What IP address range do URLFetch queries come from?

Question

I want to set my firewall to only allow HTTP connections that originate from Apps Script. My Google Spreadsheets project uses URLFetch make queries back to my server. For development, that "server" is just my desktop at home. To allow that, I had to set a rule in the firewall to allow TCP on port 80. Restricting source address is never a substitute for real security, but it would block most of the scripts that periodically scan my IP for IIS/Apache vulnerabilities. So far, the legitimate connections are coming from 66.249.85.66. Presumably, that could change at any time. I can't get reverse DNS on that (i.e., "host 66.249.85.66") so I can't even do much weaker programmatic filtering.

Is there a known IP address range that Apps Script sends URLFetch connects from?

Alternate suggestions are also welcome. Unfortunately, App Engine won't work. It's not compatible with my application.

Answer 1

216.239.32.0 - 216.239.63.255
64.233.160.0 - 64.233.191.255
66.249.80.0 - 66.249.95.255
72.14.192.0 - 72.14.255.255
209.85.128.0 - 209.85.255.255
66.102.0.0 - 66.102.15.255
74.125.0.0 - 74.125.255.255
64.18.0.0 - 64.18.15.255
207.126.144.0 - 207.126.159.255
173.194.0.0 - 173.194.255.255

Source: https://developers.google.com/apps-script/jdbc#accessing

Answer 2

The second line in the top part of the documentation for UrlFetchApp tells you how to get the IP addresses to whitelist.

https://developers.google.com/apps-script/reference/url-fetch/url-fetch-app

Requests made using this service originate from a set pool of IP ranges. You can look up the full list of IP addresses if you need to whitelist or approve these requests.

Answer 3

Here's my list. Most are from ionFish's list but some I've gleaned from web server log files. It's probably still incomplete though.

107.178.192.138
107.178.192.142
107.178.192.146
107.178.192.85-107.178.192.87
107.178.224.10
107.178.224.12
107.178.224.14
173.194.0.0-173.194.255.255
207.126.144.0-207.126.159.255
209.85.128.0-209.85.255.255
216.239.32.0-216.239.63.255
64.18.0.0-64.18.15.255
64.233.160.0-64.233.191.255
66.102.0.0-66.102.15.255
66.249.80.0-66.249.95.255
72.14.192.0-72.14.255.255
74.125.0.0-74.125.255.255

Answer 4

I used the two lists [0] from google to build a list. You don't want their public cloud IPs so it seems you'll need to subtract public cloud IPs from their total IP list. I used the program net-consolidator to do the subtracting. I don't know how good the python program is. This is my first time using it.

[0] https://support.google.com/a/answer/10026322

Reference : https://developers.google.com/apps-script/reference/url-fetch/url-fetch-app

Commands:

curl -s https://www.gstatic.com/ipranges/goog.txt > full
curl -s https://www.gstatic.com/ipranges/cloud.json > subtract.json
jq '.prefixes[].ipv4Prefix' subtract.json > subtract.quote
cat subtract.quote  | sed 's/"//g'  |grep -v nul > subtract

git clone https://github.com/TKCERT/net-consolidator

python3 net-consolidator/net-consolidator.py -f full -s subtract

Which gave me this list. I didn't actually verify the accuracy of this generated list.

8.8.4.0/24
8.8.8.0/24
8.35.200.0/21
34.64.0.0/18
34.96.0.0/18
34.98.0.0/18
34.98.136.0/21
34.98.144.0/20
34.98.160.0/19
34.98.192.0/18
34.99.0.0/16
34.100.0.0/17
34.101.0.0/20
34.101.16.0/23
34.101.19.0/24
34.101.28.0/22
34.101.32.0/19
34.103.0.0/16
34.104.0.0/20
34.104.16.0/21
34.104.24.0/23
34.104.26.0/24
34.104.28.0/22
34.104.32.0/20
34.104.48.0/24
34.104.53.0/24
34.104.54.0/23
34.104.56.0/23
34.109.0.0/16
34.110.0.0/17
34.112.0.0/14
34.116.8.0/21
34.116.16.0/20
34.116.32.0/19
34.118.128.0/17
34.119.0.0/16
34.124.64.0/19
34.124.96.0/20
34.126.0.0/18
34.126.224.0/19
34.127.128.0/19
34.127.160.0/20
34.127.176.0/24
34.127.181.0/24
34.127.182.0/23
34.127.184.0/23
34.127.192.0/18
34.128.0.0/16
34.142.128.0/17
34.143.0.0/16
34.144.0.0/16
34.152.64.0/18
34.152.128.0/17
34.153.0.0/16
34.154.0.0/15
34.156.0.0/16
34.157.8.0/21
34.157.32.0/22
34.157.44.0/22
34.157.80.0/20
34.157.96.0/19
34.157.136.0/21
34.157.160.0/22
34.157.172.0/22
34.157.208.0/20
34.157.224.0/19
34.158.0.0/16
34.160.0.0/13
34.174.0.0/15
34.177.0.0/16
34.178.0.0/15
34.180.0.0/14
34.184.0.0/13
35.187.128.0/20
35.190.96.0/20
35.190.240.0/20
35.191.0.0/16
35.199.128.0/20
35.201.32.0/21
35.201.40.0/24
35.201.42.0/23
35.201.44.0/22
35.201.48.0/20
35.203.192.0/20
35.203.208.0/23
35.203.220.0/22
35.203.224.0/21
35.203.240.0/20
35.206.0.0/19
35.218.0.0/16
35.219.192.0/18
35.220.28.0/23
35.220.30.0/24
35.229.0.0/20
35.230.192.0/19
35.230.224.0/20
35.235.128.0/18
35.235.192.0/20
35.235.208.0/21
35.235.224.0/19
35.242.28.0/23
35.242.30.0/24
35.243.16.0/20
35.243.48.0/21
64.15.112.0/20
64.233.160.0/19
66.102.0.0/20
66.249.64.0/19
70.32.128.0/19
72.14.192.0/18
74.114.24.0/21
74.125.0.0/16
104.154.0.0/20
104.154.112.0/24
104.154.122.0/23
104.154.124.0/22
104.155.240.0/20
104.196.64.0/24
104.196.72.0/21
104.196.80.0/20
104.199.64.0/23
104.199.240.0/23
104.237.160.0/19
107.178.192.0/20
107.178.224.0/20
108.170.192.0/18
108.177.0.0/17
130.211.0.0/22
136.112.0.0/12
142.250.0.0/15
146.148.0.0/23
172.110.32.0/21
172.217.0.0/16
172.253.0.0/16
173.194.0.0/16
192.178.0.0/15
193.186.4.0/24
199.36.154.0/23
199.36.156.0/24
199.192.112.0/23
199.192.114.0/24
199.223.237.0/24
199.223.238.0/23
207.223.160.0/20
208.65.152.0/22
208.68.108.0/22
208.81.188.0/22
208.117.224.0/19
209.85.128.0/17
216.58.192.0/19
216.73.80.0/20
216.239.32.0/19