3

I need the IP addresses and port numbers of the Ubuntu update sites to be able to perform updates on my systems as we can only open specific ports to specific IP addresses. Can anyone help?

Thanks in advance!

Improve this question
4
  • Which Ubuntu mirror do you want to use?
    – Thomas Ward ♦
    Dec 19, 2014 at 15:18
  • "open" ports normally refer to incoming connections, not outgoing, which normally are unrestricted ( i.e. you can browse to any web site you want ). Thus you don't need to open anything.
    – psusi
    Dec 19, 2014 at 15:19
  • 1
    @psusi unless they're paranoid about their locked-down sections of the network and want to restrict outbound communications (in which case they should be using squid or a transparent proxy to control that kind of thing)
    – Thomas Ward ♦
    Dec 19, 2014 at 15:25
  • What ThomasW says. We are overly paranoid.
    – pdhestand
    Dec 22, 2014 at 15:55

1 Answer 1

Reset to default
5

I use the US archive mirrors at us.archive.ubuntu.com, the security updates at security.ubuntu.com, and also pull in extras (extras.ubuntu.com) and PPAs (ppa.launchpad.net).

Unless you specifically state which mirrors you are on, it's impossible to figure out what IP(s) you'll use. However, if you are restricting outbound connectivity, then you'll have to open the outgoing ports depending on what exactly you use as the apt transfer method. (HTTP (TCP 80), HTTPS (TCP 443), FTP (TCP 21), or others.) If you use a proxy, there's additional configurations you'll need to run as well.

Below is my /etc/hosts entries for the US archive mirrors, the extras site, the security repos, and the PPAs site, which was last updated a couple months ago (and still works here). (They're in my /etc/hosts site to try and mitigate DNS poisoning potentiality). Note that I do not have outbound rule restrictions, but these IP addresses work on my locked-down VLAN and have "ALLOW" rules in place on my network border firewall to allow outbound from the Ubuntu systems I need updating from my locked-down area.

NOTE: These may be out of date! ALWAYS do the DNS lookup yourself to get the updated IP lists!

91.189.91.13    us.archive.ubuntu.com
91.189.91.14    us.archive.ubuntu.com
91.189.91.15    us.archive.ubuntu.com

91.189.91.14    security.ubuntu.com
91.189.91.15    security.ubuntu.com
91.189.92.181   security.ubuntu.com
91.189.92.184   security.ubuntu.com
91.189.92.190   security.ubuntu.com
91.189.92.200   security.ubuntu.com
91.189.92.201   security.ubuntu.com
91.189.92.202   security.ubuntu.com
91.189.91.13    security.ubuntu.com

91.189.95.83    ppa.launchpad.net

91.189.92.152   extras.ubuntu.com

If you want to use a different archive mirror, I can go hunting, but it'd be dependent on the region you're in. (I pulled these IPs from Google's DNS servers, so they're not likely to be poisoned DNS entries)

Improve this answer
1
  • Thanks for your help. I had some of these but not all. What I did not have was the FTP port number assigned. Instead, our IT (which I have no influence with) assigned the IPs to the SSH port. This should clear it up.
    – pdhestand
    Dec 22, 2014 at 16:05

Not the answer you're looking for? Browse other questions tagged or ask your own question.