting source address is never a substitute for real security, but it would block most of the scripts that periodically scan my IP for IIS/Apache vulnerabilities. So far, the legitimate connections are coming from 66.249.85.66. Presumably, that could change at any time. I can't get reverse DNS on that (i.e., "host 66.249.85.66") so I can't even do much weaker programmatic filtering.

Is there a known IP address range that Apps Script sends URLFetch connects from?

Alternate suggestions are also welcome. Unfortunately, App Engine won't work. It's not compatible with my application.

Answer 1

216.239.32.0 - 216.239.63.255
64.233.160.0 - 64.233.191.255
66.249.80.0 - 66.249.95.255
72.14.192.0 - 72.14.255.255
209.85.128.0 - 209.85.255.255
66.102.0.0 - 66.102.15.255
74.125.0.0 - 74.125.255.255
64.18.0.0 - 64.18.15.255
207.126.144.0 - 207.126.159.255
173.194.0.0 - 173.194.255.255

Source: https://developers.google.com/apps-script/jdbc#accessing

Answer 2

Here's my list. Most are from ionFish's list but some I've gleaned from web server log files. It's probably still incomplete though.

107.178.192.138
107.178.192.142
107.178.192.146
107.178.192.85-107.178.192.87
107.178.224.10
107.178.224.12
107.178.224.14
173.194.0.0-173.194.255.255
207.126.144.0-207.126.159.255
209.85.128.0-209.85.255.255
216.239.32.0-216.239.63.255
64.18.0.0-64.18.15.255
64.233.160.0-64.233.191.255
66.102.0.0-66.102.15.255
66.249.80.0-66.249.95.255
72.14.192.0-72.14.255.255
74.125.0.0-74.125.255.255

Answer 3

The second line in the top part of the documentation for UrlFetchApp tells you how to get the IP addresses to whitelist.

https://developers.google.com/apps-script/reference/url-fetch/url-fetch-app

Requests made using this service originate from a set pool of IP ranges. You can look up the full list of IP addresses if you need to whitelist or approve these requests.