Important firewall changes for Umbrella roaming client users

Update: All Umbrella roaming clients have been transitioned over to the new sync destination sync.hydra.opendns.com via a HTTP redirect from the api.opendns.com endpoint. In the new year, clients will transition to sync with sync.hydra.opendns.com directly; however, since all clients already sync to this host, no impact is expected as a result.

As part of an upgrade to the underlying sync capabilities for roaming clients, a new domain for the Umbrella roaming client syncing to Umbrella has been created. This change will enable faster sync responses and more up to date roaming client statuses in the dashboard. Action is required to ensure this domain is permitted in your firewall. 

The change is:

allow TCP 443 to sync.hydra.opendns.com (bidirectionally)

sync.hydra.opendns.com can resolve to several IP addresses, all within the 146.112.63.0/24 IP range. We recommend adding this entire range as the IP address(es) for sync.hydra.opendns.com are Anycast and may change. Currently, the 4 IP addresses this domain resolves to are:

146.112.63.3 to 146.112.63.9 and 146.112.63.11 to 146.112.63.13

Failure to make this change will result in the roaming client being unable to sync and possibly lose the list of internal domains that it obtains from the dashboard.