Skip to main content

How can we help you?

Search

help Knowledge Base
forum Community
checklist Release Notes
event Events

URLs and IP address ranges for DNSFilter deployments

Minetta Gould
  • Updated

    In this article

This article contains the IP addresses, URLs, and ports required for DNSFilter deployments to properly function. This is meant to be a starting point for allowing required traffic and is not an all-inclusive list; some features and functionality will require other addresses to be accessible.

DNSFilter requires connectivity to the Internet. The following table lists the addresses and ports that should be reachable for customers using DNSFilter plans, including legacy Whitelabel customers.

Topic Addresses Ports
Anycast IPv4 addresses for DNS queries, including DNS-over-TLS 103.247.36.36
103.247.37.37		 UDP: 53, 5353
TCP: 53, 5353
TCP: 853, 443
Anycast IPv4 addresses for DNS queries (NAT IPs) 103.247.36.101 - 106 103.247.37.101 - 106 UDP: 53, 5353
TCP: 53, 5353
Anycast IPv4 addresses for DNS queries with DNSSEC support 103.247.36.9 103.247.37.9 UDP: 53, 5353
TCP: 53, 5353
AnyCast for DNS PreCheck IPv4 addresses 103.85.42.42
103.85.43.43		  
Anycast IPv6 addresses for DNS queries  2402:5c40:5c40::3636
2402:5c40:5c41::3737		 UDP: 53, 5353
TCP: 53, 5353
TCP: 853, 443
Anycast IPv6 address for DNS queries (NAT IPs) 2402:5c40:5c40::3601 - 3607
2402:5c40:5c40::3701 - 3707		 UDP: 53, 5353
TCP: 53, 5353
AnyCast for DNS PreCheck IPv6 addresses 2402:5C40:5C42::4242
2402:5C40:5C43::4343		  
Data Export IP addresses 54.156.216.109 44.221.154.204 44.217.253.16  

Roaming Client & Relay loopback listener

  • If these addresses are not available, the Roaming Client uses the next available loopback address
  • Windows agent v3.0 and higher does not bind to fixed loopback addresses or port 53 in Transparent Proxy (DNS PreCheck) mode
 127.0.0.1-127.0.0.4 (loopback address pool)
127.0.0.2 (default for Windows loopback mode)
127.0.0.1 (macOS 1.x legacy default)		 UDP: 53
Relay IP address Class A range  10.0.0.0 - 10.255.255.255
Large networks (8 network bits / 24 host bits)		  
Relay IP address Class B range 172.16.0.0 - 172.31.255.255
Medium networks (16 network bits / 16 host bits)		  
Relay IP address Class C range 192.168.0.0 - 192.168.255.255
Small networks (24 network bits / 8 host bits)		  
Roaming Client & Relay auto-update downloads.dnsfilter.com TCP: 443 (HTTPS)
Roaming Client & Relay API api.dnsfilter.com TCP: 443 (HTTPS)

Roaming Client & Relay API for legacy Whitelabel deployments

  • Use the custom URL obtained from Support while setting up legacy Whitelabel

 api.<----------->.com TCP: 443 (HTTPS)

macOS Roaming Client DoH fallback (v2.4.6 and higher)

  • Exclude from TLS inspection. If TLS inspection intercepts this hostname, DoH fallback fails silently

doh.dnsfilter.com

TCP: 443 (HTTPS)
SecureTransit gateway IP addresses (for third-party security tool allowlisting) View full list of gateway IP addresses  
DNSFilter Block Page 45.54.28.9 -> .18  
DNSFilter Unknown Page 45.253.131.226
2607:f740:100:108::1400		  
Was this article helpful?
3 out of 12 found this helpful
Return to top

Comments

0 comments

Please sign in to leave a comment.