Just got this from Paypal regarding IPN

[rickhz]

Does this have any bearing on our subscription integration with Paypal?

PayPal Status Page

www.paypal-status.com

Update:
This change will now take effect on May 3, 2021. The date in the previous posts has been likewise updated to reflect May 3, 2021.


Mar 11, 16:37 UTC

Update:
This change will now take effect on May 3, 2021.



As a point of clarification, merchants will be receiving IPNs from all the below IP addresses. However, on May 3 2021, the old IP addresses (marked below) will be deprecated and IPNs will only be sent with the new IP addresses (also marked below).

• 66.211.170.66 (Old)
• 66.211.170.66 (Old)
• 173.0.81.1 (Old)
• 173.0.81.0/24 (Old)
• 173.0.81.33 (Old)
• 173.0.81.65 (New)
• 173.0.81.140 (New)
• 64.4.240.0/21 (New)
• 64.4.248.0/22 (New)
• 66.211.168.0/22 (New)
• 173.0.80.0/20 (New)
• 91.243.72.0/23 (New)

Frequently asked questions (FAQs) about the change:



What are the actions required by merchants?



Merchants implementing any Access Control List (ACL) or filters on IP addresses for the IPNs received from PayPal, need to add all the aforementioned IP addresses before May 3, 2021. Doing so will help avoid missing IPNs from PayPal.



Are these changes only being made in Production?



Yes.


Mar 5, 21:36 UTC

Initial Notification:
PayPal is expanding the Instant Payments Notification (IPN) infrastructure used to notify merchants about events related to the status of PayPal transactions. This change has added seven new IP addresses from which IPNs are being sent since January 18, 2021. Below are all of the IP addresses that are being used for IPN.

• 66.211.170.66
• 173.0.81.1
• 173.0.81.0/24
• 173.0.81.33
• 173.0.81.65
• 173.0.81.140
• 64.4.240.0/21
• 64.4.248.0/22
• 66.211.168.0/22
• 173.0.80.0/20
• 91.243.72.0/23

Call to Action



Merchants implementing any Access Control List (ACL) or filters on IP addresses for the IPNs received from PayPal, need to add all the aforementioned IP addresses before May 3, 2021. Doing so will help avoid missing IPNs from PayPal.



For any further questions about this migration activity, merchants can reach out to Merchant Technical Support (www.paypal-techsupport.com).

 

[webbouk]

I was about to ask the same question

 

[Xon]

Default XenForo doesn't care. But if you are using CloudFlare you should whitelist these IPs so they don't get challenges which posting back to the server

 

[rickhz]

Default XenForo doesn't care. But if you are using CloudFlare you should whitelist these IPs so they don't get challenges which posting back to the server

Thanks for the tip.

 

[BassMan]

Yes, thanks for the tip, @Xon. So I guess something like this should be ok in Cloudflare:

 

[Xon]

You should also consider whitelisting Stripe's webhook notification IPs. I just add another IP source address matches with an OR so there is one for paypal and one for Stripe.

 

[rickhz]

Yes, thanks for the tip, @Xon. So I guess something like this should be ok in Cloudflare:

View attachment 249626

I was told to set "Choose an action" to "Bypass" "Security Level".

 

[BassMan]

Yes, actually, even better.

 

[Xon]

I was told to set "Choose an action" to "Bypass" "Security Level".

Huh, that wasn't there when I setup my site. Today I learn something new!

 

[Rusty Snippets]

Thanks guys! I got them all added, plus Stripe!

 

[Joeychgo]

what if Im not using cloudfare?

 

[Movie Prop Sites]

This has begun impacting us (not on cloudflare). Once we have a solution we will post it up.