Whitelisting JetPack With Cloudflare Firewall Rules

  • Resolved Jixxer

    (@jixxer)


    2 years, 8 months ago

    I am trying to correctly whitelist JetPack within our Cloudflare account so that JetPack can monitor our active sites.

    The issue it that we setup some Firewall rules on Cloudflare to force people from certain countries to pass a challenge before gaining access to our sites.

    Unfortunately one of the countries that we need to prevent direct access to our sites from is the United States because there are too many malicious scripts sending queries to our sites from servers in the USA.

    But as soon as we put the Firewall Rule in place to challenge IP addresses from the USA then JetPack is no longer able to monitor our sites.

    So we created an additional rule to allow the following IP ranges from the USA to pass though and this seems to allow JetPack to continue to monitor our sites correctly:

    192.0.64.0/24 192.0.65.0/24 192.0.66.0/24 192.0.67.0/24 192.0.68.0/24 192.0.69.0/24 192.0.70.0/24 192.0.71.0/24 192.0.72.0/24 192.0.73.0/24 192.0.74.0/24 192.0.75.0/24 192.0.76.0/24 192.0.77.0/24 192.0.78.0/24 192.0.79.0/24 192.0.80.0/24 192.0.81.0/24 192.0.82.0/24 192.0.83.0/24 192.0.84.0/24 192.0.85.0/24 192.0.86.0/24 192.0.87.0/24 192.0.88.0/24 192.0.89.0/24 192.0.90.0/24 192.0.91.0/24 192.0.92.0/24 192.0.93.0/24 192.0.94.0/24 192.0.95.0/24 192.0.96.0/24 192.0.97.0/24 192.0.98.0/24 192.0.99.0/24 192.0.100.0/24 192.0.101.0/24 192.0.102.0/24 192.0.103.0/24 192.0.104.0/24 192.0.105.0/24 192.0.106.0/24 192.0.107.0/24 192.0.108.0/24 192.0.109.0/24 192.0.110.0/24 192.0.111.0/24 192.0.112.0/24 192.0.113.0/24 192.0.114.0/24 192.0.115.0/24 192.0.116.0/24 192.0.117.0/24 192.0.118.0/24 192.0.119.0/24 192.0.120.0/24 192.0.121.0/24 192.0.122.0/24 192.0.123.0/24 192.0.124.0/24 192.0.125.0/24 192.0.126.0/24 192.0.127.0/24 122.248.245.244/32 54.217.201.243/32 54.232.116.4/32 192.0.80.0/20 192.0.96.0/20 192.0.112.0/20 195.234.108.0/22

    But is there a way to whitelist JetPack without whitelisting of all these IP ranges?

    We don’t feel secure having whitelisted so many IP address ranges because we assume other servers are also using these IP addresses and not just JetPack.

    Or is there any way we can shrink this list down at least, but so that JetPack doesn’t get blocked from our sites?

    We also whitelisted the jetmon/1.0 useragent, but that only seems to cover the part of JetPack which monitors if a site is online, but doesn’t cover all of JetPack’s queries needed to monitor site stats, etc.

    Thanks…

Viewing 8 replies - 1 through 8 (of 8 total)
  • Plugin Contributor Stef (a11n)

    (@erania-pinnera)

    Hi @jixxer,

    But is there a way to whitelist JetPack without whitelisting of all these IP ranges?
    Or is there any way we can shrink this list down at least, but so that JetPack doesn’t get blocked from our sites?

    I don’t think there is a workaround to achieve both of your requests, I’m afraid.

    Do you have our Protect feature enabled at all? There is also other third-party firewall software you may want to try too which are compatible with Jetpack (hence allowing you to keep using our plugin).

    Thread Starter Jixxer

    (@jixxer)

    Hi @erania-pinnera – Thank you for the information. I think we will just keep the setup as it is for now and see how it goes rather than switching to Jetpack protect.

    What is a bit confusing though is that list of Jetpack IP addresses I posted came from the following link:

    https://jetpack.com/support/how-to-add-jetpack-ips-allowlist/

    Under Cloudflare is gives the list of IP ranges from 192.0.64 to 192.0.127 that I posted, but then there is another link which says it can be used as an alternative text list for Cloudflare as well here: https://jetpack.com/ips-v4.txt

    I don’t understand the difference between the two lists so I just combined them. But the way the instructions are given it sounds like one can use either list and doesn’t need both. So it is confusing why the list on that website and the link to the text file don’t contain the same lists of IP addresses?

    Thanks…

    Plugin Support lastsplash (a11n)

    (@lastsplash)

    Hi @jixxer –

    I put in a request to have this clarified in our documentation, thanks for bringing it to our attention.

    Since you are no longer using Jetpack Protect, I am going to go ahead and close this thread.

    If you have questions in the future, feel free to open a new thread.

    @jixxer , I am currently dealing with Jetpack no saving settings in another support thread here. Before that issue I was not able to connect to Jetpack. I solved this by adding Jetpack ASN number 2635 in my Cloudflare firewall Rules as: ALLOW

    With that I was able to connect Jetpack plugin to my WP install.

    These instructions I also found from the post url you provided above.
    https://jetpack.com/support/how-to-add-jetpack-ips-allowlist/

    Hope this helps.

    Thread Starter Jixxer

    (@jixxer)

    Hi @lastsplash – Thank you. Can you please clarify if both lists of IP addresses are needed to allow on Cloudflare and how they differ? I am referring to the list on the link I provided above and the second list I also on the link I provided above to the link to the ips-v4.txt file.

    Hi @shirtguy72 – Thank you. Originally I did try the ASN number 2635 as allow in Cloudflare, without using any list of IP addresses, but Jetpack was still unable to access my sites. I just tried it again though with just the ASN number as you suggested and it worked. So I will use that now and see how it goes. Thank you again.

    • This reply was modified 2 years, 8 months ago by Jixxer.

    No worries @jixxer , hope it works out for you.
    Uninstalled the plugin yesterday because it wouldn’t save changes and when I logged back in this morning I had over 9K expired transients left by Jetpack. I restored from a backup I took just before installing the plugin and will NOT be reinstalling.

    Plugin Support lastsplash (a11n)

    (@lastsplash)

    Hi @jixxer –

    I’m reaching out to check on the difference between the two lists.

    Plugin Support lastsplash (a11n)

    (@lastsplash)

    Hi @jixxer –

    This was an error in how the page was formatted. You only need to either list the IPs under the “Using Jetpack with Cloudflare and/or Sucuri” section or use the ASN 2635.

    Thanks for bringing the discrepancy to our attention.

Viewing 8 replies - 1 through 8 (of 8 total)
  • The topic ‘Whitelisting JetPack With Cloudflare Firewall Rules’ is closed to new replies.