Configuring your firewall to accept Cloudsmith and AWS CDN IP ranges
If you're using a firewall to secure your network and need to ensure uninterrupted access to Cloudsmith services or AWS CloudFront content, follow this guide to properly allowlist the necessary IP addresses.
Understanding traffic types
When working with Cloudsmith, your network will handle two main types of traffic: inbound and outbound. See the following breakdown of what each means for your environment.
1. Configuring inbound traffic for Cloudsmith
Inbound traffic refers to connections initiated by Cloudsmith to your infrastructure. To ensure seamless access and functionality when using Cloudsmith, it is essential to configure inbound traffic correctly. This includes allowing traffic from specific IP ranges for caching, proxying, and internal upstream requests.
Examples of inbound traffic:
- Webhooks from Cloudsmith to notify your systems about events such as package uploads, syncs, or deletions.
- API callbacks or integrations where Cloudsmith sends data to your environment.
For inbound traffic, you should allow traffic from the following sources:
- Cloudsmith's NAT Gateway IPs.
- CloudFront's list of node IPs (as Cloudsmith fetches from the edge as well as its own IP ranges).
- Internal IPs (if you are proxying/caching packages to an internal upstream).
Blocked traffic causes failures
Not allowing these IPs may lead to failures in package retrieval, proxying, or upstream requests.
Cloudsmith NAT Gateway IPs (inbound)
Allow inbound traffic from the following Cloudsmith NAT Gateway IPs:
13.55.231.43
52.62.115.207
3.104.99.235
34.252.163.216
52.208.86.0
108.129.59.129
52.30.175.5
52.209.24.43
18.200.166.58
3.135.162.154
18.224.75.239
18.216.17.80
52.24.213.62
54.203.138.156
35.163.82.210
3.115.164.121
54.95.231.54
35.79.203.238
52.211.168.181
52.215.208.106
52.212.161.68
34.252.179.227
54.76.94.68Cloudsmith webhook IP ranges
To ensure secure delivery of webhook notifications, allowlist the following Cloudsmith origin IP addresses:
3.10.225.171
34.250.171.206
52.16.183.139
52.19.118.176CloudFront CDN traffic (inbound)
Since Cloudsmith's package distribution happens via AWS CloudFront, requests may originate from CloudFront node IPs. Additionally, when proxying/caching upstream requests, CloudFront may contact your internal upstream from its node IPs.
To fetch all CloudFront IPs globally, use:
curl -s https://ip-ranges.amazonaws.com/ip-ranges.json | jq -r '.prefixes[] | select(.service == "CLOUDFRONT") | .ip_prefix' | sort -nTo fetch CloudFront IPs for a specific AWS region, use:
curl -s https://ip-ranges.amazonaws.com/ip-ranges.json | jq -r '.prefixes[] | select(.service == "CLOUDFRONT" and .region == "REGION") | .ip_prefix' | sort -nReplace REGION with your AWS region, for example us-east-1 or eu-west-1.
CloudFront IPs change over time
These are AWS CloudFront IPs and are subject to change. You may want to monitor the ranges from time to time and update your list, or implement the
curlexample above as a cron job. You can also subscribe to AWS IP address range notifications to be alerted whenever the ranges change. For more details, see Subscribe to notifications in the Amazon VPC user guide.
HTTP methods for upstream proxying
When you configure upstream proxying in Cloudsmith, your upstream server must allow two primary HTTP methods for Cloudsmith to function correctly:
- GET: Cloudsmith uses the
GETmethod to fetch the actual package or artifact from your upstream server and deliver it to the end user's local machine when they initiate an installation. - HEAD: Cloudsmith uses the
HEADmethod to validate and cache the artifact. It's essential for "Proxy and Cache" mode, as it allows Cloudsmith to check for the artifact's existence using metadata without downloading the entire package. If theHEADmethod is not allowed, the package will still be delivered to the end user via aGETrequest, but Cloudsmith will be unable to cache it for future use.
2. Outbound traffic requirements
Outbound traffic refers to connections initiated by your infrastructure to Cloudsmith.
Examples of outbound traffic:
- Downloading packages from Cloudsmith or publishing packages to Cloudsmith.
- API requests from your systems to Cloudsmith's platform.
Required IP ranges for outbound traffic
AWS CloudFront (CDN) IP ranges are dynamic and updated by AWS. To fetch the latest ranges, use the following command:
curl -s https://ip-ranges.amazonaws.com/ip-ranges.json | jq -r '.prefixes[] | select(.service == "CLOUDFRONT") | .ip_prefix' | sort -nEnsure the CloudFront CIDR ranges returned by the command are allowed over HTTPS (443).
CloudFront IPs change over time
These are AWS CloudFront IPs and are subject to change. You may want to monitor the ranges from time to time and update your list, or implement the
curlexample above as a cron job. You can also subscribe to AWS IP address range notifications to be alerted whenever the ranges change. For more details, see Subscribe to notifications in the Amazon VPC user guide.
Why are these rules necessary?
Inbound:
- Cloudsmith fetches packages via CloudFront, meaning requests originate from multiple CloudFront node IPs.
- If you use internal upstream proxying, Cloudsmith may request packages from your upstream servers.
Outbound:
- Publishing and retrieving packages requires connectivity to Cloudsmith services.
- Proxying/mirroring requires access to upstream repositories.
Firewall and network security considerations
If your security policy does not permit allowlisting the full CloudFront range, or if you have strict outbound rules, please contact Cloudsmith Support for guidance.