[研究] Google reCaptcha 在 Firewall 要開放的 IP

[研究] Google reCaptcha 在 Firewall 要開放的 IP

2019-04-08

若要使用 Google reCaptcha，Firewall 要開放

根據這篇
recaptcha - FirewallsAndRecaptcha.wiki
https://code.google.com/archive/p/recaptcha/wikis/FirewallsAndRecaptcha.wiki

recaptcha - FirewallsAndRecaptcha.wiki If you have firewall ACLs, you must allow access to all all Google IP addresses. We strongly recommend that you either a) allow outbound access to all IPs on port 80 or b) use a proxy server to do access control based on host name. The reCAPTCHA servers can be located on any IP address owned by Google. While we can not provide official support for IP Address-based ACLs, Google's public IP space can be found by issuing the following command from a Linux/Unix box: dig -t TXT _netblocks.google.com The result right now is: ip4:216.239.32.0/19 ip4:64.233.160.0/19 ip4:66.249.80.0/20 ip4:72.14.192.0/18 ip4:209.85.128.0/17 ip4:66.102.0.0/20 ip4:74.125.0.0/16 ip4:64.18.0.0/20 ip4:207.126.144.0/20 ip4:173.194.0.0/16 but you should periodically check this, as these blocks may occasionally change.

排序整理一下

64.18.0.0/20 64.233.160.0/19 66.102.0.0/20 66.249.80.0/20 72.14.192.0/18 74.125.0.0/16 173.194.0.0/16 207.126.144.0/20 209.85.128.0/17 216.239.32.0/19

因為 Windows 預設沒有 dig 程式，找了一下 dig for Windows，是在 bind 程式中

https://www.bind9.net/download
官方很多連結死了

這裡活的
ftp://ftp.iij.ad.jp/pub/network/isc/bind9/

D:\SOFTWARE\Bind 9\BIND9.9.9.x64>dig -t TXT _netblocks.google.com ; <<>> DiG 9.9.9 <<>> -t TXT _netblocks.google.com ;; global options: +cmd ;; Got answer: ;; ->>HEADER<<- opcode: QUERY, status: NOERROR, id: 1164 ;; flags: qr rd ra; QUERY: 1, ANSWER: 1, AUTHORITY: 0, ADDITIONAL: 1 ;; OPT PSEUDOSECTION: ; EDNS: version: 0, flags:; udp: 3072 ;; QUESTION SECTION: ;_netblocks.google.com.         IN      TXT ;; ANSWER SECTION: _netblocks.google.com.  3600    IN      TXT     "v=spf1 ip4:35.190.247.0/24 ip4:64.233.160.0/19 ip4:66.102.0.0/20 ip4:66.249.80.0/20 ip4:72.14.192.0/18 ip4:74.125.0.0/16 ip4:108.177.8.0/21 ip4:173.194.0.0/16 ip4:209.85.128.0/17 ip4:216.58.192.0/19 ip4:216.239.32.0/19 ~all" ;; Query time: 7 msec ;; SERVER: 168.95.1.1#53(168.95.1.1) ;; WHEN: Mon Apr 08 13:56:43 ￥x￥_?D·CRE?! 2019 ;; MSG SIZE  rcvd: 286 D:\SOFTWARE\Bind 9\BIND9.9.9.x64>

目前名單

35.190.247.0/24 64.233.160.0/19 66.102.0.0/20 66.249.80.0/20 72.14.192.0/18 74.125.0.0/16 108.177.8.0/21 173.194.0.0/16 209.85.128.0/17 216.58.192.0/19 216.239.32.0/19

新舊名單合併

35.190.247.0/24 64.18.0.0/20 64.233.160.0/19 66.102.0.0/20 66.249.80.0/20 72.14.192.0/18 74.125.0.0/16 108.177.8.0/21 173.194.0.0/16 207.126.144.0/20 209.85.128.0/17 216.58.192.0/19 216.239.32.0/19

(完)