Following are steps for determining the public IP address ranges utilized by CONNECTION Client for various Bentley services.

Background

While we always recommend configuring firewalls to use alias names instead of IP addresses since they are dynamic, some firewall environments still utilize IP addresses which will benefit if the address ranges are known. The steps below help identify the regional data centers in use and may vary by location.

Steps to Accomplish

Identify specific IP addresses in use

1. Right-click on the Windows Start menu, and select Windows PowerShell from the contextual menu.
2. Execute the following two commands:
   nslookup connect-ulastm.bentley.com
   nslookup ims.bentley.com
3. The first command will give an IP address for the Microsoft Azure data center in use by the majority of our services. The second command will give an IP address for the Amazon Web Services (AWS) data center in use for some of our services.

Identify IP address ranges from cloud providers

1. Download the latest Microsoft Azure IP address ranges.
2. Open it, and search for the first two octets of the IP addresses found with the "nslookup connect-ulastm.bentley.com" command. For example, the screenshot above gives an IP address of 40.84.27.172 which would require a search for 40.84. Search results will be found in specific service tags which give several ranges of IP addresses. Add these ranges to your firewall.
3. Download the latest AWS IP address ranges.
4. Open it, and search for the first two octets of the IP addresses found with the "nslookup ims.bentley.com" command. For example, the screenshot above gives an IP address of 54.82.25.138 for one of the addresses which would require a search for 54.82. Search results will be found in specific service tags which give several ranges of IP addresses. Add these ranges to your firewall.

Important: Microsoft and Amazon may periodically change their IP address ranges, requiring firewall rules to be periodically updated accordingly, hence why we recommend using the unchanging alias names for services whenever possible.

See Also

CONNECTION Client FAQ