title: IP Address ranges for APNS servers?
body: <p>Does anyone have a complete list of all IP addresses used by the Apple Push Notification Service?  </p>
  
  <p>I know that Apple uses a content delivery network to spread out these requests, and DNS lookups will return servers close to the requestor's location - the problem I have is in locating all of these servers that handle content for the United States.</p>
  
  <p>For example:</p>
  
  <pre><code>$ nslookup gateway.push.apple.com
  
  Non-authoritative answer:
  canonical name = gateway.push-apple.com.akadns.net.
  
  Address: 17.172.238.216
  Address: 17.172.238.224
  Address: 17.172.238.226
  </code></pre>
  
  <p>etc.</p>
  
  <p>This list changes every time I query DNS - but all of the addresses seem to be in the same 17.172.238.x range - but there's no guarantee that tomorrow or next week I'll see a different range.</p>
  
  <p>For the test push server, however, I already get results in different subnets.  Sometimes I get one set of addresses:</p>
  
  <pre><code>$ nslookup gateway.sandbox.push.apple.com
  
  Non-authoritative answer:
  canonical name = gateway.sandbox.push-apple.com.akadns.net.
  
  Address: 17.149.34.66
  Address: 17.149.34.65
  </code></pre>
  
  <p>and other times, I'll get these addresses:</p>
  
  <pre><code>Address: 17.172.233.65
  Address: 17.172.233.66
  </code></pre>
  
  <p>My server that will use the Apple Push Notification Service will be behind a corporate firewall, and I'll need to open up ports 2195 and 2196 for the production and test gateways -- however, my firewall team requires specific IP Addresses instead of host names.</p>
  
  <p>I'm worried that if I just ask the firewall team to allow the IP Addresses I've seen so far, then my server will simply stop working a day or a week from now when the DNS server decides to serve up a different range.</p>
  
  <p>If anyone has a comprehensive list for both the production and test environments, I'd appreciate it.</p>
  
  <p><strong>Update:</strong>  I've tried asking the firewall team to open Apple's entire IP block (17.0.0.0/8), but they won't do that for me -- I need to narrow down the addresses a little bit.</p>
  
  <p><strong>Final update - 10/16/2016</strong></p>
  
  <p>Even though this question is closed, I thought I'd add a note explaining my final solution - and it is not what anyone looking for an answer wants to hear.  I could never get ahead of the constantly changing addresses used by the CDN, so I finally gave up and leased an external server from Rackspace.  I got the smallest server possible, and the only thing running on it is a port-forwarder that listens on 2195 and 2916 and sends the connections to Apple.</p>
  
  <p>I used a simple iptables configuration on the Rackspace server to only allow connections on 2195/2916 from my corporate gateway, and then had my firewall team open a path to the static IP address on the external server.  The firewall team is happy, with implementing a single path, and the external server can connect to the entire 17.0.0.0/8 range used by Apple.</p>