<p>@Tensibai indicated that:</p>

<blockquote>
  <p>See: <a href="https://docs.aws.amazon.com/general/latest/gr/aws-ip-ranges.html" rel="nofollow noreferrer">https://docs.aws.amazon.com/general/latest/gr/aws-ip-ranges.html</a> if you
  really want to go this way, but there's quite large ranges, the
  52.216.0.0 is a /15 for us-east-1 and not a /16 btw { "ip_prefix": "52.216.0.0/15", "region": "us-east-1", "service": "S3" },</p>
</blockquote>

CC BY-SA 3.0
2018-04-27T16:13:07.583Z
2018-04-27T16:13:07.583Z
030
<p>I have denied all outgoing traffic, but need to allow some of them in order to allow the installation of certain software packages. One of such packages resides on github and that means that the ip range of <code>github-production-release-asset-2e65be.s3.amazonaws.com</code> has to be allowed, but after adding a couple of ip addresses it turns out that there are multiple ips.</p>

<p><strong>Attempt to solve the issue</strong></p>

<p><a href="https://api.github.com/meta" rel="nofollow noreferrer">https://api.github.com/meta</a> was found and returns the ips, but not those of AWS</p>

<p><strong>Current approach</strong></p>

<p>As a workaround I have allow outgoing connection to <code>52.216/16</code>, but that it is too open</p>

CC BY-SA 3.0
2018-03-04T23:33:40.260Z
IP filtering is quite 'old school' and absolutely not adapted... Targeting S3, take aws S3 endpoints IP at worst. Better use an artifact proxy like nexus or a proxy to filter on urls IMO
Tensibai
CC BY-SA 3.0
2018-03-05T10:09:44.327Z
See: https://docs.aws.amazon.com/general/latest/gr/aws-ip-ranges.html if you really want to go this way, but there's quite large ranges, the 52.216.0.0 is a /15 for us-east-1 and not a /16 btw {
      "ip_prefix": "52.216.0.0/15",
      "region": "us-east-1",
      "service": "S3"
    },
Tensibai
CC BY-SA 3.0
2018-03-05T13:32:40.447Z
Side question: outgoing from where ? internal network ?
Tensibai
<firewall>
How to get the ip range of github-production-release-asset-2e65be.s3.amazonaws.com?
030
# How to get the ip range of github-production-release-asset-2e65be.s3.amazonaws.com?

(Asked by: username_0 on 2018-03-04)

I have denied all outgoing traffic, but need to allow some of them in order to allow the installation of certain software packages. One of such packages resides on github and that means that the ip range of `github-production-release-asset-2e65be.s3.amazonaws.com` has to be allowed, but after adding a couple of ip addresses it turns out that there are multiple ips.

**Attempt to solve the issue**

<https://api.github.com/meta> was found and returns the ips, but not those of AWS

**Current approach**

As a workaround I have allow outgoing connection to `52.216/16`, but that it is too open

**Tags:** firewall

> **Comments:**
> **username_1**: IP filtering is quite 'old school' and absolutely not adapted... Targeting S3, take aws S3 endpoints IP at worst. Better use an artifact proxy like nexus or a proxy to filter on urls IMO  
> **username_1**: See: https://docs.aws.amazon.com/general/latest/gr/aws-ip-ranges.html if you really want to go this way, but there's quite large ranges, the 52.216.0.0 is a /15 for us-east-1 and not a /16 btw {       "ip_prefix": "52.216.0.0/15",       "region": "us-east-1",       "service": "S3"     },  
> **username_1**: Side question: outgoing from where ? internal network ?  

---

## 1 answers

### Answer by username_0 on 2018-04-27. Score: 0 | Accepted answer

@username_1 indicated that:

> See: <https://docs.aws.amazon.com/general/latest/gr/aws-ip-ranges.html> if you
> really want to go this way, but there's quite large ranges, the
> 52.216.0.0 is a /15 for us-east-1 and not a /16 btw { "ip\_prefix": "52.216.0.0/15", "region": "us-east-1", "service": "S3" },


---

