Why does Alias add smtp.gmail.com only have one IP?

[meyergru]

As the article clearly tells, the ranges may change in the future (and actually did since the article was written in 2017). AFAIK, there are no aliases in OpnSense to resolve SPF TXT records, so using an alias is not automatic.

Also, the three SPF netblocks are a subset of Google's AS, for which an OpnSense automatic alias type exists. By limiting access to SMTP and SUBMISSION ports for those IPs, restrictions should be fair enough for this purpose without the need to manually update anything - actually, any Google SMTP server in the future will also reside in AS15169.

[chemlud]

Also, the three SPF netblocks are a subset of Google's AS, for which an OpnSense automatic alias type exists.

OK, you suggest an Alias based on BGP ASN 15169 (which is Googles AS number), right?

[meyergru]

I did exactly that a few posts ago.

[franco]

> As the article clearly tells, the ranges may change in the future (and actually did since the article was written in 2017). AFAIK, there are no aliases in OpnSense to resolve SPF TXT records, so using an alias is not automatic.

True I did not dispute that. I was referring to the "ping" script that "tries" to built a list of all IP addresses which fails miserably for the same reason the alias doesn't work.


Cheers,
Framco

[chemlud]

...

Oh look I googled it and that's a top suggestion:

https://www.sourceonetechnology.com/gmail-ip-address-ranges/

Was this so hard? Now you can fix your leaky host alias to be a proper network alias.

To quote from your link:

...as of September 2017 ...

Still up to date? I doubt. I would go with the solution proposed by meyergru, whole google range with relevant ports blocked...

[franco]

Ok. Instead of focusing on a random link from Google I posted that has a viable solution maybe you want to focus on the fact that I never said it's not going to be outdated.

You want me to not post it because someone later said there is a better solution? I think that is the point of progressing this discussion.


No cheers from me for this,
Franco