Which external services Ghost is trying to reach?

Developer help
1

Hi,

I have a proxy that catches all non-wanted traffic so I need to whitelist specific domains when needed.

For now I allowed:

But I’m seeing multiple attempts to an external service (my proxy logs won’t tell me the domain, just IPs):

[2021-04-16T17:03:30.343Z] "- - -" 0 UH "-" "-" 0 0 0 - "-" "-" "-" "-" "-" - - 108.177.121.132:443 ${local_one}:44530 - -
[2021-04-16T17:03:30.347Z] "- - -" 0 UH "-" "-" 0 0 0 - "-" "-" "-" "-" "-" - - 64.233.191.132:443 ${local_one}:33784 - -
[2021-04-16T17:03:30.409Z] "- - -" 0 UH "-" "-" 0 0 0 - "-" "-" "-" "-" "-" - - 74.125.201.132:443 ${local_one}:42826 - -
[2021-04-16T17:03:30.423Z] "- - -" 0 UH "-" "-" 0 0 0 - "-" "-" "-" "-" "-" - - 74.125.132.132:443 ${local_one}:32968 - -
[2021-04-16T17:03:30.435Z] "- - -" 0 UH "-" "-" 0 0 0 - "-" "-" "-" "-" "-" - - 142.250.103.132:443 ${local_one}:35220 - -

All those IPs are owned by Google but I can’t figure out which domains I should allow (they are probably all the same service behind a load balancer when retrying).

Since for more than a year Ghost only uses “rpc.pingomatic.com” and no longer ping Google services I don’t understand what’s going on :frowning:

Thank you,

2

Other services are Mailgun and Stripe if you’re using those, plus any services you have set up for Integrations such as Slack, Zapier, or any other webhook endpoints that have been configured. For embeds/bookmarks to work you’ll need to allow outgoing connections to any site that you’re trying to embed - embedding will be triggered by using those cards directly or when pasting a link by itself in a new paragraph.

Are you allowing your site to contact itself too? If your local network setup causes local traffic to route via the internet then you’ll need to allow those connections through for things like scheduled posts to function as they are triggered by API calls.

AMP pages will also trigger fetches of external images if they are used because AMP requires image dimensions and the images have to be fetched to obtain those.