New to the community? Start here

WPMU DEV IP Ports List might be incorrect

The common list of IP addresses currently copy/pasted by staff is :

WPMU DEV site:
18.204.159.253
SmartCrawl:
165.227.66.214
45.55.78.242  
35.171.56.101 
WP Scan:
192.241.140.15
104.236.132.22
192.241.148.18
Uptime (AWS NAT):
34.196.51.17  
52.57.5.20

But in this thread Dmitris had these three for WP Scan:

192.241.140.159
104.236.132.222
192.241.148.185

It looks like in the list that gets republished those IPs are included without the last digit. : 15=159? 22=222? 18=185?

Or did Dimitris just have it wrong in that one post?

Also note in this post that Kris provided three additional IP addresses that aren’t referenced recently.

66.135.60.59
66.135.49.214
66.135.60.64

Nithin included those 66.* addresses in a note to me in 2018, and I’ve seen them elsewhere.

Kris also included this address which I don’t think I’ve seen anywhere else.

159.89.254.12

Now, I have about 8 sites that have not updated since Hub 2.0. And almost all of my sites are reporting a security/Defender issue even though the detail doesn’t show any. To be clear, there is always one more issue counted than is actually shown, so a site with 2 issue details shows as having 3 issues.

I dunno if those issues are due to inability for Dev to access my servers. I dunno if the issue might be that a few sites are still HTTP=80 while most are now HTTPS=443.

What ports should be open for those IPs? Please don’t say “all”.

I posted a request a couple years ago asking for a consistently updated and posted list of IPs.
I’ve asked for an API call on this site so that we can poll for the list of IPs so that we can auto-update our own tables.
I’ve noted that it would be nice if we could avoid the exact problem that it seems we’re having now, where the list of IPs changes and no one knows about it until we discover things haven’t been working right for a while.

I hate to be grumpy about this but every time you guys do something like this I have to go around to a bunch of servers to make manual changes. I can’t imagine the pain for someone who has real sites on a real large number of servers. I know I know, its my own stupid fault for not setting this up with Ansible or some other automation. But I just found out that something had turned off Automate on most of my sites, I think it was Hub 2.0. I could automate fixing that too but I thought that’s what Dev was doing for us.

PLEASE verify the list, post it in a freakin text file somewhere so that we can cURL it, or (hot new idea) put it in a WP Page, and keep it current so that we don’t need to see different lists in forum posts every few months.

Thank you for tolerating my obvious frustrations, as I tolerate a need to keep coming back to discuss the same pain points every few months.

Thu, 25 Jun 2020 10:00:58
  • Predrag Dubajic
    • Support

    Hi Tony G ,

    I had a look at the IPs that you mentioned and I was able to find an internal list at one place where the IPs were shared with cut last numbers for WP Scan so the IPs that you got from Dimitris are actually correct.

    To make things clear this is the full list with corrected IPs:

    WPMU DEV site
18.204.159.253

SmartCrawl
165.227.66.214
45.55.78.242  
35.171.56.101

WP Scan
192.241.140.159
104.236.132.222
192.241.148.185

Uptime
34.196.51.17
52.57.5.20

WP-Smush:
159.89.254.12

    It includes the correct WP Scan IPs that Dimitris provided you, as well as Smush IP that Kris shared.

    Last year we were making some changes in the IPs that are used and that’s why those 66.* IPs might be mentioned in some responses before that happened and while the switch was being done.
    This was done in order to also reduce the number of IPs and how often they’ve been changed, so it should be fixed now.

    We’ve already changed the internal list that had the mistake, updated most of the tickets that were mentioning them and I also pinged our team about including this in the docs where it can be all in one place and updated when and if needed.

    Thanks a lot for bringing this up so we can avoid further share of wrong IPs!

    Best regards,
    Predrag

  • Tony G
    • Mr. LetsFixTheWorld

    That’s great Predrag Dubajic – I’m glad this was productive.

    Perhaps in the future all Dev applications can proxy outbound requests through a single system and IP address. This could be setup like a DHCP / NAT where all systems have their own local address but they are exposed to the public as a single source. In a cloud environment this is especially helpful so that you can change the internal servers and IP addresses without affecting the front-facing address. I’m doing this now where I need to ensure that if my cloud email server dies that I can spin up a new instance without getting a new IP address – otherwise I’m subject to getting an IP from my service provider that could be blocked by random RBLs. You guys are hosting a cloud much like I am, you should use the resources.

    I also pinged our team about including this in the docs where it can be all in one place and updated when and if needed.

    It sounds like that will lead to a single web page somewhere with the current list, and when staff wants to provide the list they can link to that page rather than republishing the hard-coded list. That’s great.

    Again, strongly recommend and request for the list to be sourced from a publicly accessible text file or REST end-point. This will allow us to occasionally download the list programmatically so that we can auto-update our firewalls. Otherwise we will all need to manually parse a web page that will itself be subject to changes over time. PLEASE, let’s use technology in a way that is useful First, rather than just pressing buttons and dealing with ramifications later. If nothing else, ensure that the list is included in the HTML source in delimited form so that it can be extracted and easily parsed. For example, set a named DIV with the data, set visibility to false, and use JavaScript in the page to pull from that data to render it. We can do the same. We can ALL use the same datasource for whatever purpose is required.

    I am annoyed that I always feel a need to explain details like this. But if I don’t it looks like we’re always left with the same sorts of problems and non-solutions. So I provide the suggestions, hope that others will +1, and leave it to you to make your own decisions.

    Thanks as always.

  • Pawel Pela
    • Ex Staff

    Hello Tony G !

    Once again, we’re very sorry for the hassle here!

    We appreciate the explanation given by you on possible solutions for the future, especially that I personally do some data scraping/processing in my free time so I definitely understand the point here. We’re still thinking of a solution to this, maybe it will be what Predrag already mentioned, but I’ve also shared your latest reply with our developers to see what they think about the solution you’ve proposed. We’ll share feedback when the devs share their thoughts.

    Kind regards,
    Pawel

    • Adam
      • Support Gorilla

      Hi WFRM IT Staff

      Thanks for reporting it.

      May I ask you, however, if you have found only this single occurrence of that IP in logs or more of them – or is it that your site is constantly/always check from this IP?

      I’m asking because it seems that this IP actually shouldn’t show up there and it might mean that there’s some unexpected issue on our end. Our developers are checking that but it would help them.

      Let me know, please.

      Best regards,
      Adam

  • Tony G
    • Mr. LetsFixTheWorld

    I don’t see any web page on this topic. I am reconfiguring my subnet ingress rules, had to come back to find this thread, then scan down to see if there were any IPs not included in the verified list.

    C’mon guys, this is nuts. Just put up a freakin web page and implement a policy to keep it updated. Thanks.

      • Tony G
        • Mr. LetsFixTheWorld

        No more requests from the IP. I had it in my list of authorized IPs.

        I apologize that I jumped to the conclusion that the list was still not accurate.

        And I thank the team for adding the page – with the hope that there is a policy in a checklist somewhere to ensure it stays updated whenever there are internal changes. Since it’s in a repo owned by Patrick Cohen I trust it’s in good hands. :slight_smile:

        An example of how to use this:

        cd /some/path/repositories
git clone https://gist.github.com/d7d00f078d5656f26ad0b04464cf69cc.git ./WPMUDEV-IPs

        Now schedule with cron:
        cd /some/path/repositories/WPMUDEV-IPs ; git pull ; > /tmp/ip-change

        If the result of that is not “Already up to date.” then a change is required in the local firewall rules.

        The same can be done with wget/curl or other tooling.

        That is exactly what I hoped for in my OP here and in my note a couple years ago.
        THANK YOU SO MUCH!