Whitelisting Files.com Service

---

Files.com is a large global cloud and SaaS application. Many of our customers are in environments that require whitelisted IP addresses, so we commit to publishing a list of IP addresses that may be involved in inbound or outbound connections to Files.com.

The list is extensive because it includes IPs in all regions where we operate servers, as well as IPs for different service types and integration endpoints for our various integrations. Unfortunately, we are not able to split this list into sub-lists by region or by integration type.

This list may change. To keep up to date with the latest list, please regularly poll our IP Address List API.

You can use our CLI App to access the IP Address Listings. In addition to retrieving the data, you can change the output format to create a CSV or JSON file for importing into another system.

files-cli ip-addresses get-reserved

Use this command if your account is migrated from ExaVault and configured to use the ExaVault host key:

files-cli ip-addresses get-exavault-reserved

13.115.185.197
13.211.6.58
13.211.8.8
13.228.110.5
13.230.174.211
13.251.23.79
13.251.75.92
18.130.82.3
18.130.85.21
18.184.31.111
18.196.218.237
18.196.249.148
18.205.187.185
18.210.222.34
3.124.213.47
34.193.60.221
34.194.175.247
34.204.145.250
34.204.150.23
34.204.153.236
34.204.236.250
34.204.250.40
34.205.137.182
34.206.140.166
34.246.103.210
34.251.118.53
34.252.200.237
35.157.95.231
35.176.125.40
35.178.122.29
35.178.154.72
35.178.42.15
35.178.42.158
35.182.68.20
46.51.239.135
52.17.96.203
52.18.87.39
52.20.236.84
52.215.35.55
52.221.157.129
52.23.22.134
52.28.101.76
52.29.176.178
52.44.29.99
52.56.167.16
52.56.197.159
52.58.79.145
52.60.101.109
52.60.113.8
52.60.129.247
52.60.153.17
52.60.214.201
52.60.239.159
52.60.245.89
52.62.59.186
52.64.150.164
52.64.199.91
52.64.2.88
52.64.251.226
52.64.6.120
52.68.30.197
52.68.4.44
52.74.166.120
52.74.188.115
52.77.142.208
52.77.8.56
52.8.210.89
52.9.227.24
54.193.65.189
54.193.69.198
54.193.69.200
54.193.69.72
54.207.27.239
54.208.20.30
54.208.63.151
54.209.222.205
54.209.231.233
54.209.231.99
54.209.242.244
54.209.246.217
54.209.91.52
54.232.253.47
54.64.240.152
54.95.179.0
54.95.60.23
99.79.110.182

Please make sure that all IP addresses are white-listed, as we may switch between these at any time.

Some sites that were migrated from the ExaVault architecture will provide the same host key that was used on ExaVault. For those sites, these IP addresses should also be whitelisted (in addition to the addresses above), if your networking configuration requires a whitelist.

18.205.170.87
18.205.8.81
18.233.238.114
3.217.82.30
3.227.183.71
3.232.229.87
34.192.34.71
34.202.116.48
34.202.23.159
34.202.28.186
34.231.28.146
34.233.32.85
35.171.168.150
35.174.249.23
44.197.126.42
44.205.164.56
44.205.181.212
44.205.218.209
44.205.47.95
54.175.70.146
54.205.227.156
54.82.79.68
54.84.38.86
54.86.1.128

Please make sure that all IP addresses are white-listed, as we may switch between these at any time. ExaVault does not provide IPv6 addresses.

If you restrict inbound or outbound access via a firewall, you may also need to determine which ports to whitelist in conjunction with our IP list. Ports are protocol specific.

For API traffic, which is used by our Desktop app, mobile apps, web app, CLI, SDKs, and API, port 443 (HTTPS) should be whitelisted.

If you are using FTP, you will need to whitelist port 21 and FTP data ports 40000-50000, and optionally our three alternate FTP ports 990, 3021, and 3990 if they apply to your use case.

If you are using SFTP, you will need to whitelist port 22 and optionally our alternate SFTP port 3022 if it applies to your use case.

For Outbound Connections from Files.com, Files.com will use IPs from the above list for all of outbound connections, including Webhooks, SMTP, LDAP, and Remote Server connections.

The exception is if you have configured dedicated IP Addresses for your site. By default, Files.com will use your dedicated IP addresses for outbound connections to remote servers. This applies to our Remote Server Sync and Remote Server Mount features. However, you can disable the use of your dedicated IP in these circumstances if you need to. For example, you might do that if your counterparty has already whitelisted the main Files.com IP range.

We do not support or recommend that any of our customers ever hardcode IP addresses directly into their client application. We use DNS as part of our redundancy and disaster recovery strategy, and we expect that our customers will always use DNS to look up [subdomain].files.com or app.files.com as appropriate. We also use Geo-DNS to route traffic to the fastest and closest available server, as well as to take troubled servers out of the active pool.

Using a hardcoded or stale IP may well direct you to a server that is down, currently undergoing maintenance, etc.

If you absolutely must use a hardcoded or static IP address, the best workaround is to provision a Custom Domain for your site. When you add a Custom Domain, we will provision a pair of dedicated IPs for your site. It is our goal to have your dedicated IPs remain the same, and we work hard to avoid having IP addresses change out from under you. In practice, dedicated IPs for our customers have remained the same for the past several years.

If we ever have to make changes to dedicated IP addresses that are associated with a custom domain, we will endeavor to provide advance notice. If you need real-time notification of changes, you may poll the the IP Addresses API endpoint to monitor when a change occurs. This endpoint returns a response including both our published list of IP addresses and your site's 2 dedicated IP addresses.

Customers often ask for dedicated IP addresses as a way to avoid having to whitelist a huge list of IP addresses for firewall purposes.

Files.com automatically provisions a pair of dedicated IP addresses for every site that has a custom domain enabled. We do that because FTP, unlike HTTP, requires that every custom domain be hosted on a dedicated IP address in order to have a custom SSL Certificate that matches the domain.

This means that if you have users who restrict outbound access via a firewall, they will only need to whitelist your 2 dedicated IP addresses rather than our entire published list of IP addresses (see above).

Custom domains and dedicated IPs are only available on the Power and Premier plans.

Dedicated IPs, once provisioned, are used for both inbound connections to your site via your custom domain, as well as outbound connections from Files.com to Remote Servers that are used for Remote Server Sync and Remote Server Mount.

Files.com does not offer IPv6 addresses for dedicated addresses.

When you use a Files.com-provided SSL certificate with a custom domain, inbound connections to your default account subdomain ([subdomain].files.com) address will also use your dedicated IPs because your custom domain uses a CNAME pointing at the default subdomain address.

When using your own SSL certificate with a custom domain, inbound connections to the Files.com subdomain address ([subdomain].files.com) will use the Files.com general IP pool of IP addresses. Inbound connections to your own custom domain (yoursubdomain.yourcompany.com) will use your dedicated IP addresses.

Remote Servers can be configured to either use your dedicated IP addresses or to use the Files.com general IP pool of IP addresses. The setting for using dedicated IP addresses for remote servers applies to both our Remote Server Sync and Remote Server Mount features.

However, you can disable the use of your dedicated IP in these circumstances if you need to. (You might do that if your counterparty has already whitelisted the main Files.com IP range, for example.)

We will not use your dedicated IP addresses for other types of outbound connections such as webhooks, LDAP, or SMTP. Our view is that this likely isn't a priority for most customers. If you have a need to have webhooks, LDAP, or SMTP originate from a dedicated IP address, we'd love to learn more about your exact use case.

In order to receive dedicated IP addresses for your site, you will first need to set up a custom domain. Once your custom domain is set up and active, you can look up your 2 dedicated IP addresses. Type "Firewall" in the search box at the top of every page and click on the matching result.

Dedicated IP addresses are exclusive to your Files.com site and act as static IP addresses.

It is our goal to have your dedicated IPs remain the same, and we work hard to avoid having IP addresses change out from under you. In practice, dedicated IPs for our customers have remained the same for the past several years. If we ever have to make changes to your IP addresses, we will endeavor to provide advance notice.

We have implemented an automated mechanic for you to be able to get real time notifications when a change occurs. You can achieve this by polling the /ip_addresses API endpoint shown in our API documentation. This endpoint returns a response including both our published list of IP addresses, and your site's 2 dedicated IP addresses.

If you change the primary region where files are hosted on your Files.com site, we will issue you new IP addresses in the new region and release your old IP addresses.

If you remove a custom domain from your site, the dedicated IPs associated with that custom domain are removed from active use and are no longer associated with your site.

Your users are still able to connect using your subdomain.files.com address as the host, but are no longer able to connect via your custom domain, and your subdomain will no longer resolve to the 2 IP addresses that were dedicated to your site.

After your custom domain is deactivated, your subdomain will resolve to an IP address from the general pool. Those users who require whitelisting in their local network firewalls or elsewhere will need to cover that entire list to ensure that they have consistent connection results.