🐛 Bug: Gmail IPs on CSF_MASTER list

[jdimea]

CSF › Version

15

CSF › Release

Stable

System › OS

Linux

System › Distro & Version

AlmaLinux release 8.10

Control Panel › Name

cPanel

Priority

Normal

Issue Description

Gmail IPs are in CSF_MASTER which cause mail delivery issues.

$ curl -s https://raw.githubusercontent.com/Aetherinox/csf-firewall/main/blocklists/master.ipset | grep 209.85.221.17
209.85.221.171
209.85.221.172
209.85.221.173
209.85.221.177
209.85.221.179

I think we should look into excluding Gmail's IP ranges to prevent this issue.

Here is a list of their IPs:

$ dig +short txt _spf.google.com
"v=spf1 ip4:74.125.0.0/16 ip4:209.85.128.0/17 ip6:2001:4860:4000::/36 ip6:2404:6800:4000::/36 ip6:2607:f8b0:4000::/36 ip6:2800:3f0:4000::/36 ip6:2a00:1450:4000::/36 ip6:2c0f:fb50:4000::/36 ~all"

Steps To Reproduce

N/A

Logs › Lfd

No response

Config › csf.conf

No response

Screenshots

No response

[eric418hk]

I have reported this to @Aetherinox couple days ago via Discord, and he will fix this.

Basically, these Gmail IPs are flags in abuseipdb and imported to the master list.

https://www.abuseipdb.com/check/209.85.221.171

Meanwhile, just add the Gmail ranges to csf.allow

# Gmail servers
74.125.0.0/16
209.85.128.0/17
64.233.160.0/19
66.102.0.0/20
216.58.192.0/19
172.217.0.0/16
108.177.8.0/24

[jcatello]

Seeing properly identified Google bots as well on:

https://raw.githubusercontent.com/configserver-software/service-blocklists/main/blocklists/master.ipset

• 66.249.77.160
• 66.249.77.161
• 66.249.83.8

# host 66.249.77.160
160.77.249.66.in-addr.arpa domain name pointer crawl-66-249-77-160.googlebot.com.
# host 66.249.77.161
161.77.249.66.in-addr.arpa domain name pointer crawl-66-249-77-161.googlebot.com.
# host 66.249.83.8
8.83.249.66.in-addr.arpa domain name pointer google-proxy-66-249-83-8.google.com.

[Aetherinox]

Yeah, we're getting ready to roll out a whitelist for certain bots that get identified as false flags.

For the meantime, the API should take care of this, you can add an ignore rule to the blocks that you want to accept via:

• https://blocklist.configserver.dev/help

I've got an update coming out for CSF to address the last of the migration changes, and then I can spend a few days finishing the next revision of the blocklists and re-enabling other other lists.