Skip to main content

mabl static IP addresses

Eva Ferreira
  • Updated

All mabl test traffic originates through a fixed set of IP addresses. By adding mabl's static IP addresses to a firewall allowlist, permitlist, or whitelist, you can give mabl access to non-public testing and production environments for cloud runs. 

Static IP addresses are one of two ways to give mabl access to a private environment. The other is mabl Link, which runs an agent inside your network. Choosing between mabl Link and static IP allowlisting compares them.

To send test traffic from a specific country or region rather than from these addresses, see Testing from specific geographic regions.

Current static IP addresses

As of this article being updated, mabl's static egress IPs are:

  • 3.146.47.160/27
  • 34.31.138.224/27
  • 34.132.2.128/28
  • 34.31.17.192/28

Unless you have configured your tests to run over mabl Link, all cloud test traffic, webhook calls, and URL validation traffic originate from these IP addresses. The ranges are hosted on both Google Cloud and Amazon Web Services, so both providers appear if your security team verifies who owns them. You can also find the current static IP addresses on the networking page in the app: Settings > Networking.

Example of static IP addresses used by mabl browsers

The IP addresses are listed in CIDR block format. If your firewall doesn't use CIDR format, drop the /28 from the address and use that in your firewall configuration.

mabl uses the standard port for HTTPS / TLS (443).

Applications under test hosted on Google Cloud Platform services

If your application under test is hosted by select Google Cloud Platform services, such as the following, traffic will appear to originate from the 0.0.0.0 address, because the test traffic will transit the internal Google Cloud network directly to your application.

  • Google App Engine
  • Google Cloud Run
  • Google Cloud Functions

Writing the firewall rule

mabl's static IP ranges are shared by every mabl customer, so an allowlist rule identifies traffic from mabl's cloud, not from your workspace specifically. To keep the rule as narrow as possible:

  • Scope it to the hosts under test. Allow mabl's ranges to reach only the specific hostnames or servers your tests use, rather than the whole network.
  • Add a header condition where you can. If your web application firewall supports it, require one of the markers mabl browser tests send alongside the IP match. API tests and mobile tests don't send them, so a rule that requires them blocks those tests. Troubleshooting connectivity issues lists the markers.
  • Assign an owner for the list. mabl announces changes to the ranges in the places listed below. Someone on your team should be responsible for updating the rule when that happens.

Allowlisted, but tests still fail?

Services between mabl and your app, such as a content delivery network or an identity provider, can challenge mabl's traffic as a bot even after your firewall admits it. See Troubleshooting connectivity issues.

Communicating IP address changes

If mabl adds or removes static IP addresses, the change will be communicated via:

Retired static IP addresses

Previously used egress IPs that are now retired are:

  • 104.198.166.162/32 (RETIRED)
  • 35.184.236.163/32 (RETIRED)
  • 207.254.16.90/32 (RETIRED)

Retired egress IPs remain in the control of mabl for security purposes, but are no longer used for production mabl test traffic.

Limitation

Dedicated static IP addresses for a single workspace or customer aren't currently available.

Related articles