Configuring your firewall for Zendesk

What your network needs to allow. Usually a question from IT, and the answer is more than one address range.

What your network needs to allow. Usually a question from IT, and the answer is more than one address range.

Set it up

1. Get the current ranges from your own account rather than from a document: https://yoursubdomain.zendesk.com/ips returns the inbound and outbound addresses for your subdomain.
2. Allow them outbound from your network. If you allow only part of Zendesk's addresses, 216.198.0.0/18 has to be among them: that is the consolidated range Zendesk owns outright.
3. Allow the mail servers if you filter inbound mail.
4. Test the agent interface, email and any integration.
5. Note that the list came from the /ips endpoint, so whoever refreshes it next knows where to look.

Products beyond Support publish their own addresses, and third-party services your integrations call are not in Zendesk's list at all. Both are the usual reason a firewall change is ninety per cent right.

Four things need allowing

• The agent interface, so people can work.
• Mail, both directions, or tickets stop arriving.
• Real-time connections used by messaging and live updates.
• Anything your integrations call, which is easy to overlook.

The ranges change

Not often, and enough to matter. A firewall configured three years ago and never revisited is a plausible cause when something intermittently fails for one office.

Note where the list came from so somebody can check it against the current one.

Symptoms of a partial block

The interface loads and messaging does not update. Email works and attachments fail. Everything works except from one location.

Those patterns point at the network rather than at Zendesk, and they are frequently investigated as product faults first.

Deep inspection breaks things

Proxies that inspect traffic can interfere with real-time connections in ways that look like intermittent product faults. Worth asking about before a long investigation.

Test from each location

Offices differ, and the branch with its own firewall is where the problem will be. One person in each place, checking the interface, email and a messaging conversation.

See also

• Restricting access with IP restrictions
• Monitoring your account on the Zendesk status page
• General security practices for your Zendesk