10

Scenario

I am calling Stack Exchange APIs to collect Stack Overflow Teams data for my organization. In order to call these APIs from the server where I would like to run it, I must first request firewall traffic to be allowed for the APIs from the server.

There is a mechanism we could use to whitelist the domain name, but this works by looking up the address of the domain periodically and updating firewall access. Unfortunately sometimes this leads to the application getting/using an IP address which hasn't been set up in the firewall yet, and getting blocked.

Possible Solution

We've seen other services/APIs provide CIDR ranges or files containing CIDR ranges, which we can then whitelist and dynamically refresh/use for this whitelisting.

Where I've looked

I've searched the Stack Exchange API documentation, the Stack Apps site, and the stackexchange-api tag on Stack Overflow for this, as well as several google searches (as it turns out these are seldom about Stack Exchange, but instead unrelated topics hosted on Stack Exchange).

Question

Is there a list of CIDR ranges that we can whitelist? Are they published anywhere? Is there another approach which is recommended that would allow me to access Stack Exchange APIs from behind a firewall?

9
  • Very similar question: meta.stackexchange.com/q/342944/282094
    – Rob
    Commented Feb 1, 2022 at 13:58
  • @Rob, Would you recommend I leverage that post somehow? My question is about IP address ranges, specifically, while that and the post it is marked as duplicating are not concerned with IP address ranges (342944's question asks in the title, but the body of the question explains that he's actually looking for "URLs" instead).
    – snydergd
    Commented Feb 1, 2022 at 15:51
  • IP addresses can change and may not be contiguous, while URLs remain more constant (less frequently changed); and the Firewall should cache the DNS, so it's not looked up each time only if there's a failure (404).
    – Rob
    Commented Feb 1, 2022 at 16:11
  • @Rob, in other cases we've found that large hosts like AWS and Microsoft block off public IP ranges for their servers and that these ranges may change as infrequently as monthly, with updates made available in a file we can periodically download, while DNS on the other hand is used for load balancing and will return a subset of these for load balancing, which may change fairly frequently. The problem is the firewall does in essence cache the IP, while the API client grabs a new one each time which may not yet be whitelisted.
    – snydergd
    Commented Feb 1, 2022 at 16:17
  • @Rob, see here for an example with Azure -- in this case it is weekly that they expect you to update the IP ranges, while DNS lookups have been found to vary throughout the day: microsoft.com/en-us/download/details.aspx?id=56519
    – snydergd
    Commented Feb 1, 2022 at 16:19
  • In keeping with the terminology you are using you would create FQDN Tags, not Service Tags. There is no specific API call to download a (your) "subscription", by following the "duplicate link" in the banner of the URL in my prior comment the closest you can get is: api.stackexchange.com/docs/sites - which you would massage with a script. Ref: docs.microsoft.com/en-us/azure/firewall/fqdn-tags computersolutionseast.com/blog/microsoft-azure/… docs.microsoft.com/en-us/azure/firewall/service-tags
    – Rob
    Commented Feb 1, 2022 at 16:48
  • For the second question, "another approach", that would probably be best answered on: superuser.com/questions
    – Rob
    Commented Feb 1, 2022 at 17:19
  • @Rob my question is whether official IP address ranges exist for StackExchange APIs, similar to the one provided my Microsoft for their services or if StackExchange recommends an alternative to using IP ranges which would accomplish the same goal. Are you speaking on behalf of StackExchange to say that no such IP ranges exist and/or that the recommendation of StackExchange is to try to keep up with DNS changes or couple it tightly with processing the outbound request as suggested by user 350567 (iBug says Reinstate Monica) below? Are you pointing out an issue with my question?
    – snydergd
    Commented Feb 1, 2022 at 17:25
  • I'm sticking with my first comment and I am not an employee.
    – Rob
    Commented Feb 1, 2022 at 17:48

1 Answer 1

3

If possible, you can set up an HTTP / TLS reverse proxy in a DMZ, configure domain (hostname) whitelist on that proxy (e.g. sniproxy or HAProxy) and then resolve api.stackexchange.com onto that proxy. This has the additional benefit that it works for any external service and doesn't require a published IP address range list (and therefore no need to update your firewall rules periodically).

I've been doing this in my organization for some time, though not for security purposes. We use Debian as our routers so managing these requires just Linux knowledge.

I'm just sharing my alternative solution here. Of course an official response is the right answer to this question.

1
  • 2
    Thank you for your thoughtful response. I'm hoping to hear an official response on the ip ranges, like you suggested, but am grateful for the alternative to consider, which nicely addresses the problem of keeping these ranges up to date.
    – snydergd
    Commented Jan 19, 2022 at 16:52

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .