FTP Publishing - Check Your Firewall Filters

If you have a server that is used to host web sites, you need to protect the server, and the web sites, from malicious access. One of the easiest ways to protect the server is to deny update access to computers with unknown IP addresses. As long as your clients publish from computers with known IP addresses, and those computers are never used by people with malicious intent, this is a good strategy.

If you're publishing your Blogger blog by FTP to a remote host server, and the host server protects itself by an IP filter, the filter has to allow access to any computers used by Blogger for FTP transfer. A list of IP addresses is provided in Blogger Help: Can I use Blogger if my server is restricted by IP address or behind a firewall?.

The IPs provided are:
74.125.66.132
74.125.112.132

It's not clear whether those 2 addresses completely replace the previously defined addresses:
66.102.15.83
216.34.7.186
64.233.166.192-207
64.233.178.192-207

During the past couple weeks, several bloggers have found that list to be inaccurate.

We were able to see requests from a new google IP (72.14.206.132) address being dropped by our firewall. We updated our firewall rules with this new IP (72.14.206.132) and publishing started to work.

Let's check out "72.14.206.132", using the All-NetTools WhoIs utility.

eh-out-f132.google.com (72.14.206.132)

72.14.192.0 - 72.14.255.255
Google Inc.
1600 Amphitheatre Parkway
Mountain View, CA
US

That's a Blogger computer, but is it the only one? We'll only find out if more bloggers report finding other addresses being rejected.

It's good that Blogger is willing to provide a list of IP addresses used in the FTP process, but I would never bet on the list being 100% up to date. If you are having problems with blog publishing by FTP from Blogger, check your firewall logs. If you see an entry mentioning rejection by IP address, when you're trying to publish your blog, verify the address using WhoIS. If you see an IP address owned by Google being filtered, update your filter.

This scenario is another example why I recommend immediately checking server logs, any time there's a problem with FTP publishing. This problem is probably involved in some of the previously reported symptoms, observed at the Blogger end

ConnectException: Connection timed out.

a variant

FTPConnectionClosedException: Connection closed without indication.

or maybe the well known

Your publish is taking longer than expected.

Depending upon what response the firewall is making to the client computer, and how the client computer interprets the response, either symptom is a perfectly reasonable result.

If you examine the firewall log from your server, and find that the firewall is rejecting addresses other than "72.14.206.132", take action.

1. Verify any rejected addresses, using a WhoIs or similar query.
2. If you find any such addresses, that absolutely verify as Google, add them to your firewall "pass" list, and test.
3. If you are now successful in publishing, post here, in Blogger Help Group: Publishing Trouble, or both, and let your peers know of your findings. While we await advice from Blogger Support, we have to support each other.

And be sure that you know the scope of the pass list. Make sure that the firewall doesn't have any exceptions that need to be configured.

I granted the new IP access via the IIS/FTP "Directory Security" tab for my FTP site. No problems there. BUT I had forgotten that the inetinfo.exe process was listed as an exception to the firewall rules. Once I found it again, and added the new IP to the inetinfo.exe's scope, problem fixed!!

If you update the firewall pass list, and add a new IP address, make sure that there are no extra pass lists that need to be updated with a new address also.

Be persistent, when requesting diagnostics like server logs, from the support staff for your server. And be aware of other current issues, too.

>> Top