Determine IP addresses and / or hostnames that need to be accessible from CiviCRM and payments-wiki for FROPs Allowlist.
Description
Description
| Status | Subtype | Assigned | Task | ||
|---|---|---|---|---|---|
| Open | None | T364501 Gravy Integration | |||
| Resolved | Dwisehaupt | T370319 Network configuration for Gravy integration | |||
| Restricted Task |
Event Timeline
Comment Actions
Ok. Looks like they are using google cloud computing for those endpoints. I'll have to check our config on the pfw, but this may necessitate moving from a strict allow list to a dns based iptables list. We have been able to avoid that for the payments role at this point.
Comment Actions
IP addresses from gr4vy.
API:
- 34.36.3.1
- 34.149.116.58
Webhook server:
- 34.83.124.27
Going to use IP mappings for now instead of dns_to_ipset since they state that the ips are stable and shouldn't change.
Comment Actions
Iptables rules updated and applied to civicrm, payments, and payments_listener role for the API addresses. The frdev role did not have the other payment gateways rules so I'm not certain we need it on that role. Correct me if I'm wrong.
Also, the webhook server should be the ip that contacts our frpig hosts. We don't restrict access from the external sources in that manner so we should be ok with that.
PFW changes to follow.
Comment Actions
PFW changes added to the repo and pushed to the PFWs for application Network task tracked in T370481.