My company distributes software that runs on locally installed Ubuntu Virtual Machines. To update the software, we pull our latest code down from Github.
Some IT departments have github blocked on their firewall. One IT guy suggested to us that they would be more open to adding a permanent rule to their firewall if we were able to narrow down the rule to a single external IP rather than the "github.com" domain, which covers a range of public IP addresses.
When I try to find info on github's public IP addresses, I'm always directed to the following page: https://docs.github.com/en/rest/reference/meta
When I follow the suggestions and access the github API to get a list of their public IP addresses, I get a long list of IP ranges in the "git" list. However, it's clear that not all of the addresses in these ranges work as a git remote URL.
Approaching this from a different angle, I pinged www.github.com and got 140.82.112.4. I see this is part of an IP range in the "git" list from the API call (140.82.112.0/20), and it works when I use it in a remote git URL in place of "github.com".
By accident and by messing around, I found that the following IPs worked as remotes. However, when I try adjacent IP addresses (eg. 140.82.112.2), those don't work even though they're in the same range returned by the github API call.
140.82.112.3
140.82.112.4
140.82.112.35
140.82.112.36
140.82.113.3
140.82.113.4
140.82.113.35
140.82.113.36
140.82.114.3
140.82.114.4
140.82.114.35
140.82.114.36
Questions
- Is there a better list where I can find specific IP addresses that can be used for git remote URLs? Are these subject to frequent change and could they be any addresses in the ranges returned by the github API at any given point in time?
- Is it reasonable for IT to ask us to limit our pulls to a single IP address? Is that really more secure than using the "github.com" domain?
- One of the repositories we pull from uses LFS, which pulls from a different domain/IP range. Is there any way to accommodate this when using a single IP in the git remote URL? (this should maybe be a separate post)