I want to set my firewall to only allow HTTP connections that originate from Apps Script. My Google Spreadsheets project uses URLFetch make queries back to my server. For development, that "server" is just my desktop at home. To allow that, I had to set a rule in the firewall to allow TCP on port 80. Restricting source address is never a substitute for real security, but it would block most of the scripts that periodically scan my IP for IIS/Apache vulnerabilities. So far, the legitimate connections are coming from Presumably, that could change at any time. I can't get reverse DNS on that (i.e., "host") so I can't even do much weaker programmatic filtering.

Is there a known IP address range that Apps Script sends URLFetch connects from?

Alternate suggestions are also welcome. Unfortunately, App Engine won't work. It's not compatible with my application.

4 Answers 4

4 - - - - - - - - - -

Source: https://developers.google.com/apps-script/jdbc#accessing


The second line in the top part of the documentation for UrlFetchApp tells you how to get the IP addresses to whitelist.


Requests made using this service originate from a set pool of IP ranges. You can look up the full list of IP addresses if you need to whitelist or approve these requests.


Here's my list. Most are from ionFish's list but some I've gleaned from web server log files. It's probably still incomplete though.

I used the two lists [0] from google to build a list. You don't want their public cloud IPs so it seems you'll need to subtract public cloud IPs from their total IP list. I used the program net-consolidator to do the subtracting. I don't know how good the python program is. This is my first time using it.

[0] https://support.google.com/a/answer/10026322

Reference : https://developers.google.com/apps-script/reference/url-fetch/url-fetch-app


curl -s https://www.gstatic.com/ipranges/goog.txt > full
curl -s https://www.gstatic.com/ipranges/cloud.json > subtract.json
jq '.prefixes[].ipv4Prefix' subtract.json > subtract.quote
cat subtract.quote  | sed 's/"//g'  |grep -v nul > subtract

git clone https://github.com/TKCERT/net-consolidator

python3 net-consolidator/net-consolidator.py -f full -s subtract

Which gave me this list. I didn't actually verify the accuracy of this generated list.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.