Docs

WAF Egress IP Addresses

Overview

The Expedited WAF works as a reverse proxy. Visitors connect to the WAF edge network, the WAF applies your security rules, and allowed requests are then forwarded on to your Heroku application.

Visitor → WAF Edge Network → Your Heroku App

Because of this, every request that reaches your application arrives from one of the WAF’s egress IP addresses, not from the visitor directly. The visitor’s original IP address is passed along in the X-Forwarded-For header.

The IP ranges

Requests from the WAF to your application will always come from these four ranges:

192.88.134.0/23

185.93.228.0/22

66.248.200.0/22

208.109.0.0/22

How often do these ranges change?

Essentially never. The list has not changed in over five years.

If we add a range in the future, we will contact all of our customers months in advance so you have time to update any rules that reference these ranges.

Common uses

Allowing WAF traffic through application-level IP filtering

If your application filters or throttles by source IP (for example with Rack::Attack or similar middleware), make sure these four ranges are never blocked. All of your legitimate visitor traffic arrives from them.

For the same reason, rate limiting should key on the X-Forwarded-For header rather than the connection’s source IP. From your dyno’s point of view, every visitor shares the same small pool of WAF addresses, so per-IP throttles keyed on the source IP will lump all of your visitors together.

Verifying that requests came through the WAF

To confirm that a request passed through the WAF rather than reaching your Heroku app URL directly, check the request’s source IP against these ranges in your application.

Heroku Private Space customers can enforce this at the network level instead, so that direct-to-app requests are rejected before they reach a dyno. See the article “Heroku Private Space Trusted IP Range Configuration” for that setup.

What these ranges are not

These are the addresses the WAF connects from when forwarding visitor requests to your application. They are unrelated to outbound requests your application makes to other services, which leave directly from your Heroku dyno and never pass through the WAF. See “WAF and Outbound Connections” for more detail.

Need Help?