The scenario is - I need to send push notification to Apple push server hosted at gateway.sandbox.push.apple.com. This Apple server is load balanced and the destination IP address can be anything in 17.x.x.x block.

Now my server which will be requesting Apple server is in secure environment and is behind firewalls. I have got the IP range 17.x.x.x unblocked, but DNS resolving is not possible on that server. That server also doesnt have Internet access on it.

What I did was - I pinged the Apple server from another system and got the Apple server's IP address for the moment. Then I mapped that IP address with the DNS name in the hosts file of my Windows server. This worked, but now the IP address can change anytime at the Apple end, and this will break things.

What can I do in this scenario?

  • 2
    a) setup a DNS server, b) manually fix it every time it breaks, c) setup a proxy. (also, if it "doesn't have internet access", how is it talking to an internet hosted service?) – Ricky Beam Jul 22 '16 at 7:15
  • i mean only firewall opened ip addresses are allowed..rest of the internet access is blocked..thanks for your comment – Lakshay Jul 22 '16 at 7:32
  • 1
    You should be able to configure your firewall to allow only DNS type traffic to the specific server needing to push notifications. This would be a specific rule and should not compromise your network security posture, especially since DNS servers IP addresses are typically hard coded. – Ronnie Royston Jul 24 '16 at 17:37

Do nothing. I doubt apple is using round robin DNS.

Network Load Balancing (typically a virtual IP address) is superior to other software solutions such as round robin DNS (RRDNS), which distributes workload among multiple servers but does not provide a mechanism for server availability.

| improve this answer | |
  • I am sorry I didnt get u..u r saying I can have that single IP address in the hosts file, and it shd work fine – Lakshay Jul 24 '16 at 10:23
  • Thanks! It would be really helpful if you can provide me some info as in why it will work...lets assume currently apple is redirecting the domain to server whose ip address is lets say tomorrow this server is dead..but my server will try to reach out to this server only.. – Lakshay Jul 24 '16 at 16:36
  • 1
    gateway.sandbox.push.apple.com is where you want to connect to but your server can't use DNS. ...I see. In the real world you fix the issue by allowing DNS traffic to pass to the server by updating the configuration of your network security devices. If your server simply can't be allowed to use DNS, you're going to have to roll your own version of dynamic address resolution and recreate the wheel. – Ronnie Royston Jul 24 '16 at 17:33

Not the answer you're looking for? Browse other questions tagged or ask your own question.