Sign inMonitor a domain
aws · CLOUDFRONT_ORIGIN_FACING

Amazon Web Services uses 87 prefixes for CLOUDFRONT_ORIGIN_FACING.

Last updated 5 Nov 2026 from Amazon Web Services’s own list (file dated 2026-11-04-23-10-01)

Short answer

CLOUDFRONT_ORIGIN_FACING is the subset of CloudFront addresses that connect to your origin; AWS suggests allowing only these at an origin server.

IPv4 prefixes49
IPv6 prefixes38
Regions in the first 100ap-northeast-2, GLOBAL, me-central-1, eusc-de-east-1, ap-southeast-5, af-south-1, ap-southeast-6, ap-northeast-1 …
Fetched by peekip5 Nov 2026

Prefixes

PrefixRegion / locationService
13.124.199.0/24ap-northeast-2CLOUDFRONT_ORIGIN_FACING
130.176.0.0/18GLOBALCLOUDFRONT_ORIGIN_FACING
130.176.128.0/21GLOBALCLOUDFRONT_ORIGIN_FACING
130.176.136.0/23GLOBALCLOUDFRONT_ORIGIN_FACING
130.176.140.0/22GLOBALCLOUDFRONT_ORIGIN_FACING
130.176.144.0/20GLOBALCLOUDFRONT_ORIGIN_FACING
130.176.160.0/19GLOBALCLOUDFRONT_ORIGIN_FACING
130.176.192.0/19GLOBALCLOUDFRONT_ORIGIN_FACING
130.176.64.0/21GLOBALCLOUDFRONT_ORIGIN_FACING
130.176.72.0/22GLOBALCLOUDFRONT_ORIGIN_FACING
130.176.76.0/24GLOBALCLOUDFRONT_ORIGIN_FACING
130.176.78.0/23GLOBALCLOUDFRONT_ORIGIN_FACING
130.176.80.0/22GLOBALCLOUDFRONT_ORIGIN_FACING
130.176.86.0/23GLOBALCLOUDFRONT_ORIGIN_FACING
130.176.88.0/21GLOBALCLOUDFRONT_ORIGIN_FACING
130.176.96.0/19GLOBALCLOUDFRONT_ORIGIN_FACING
15.158.0.0/16GLOBALCLOUDFRONT_ORIGIN_FACING
18.68.0.0/16GLOBALCLOUDFRONT_ORIGIN_FACING
204.246.166.0/24GLOBALCLOUDFRONT_ORIGIN_FACING
205.251.218.0/24GLOBALCLOUDFRONT_ORIGIN_FACING
24.110.128.0/17GLOBALCLOUDFRONT_ORIGIN_FACING
3.172.0.0/18GLOBALCLOUDFRONT_ORIGIN_FACING
3.172.64.0/18GLOBALCLOUDFRONT_ORIGIN_FACING
3.29.57.0/26me-central-1CLOUDFRONT_ORIGIN_FACING
51.74.20.0/24eusc-de-east-1CLOUDFRONT_ORIGIN_FACING
51.74.21.0/24eusc-de-east-1CLOUDFRONT_ORIGIN_FACING
51.74.22.0/24eusc-de-east-1CLOUDFRONT_ORIGIN_FACING
52.46.0.0/18GLOBALCLOUDFRONT_ORIGIN_FACING
52.82.128.0/23GLOBALCLOUDFRONT_ORIGIN_FACING
52.82.134.0/23GLOBALCLOUDFRONT_ORIGIN_FACING
54.182.128.0/20GLOBALCLOUDFRONT_ORIGIN_FACING
54.182.144.0/21GLOBALCLOUDFRONT_ORIGIN_FACING
54.182.154.0/23GLOBALCLOUDFRONT_ORIGIN_FACING
54.182.156.0/22GLOBALCLOUDFRONT_ORIGIN_FACING
54.182.160.0/21GLOBALCLOUDFRONT_ORIGIN_FACING
54.182.172.0/22GLOBALCLOUDFRONT_ORIGIN_FACING
54.182.176.0/21GLOBALCLOUDFRONT_ORIGIN_FACING
54.182.184.0/22GLOBALCLOUDFRONT_ORIGIN_FACING
54.182.188.0/23GLOBALCLOUDFRONT_ORIGIN_FACING
54.182.224.0/21GLOBALCLOUDFRONT_ORIGIN_FACING
54.182.240.0/21GLOBALCLOUDFRONT_ORIGIN_FACING
54.182.248.0/22GLOBALCLOUDFRONT_ORIGIN_FACING
54.239.134.0/23GLOBALCLOUDFRONT_ORIGIN_FACING
54.239.170.0/23GLOBALCLOUDFRONT_ORIGIN_FACING
54.239.204.0/22GLOBALCLOUDFRONT_ORIGIN_FACING
54.239.208.0/21GLOBALCLOUDFRONT_ORIGIN_FACING
64.252.128.0/18GLOBALCLOUDFRONT_ORIGIN_FACING
64.252.64.0/18GLOBALCLOUDFRONT_ORIGIN_FACING
70.132.0.0/18GLOBALCLOUDFRONT_ORIGIN_FACING
2001:3fc6:3c::/47GLOBALCLOUDFRONT_ORIGIN_FACING
Showing 50 of 87 prefixes All prefixes (CSV)

What changed

  • 16 Oct 2026
    + 2001:3fc6:4::/48
+ 2001:3fc6:5::/48
+ 51.74.20.0/24
+ 51.74.21.0/24
+ 51.74.22.0/24
  • 14 Oct 2026
    + 2001:3fc6:3c::/47

Allowlist formats

nginx (first 5 prefixes)
allow 13.124.199.0/24;
allow 130.176.0.0/18;
allow 130.176.128.0/21;
allow 130.176.136.0/23;
allow 130.176.140.0/22;
deny all;
iptables (first 5 prefixes)
iptables -A INPUT -s 13.124.199.0/24 -j ACCEPT
iptables -A INPUT -s 130.176.0.0/18 -j ACCEPT
iptables -A INPUT -s 130.176.128.0/21 -j ACCEPT
iptables -A INPUT -s 130.176.136.0/23 -j ACCEPT
iptables -A INPUT -s 130.176.140.0/22 -j ACCEPT

Generate the full list from the CSV, and refresh it on a schedule: providers add and retire prefixes often.

Sources

  1. Amazon Web Services: published IP ranges · checked 5 Nov 2026
  2. Amazon Web Services documentation