Dropbox Web Security Proxy: Whitelisting IP Ranges Correctly

If Dropbox won’t install or sync on a corporate network sitting behind a web security proxy, the usual advice of just whitelisting *.dropbox.com often isn’t enough — in practice, Dropbox’s installer and sync client also reach out to a range of raw IP addresses that a simple domain whitelist won’t cover.

What to whitelist

Based on packet captures of the Dropbox installer and sync client connecting through a proxy, the following need to be allowed for Dropbox to work reliably:

• 108.160.172.0/24 — the full IP range Dropbox’s infrastructure uses for client traffic.
• client.dropbox.com
• dropbox.com

All of this traffic is HTTPS on port 443, so make sure your proxy rules account for that rather than only opening port 80.

If it’s still not working

Dropbox’s infrastructure and IP ranges do change over time, so if the above doesn’t fully resolve connectivity, capture traffic with Wireshark while attempting to install or sync Dropbox on an affected machine, and check what IP addresses and domains the client is actually trying to reach. Whitelisting whatever shows up there, in addition to the ranges above, should get things working.

Dropbox’s Current Official Guidance Has Moved Away From a Fixed IP Range (Updated for 2026)

Worth flagging directly: Dropbox’s own current help documentation no longer publishes a static IP block to whitelist at all — the specific 108.160.172.0/24 range above should be treated as historical rather than something to configure from scratch today. Dropbox’s current “Allow firewall for the Dropbox desktop app” article instead recommends allowing traffic by domain name (or by process — Dropbox.exe/DropboxUpdate.exe on Windows) and opening ports 80, 443, 17600, and 17603, rather than committing to a fixed CIDR range that can silently go stale as Dropbox’s infrastructure evolves. Its companion “What official domains does Dropbox use?” article lists the current verified domain set, including dropbox.com, dropboxapi.com, dl.dropboxusercontent.com (plus regional variants), and api-content.dropbox.com — notably, client.dropbox.com doesn’t appear on that current list, so it’s worth double-checking against Dropbox’s own domain page rather than assuming the original entries here are still complete. If you’re setting this up fresh, start from Dropbox’s own domain-based list and the four ports above rather than the legacy IP range.

Resources

• guide
• How to Automatically Empty Synology Recycle Bin
• Browse our Storage & Backup picks on Amazon