# CircleCi Source IP

**URL:** <https://discuss.circleci.com/t/circleci-source-ip/1202>\
**Category:** Build Environment\
**Tags:** networking\
**Created:** [December 18, 2015, 6:21am UTC](https://discuss.circleci.com/t/circleci-source-ip/1202 "2015-12-18T06:21:02Z")\
**Posts on this page:** 15\
**Page:** 1

<div class="post-metadata">

**Author:** ![pavankumar9](https://avatars.discourse-cdn.com/v4/letter/p/bbce88/32.png) [@pavankumar9](https://discuss.circleci.com/u/pavankumar9)\
**Post date:** [December 18, 2015, 6:21am UTC](https://discuss.circleci.com/t/circleci-source-ip/1202/1 "2015-12-18T06:21:02Z")

</div>

Can you please let us know circle Ci public Ip? This is needed for setting up port forwarding to enable circle ci trigger automation execution on out private hosted servers.

---

<div class="post-metadata">

**Author:** ![levlaz](https://sea2.discourse-cdn.com/circleci/user_avatar/discuss.circleci.com/levlaz/32/36978_2.png) [@levlaz](https://discuss.circleci.com/u/levlaz)\
**Post date:** [December 22, 2015, 8:22am UTC](https://discuss.circleci.com/t/circleci-source-ip/1202/2 "2015-12-22T08:22:18Z")

</div>

Hi!

We deploy machines in US-East and US-West on AWS. There is no single IP address and there is no great way to predict where your builds will run. This means that you will need to whitelist the [entire ranges](http://docs.aws.amazon.com/general/latest/gr/aws-ip-ranges.html) for US-East and US-West.

---

<div class="post-metadata">

**Author:** ![mcaramello](https://sea2.discourse-cdn.com/circleci/user_avatar/discuss.circleci.com/mcaramello/32/856_2.png) [@mcaramello](https://discuss.circleci.com/u/mcaramello)\
**Post date:** [December 22, 2015, 10:53pm UTC](https://discuss.circleci.com/t/circleci-source-ip/1202/3 "2015-12-22T22:53:54Z")

</div>

We are running system integration tests against our production service as well. In that context opening up the whole IP range is unacceptable.  
We are currently unable to run said tests and have to do so manually from a developer’s machine.  
Is there any plan on providing a specific range of IPs or alternatively the security group?

---

<div class="post-metadata">

**Author:** ![levlaz](https://sea2.discourse-cdn.com/circleci/user_avatar/discuss.circleci.com/levlaz/32/36978_2.png) [@levlaz](https://discuss.circleci.com/u/levlaz)\
**Post date:** [December 23, 2015, 7:28pm UTC](https://discuss.circleci.com/t/circleci-source-ip/1202/4 "2015-12-23T19:28:55Z")

</div>

We do not have any immediate plans for this, but if this would be useful for you I would encourage you to add a feature request here on this site.

---

<div class="post-metadata">

**Author:** ![chunkaiw](https://sea2.discourse-cdn.com/circleci/user_avatar/discuss.circleci.com/chunkaiw/32/9265_2.png) [@chunkaiw](https://discuss.circleci.com/u/chunkaiw)\
**Post date:** [February 1, 2016, 12:45am UTC](https://discuss.circleci.com/t/circleci-source-ip/1202/5 "2016-02-01T00:45:09Z")

</div>

i’m confused. it used to be security groups right? what happened to that? wasn’t it 183081753049/sg-f98a8290?

---

<div class="post-metadata">

**Author:** ![smiller171](https://sea2.discourse-cdn.com/circleci/user_avatar/discuss.circleci.com/smiller171/32/2906_2.png) [@smiller171](https://discuss.circleci.com/u/smiller171)\
**Post date:** [May 12, 2016, 4:33pm UTC](https://discuss.circleci.com/t/circleci-source-ip/1202/6 "2016-05-12T16:33:25Z")

</div>

That only works with EC2-classic, which isn’t available to new customers, and it’s likely that CircleCI has migrated to VPC themselves.

---

<div class="post-metadata">

**Author:** ![sebask](https://sea2.discourse-cdn.com/circleci/user_avatar/discuss.circleci.com/sebask/32/14348_2.png) [@sebask](https://discuss.circleci.com/u/sebask)\
**Post date:** [October 7, 2016, 8:30am UTC](https://discuss.circleci.com/t/circleci-source-ip/1202/7 "2016-10-07T08:30:11Z")

</div>

Are the AWS IP ranges used by CircleCI still US-East and US-West? There used to be more info at [https://circleci.com/docs/ec2ip-and-security-group](https://circleci.com/docs/ec2ip-and-security-group), but that page is down.

---

<div class="post-metadata">

**Author:** ![hernandesbsousa](https://sea2.discourse-cdn.com/circleci/user_avatar/discuss.circleci.com/hernandesbsousa/32/14518_2.png) [@hernandesbsousa](https://discuss.circleci.com/u/hernandesbsousa)\
**Post date:** [November 9, 2016, 3:09pm UTC](https://discuss.circleci.com/t/circleci-source-ip/1202/8 "2016-11-09T15:09:00Z")

</div>

Is this still the case or are you guys using a fixed range now?

---

<div class="post-metadata">

**Author:** ![drazisil](https://sea2.discourse-cdn.com/circleci/user_avatar/discuss.circleci.com/drazisil/32/24029_2.png) [@drazisil](https://discuss.circleci.com/u/drazisil)\
**Post date:** [December 2, 2016, 5:58pm UTC](https://discuss.circleci.com/t/circleci-source-ip/1202/9 "2016-12-02T17:58:07Z")

</div>

Yes they are. No way to limit down further.

---

<div class="post-metadata">

**Author:** ![chipgofer](https://avatars.discourse-cdn.com/v4/letter/c/f14d63/32.png) [@chipgofer](https://discuss.circleci.com/u/chipgofer)\
**Post date:** [January 10, 2017, 11:53pm UTC](https://discuss.circleci.com/t/circleci-source-ip/1202/10 "2017-01-10T23:53:34Z")

</div>

A solution we used was to add a custom script to run in the beginning that gets the public ip address of the current box and calls the AWS CLI to add an inbound security rule on the fly. Then we do the opposite and remove that rule at the end of the script. Here’s the sample code:

**To Remove the Old Values**  
_this removes all existing rules - adjust if you need to keep some_

```
current_security_group=$(aws ec2 describe-security-groups --region us-west-2 --group-id sg-e747959f)
ip_count=$(echo ${current_security_group} | jq -r '.SecurityGroups[0].IpPermissions | length')
if [${ip_count} > 0]; then
    for (( n=0; n < $ip_count; n++ ))
    do
	this_port=$(echo ${current_security_group} | jq -r ".SecurityGroups[0].IpPermissions[${n}].FromPort")
	cidr_count=$(echo ${current_security_group} | jq -r ".SecurityGroups[0].IpPermissions[${n}].IpRanges | length")
	for (( c=0; c < $cidr_count; c++ ))
	do
	    this_cidr=$(echo ${current_security_group} | jq -r ".SecurityGroups[0].IpPermissions[${n}].IpRanges[${c}].CidrIp")
	    aws ec2 revoke-security-group-ingress --region us-west-2 --group-id sg-e747959f --protocol tcp --port ${this_port} --cidr ${this_cidr}
	done
    done
fi

```

**To Add the Current Public IP Address**  
_ip-permissions is an array so add more ports as needed_

```
public_ip_address=$(wget -qO- http://checkip.amazonaws.com)
echo "this computers public ip address is $public_ip_address"
aws ec2 authorize-security-group-ingress --region <YOUR_REGION> --group-id <YOUR_SECURITY_GROUP_ID> --ip-permissions "[{\"IpProtocol\": \"tcp\", \"FromPort\": <YOUR_PORT_YOU_NEED_OPEN>, \"ToPort\": <YOUR_PORT_YOU_NEED_OPEN>, \"IpRanges\": [{\"CidrIp\": \"${public_ip_address}/32\"}]}]"
```

---

<div class="post-metadata">

**Author:** ![sebask](https://sea2.discourse-cdn.com/circleci/user_avatar/discuss.circleci.com/sebask/32/14348_2.png) [@sebask](https://discuss.circleci.com/u/sebask)\
**Post date:** [February 22, 2017, 11:53am UTC](https://discuss.circleci.com/t/circleci-source-ip/1202/11 "2017-02-22T11:53:28Z")

</div>

I currently have whitelisted an enormous list of IP’s from the regions `us-east-1`, `us-west-1`, `us-west-2`. Which isn’t optimal at all. Still deployments failed. Seems my CI box uses an IP not listed in these regions.

What could be up? Are there other regions added recently?

---

<div class="post-metadata">

**Author:** ![drazisil](https://sea2.discourse-cdn.com/circleci/user_avatar/discuss.circleci.com/drazisil/32/24029_2.png) [@drazisil](https://discuss.circleci.com/u/drazisil)\
**Post date:** [March 1, 2017, 4:46pm UTC](https://discuss.circleci.com/t/circleci-source-ip/1202/12 "2017-03-01T16:46:24Z")

</div>

We did expand to us-east-2 recently to keep up with capacity requirements.

---

<div class="post-metadata">

**Author:** ![sebask](https://sea2.discourse-cdn.com/circleci/user_avatar/discuss.circleci.com/sebask/32/14348_2.png) [@sebask](https://discuss.circleci.com/u/sebask)\
**Post date:** [March 2, 2017, 9:32am UTC](https://discuss.circleci.com/t/circleci-source-ip/1202/13 "2017-03-02T09:32:52Z")

</div>

Is there anywhere we can read about such changes?

---

<div class="post-metadata">

**Author:** ![duffn](https://avatars.discourse-cdn.com/v4/letter/d/f19dbf/32.png) [@duffn](https://discuss.circleci.com/u/duffn)\
**Post date:** [March 19, 2017, 9:31pm UTC](https://discuss.circleci.com/t/circleci-source-ip/1202/14 "2017-03-19T21:31:07Z")

</div>

Thank you for the excellent solution. 🙂

---

<div class="post-metadata">

**Author:** ![drazisil](https://sea2.discourse-cdn.com/circleci/user_avatar/discuss.circleci.com/drazisil/32/24029_2.png) [@drazisil](https://discuss.circleci.com/u/drazisil)\
**Post date:** [March 23, 2017, 2:15pm UTC](https://discuss.circleci.com/t/circleci-source-ip/1202/15 "2017-03-23T14:15:51Z")

</div>

Closed on March 23, 2017, 2:15pm UTC

This topic was automatically closed 3 days after the last reply. New replies are no longer allowed.