URLs accessed by BunkerWeb and plugins

Community Support
1

Hello,

I would like not to open all Internet access from my Bunkerweb instance.

Is there an list of all IP/URL needed for Bunkerweb and its different plugins/services (for reaching updates, white/black lists, etc…) so I can allow only these on my main firewall ?

Best regards,

2

Hi,

There isn’t a single official allow-list in the docs for this, mostly because what BunkerWeb talks to depends on which plugins you’ve actually enabled. Here’s a breakdown based on the documentation.

Core (default install)

  • api.bunkerweb.io (HTTPS/443), but only if you’re on PRO. It’s used for license verification and downloading the premium plugins. This is the one the docs explicitly list as a network requirement.

  • BunkerWeb’s endpoint for anonymous usage reports, if you leave SEND_ANONYMOUS_REPORT at yes. You can turn that off if you’d rather.

Blacklist (on by default)

  • https://www.dan.me.uk/torlist/?exit for Tor exit nodes. That’s the default BLACKLIST_IP_URLS, also available as the community list ip:danmeuk-tor-exit.

  • https://raw.githubusercontent.com/mitchellkrogza/nginx-ultimate-bad-bot-blocker/... for bad user-agents (community list ua:mitchellkrogza-bad-user-agents).

  • If you opt into the Data-Shield community lists, add raw.githubusercontent.com/duggytuxy/``....

Country / GeoIP

Only relevant if you enable the matching feature

  • Antibot CAPTCHAs: Google reCAPTCHA (google.com, or the Google Cloud reCAPTCHA Enterprise API for the new version), hCaptcha (hcaptcha.com), Cloudflare Turnstile (challenges.cloudflare.com), or your own mCaptcha / Cap.js URLs.

  • CrowdSec: the CrowdSec Hub/API for collection updates.

  • ModSecurity CRS plugins: github.com/coreruleset/... archives.

  • Robots.txt DarkVisitors: the darkvisitors.com API.

  • DNSBL: DNS lookups (port 53) to whatever servers you configure, e.g. zen.spamhaus.org.

  • Anything you set yourself through whitelist/greylist/blacklist *_URLS or EXTERNAL_PLUGIN_URLS.

Couple of things to keep in mind. A lot of these sit behind CDNs (raw.githubusercontent.com being the obvious one), so locking down by static IP won’t really work. You’re better off allowing by domain on your firewall or proxy. Also, most of the list-based features accept a file:/// local path instead of a remote URL, so if you want to keep things fully closed off you can host the lists internally and avoid the outbound calls altogether.

Best regards

3

Hello Théophile,

thank you for your detailed answer, it will help us a lot !

Best regards,