Cloudflare Developers•3y ago

is it? Interesting, look slike there's two different types as well, a filling and a license

CChaika is it? Interesting, look slike there's two different types as well, a filling an...

PencilNavigator•7/12/23, 3:02 PM

it depends on your site type

PencilNavigator•7/12/23, 3:03 PM

if you are an individual and want to run sth like a blog or a self host network storage, then its pretty easy

PencilNavigator•7/12/23, 3:04 PM

u just need your ID (scan both side), photo of you holding the id, and a agreement or sth that you need to sign

PencilNavigator•7/12/23, 3:06 PM

for business then it's probably harder. Depends on type ICP license may not be the only thing you need to get

PencilNavigator•7/12/23, 3:07 PM

e.g. https://bilibili.com a famous chinese video site (like youtube)
this is on their footer (full of licenses)

PencilNavigator•7/12/23, 3:07 PM

PencilNavigator•7/12/23, 3:11 PM

If it's translated it looks sth like this

Business License Information / Network Transmission of Audiovisual Programs License: 0910417 / Network Culture Operation License 沪网文【2019】3804-274 No. / Radio and Television Program Production and Operation License: (HU) No. 01248 / Value-added Telecommunications Business License 沪B2-20100043
/ Internet ICP License: Shanghai ICP No. 13002172-3 / Publication License 沪批字第U6699号 / Internet Medical Information Service Qualification Certificate 沪-非经营性-2022-0011 / Business Performance License 沪市文演（经）00-2253 |
Undesirable information reporting mailbox: help@bilibili.com Incidents involving teenagers (under 18) reporting mailbox: teenprotect@bilibili.com
Shanghai Internet Reporting Center |12345 Government Service Hotline |
Shanghai public network security preparation 31011002002436 | child pornography information reporting area | anti- pornography and combating illegal reporting
Online harmful information reporting area:
China Internet Illegal and Undesirable Information Reporting Center Dear friends, the Shanghai police anti-fraud dissuasive telephone "96110" is specifically designed to avoid your property is damaged by fraud and set up, please once you receive the call, immediately answer.
Company Name: Shanghai Broad Entertainment Digital Technology Co., Ltd | Company Address: No. 489 Zhengli Road, Yangpu District, Shanghai | Tel: 021-25099888

ChaikaOP•7/12/23, 3:12 PM

that's like 10 licenses lol

PencilNavigator•7/12/23, 3:13 PM

yup, so depends on type it may not only requires a ICP license

PencilNavigator•7/12/23, 3:15 PM

baidu, a search engine, has an Internet Religious Information Service License

PencilNavigator•7/12/23, 3:15 PM

but anyways ICP license is the minimum requirement to legally run a website in china

PencilNavigator•7/12/23, 3:16 PM

ofc you can serve your website outside china to avoid this issue but it will likely get blocked by the GFW if traffic went up

PencilNavigator•7/12/23, 3:19 PM

there are also many ways GFW uses to block traffic for certain sites, for cloudflare protected sites they use SNI block (also perodically blocking traffic to cloudflare IPs), for google they blocked all google IPs, etc.

Original message was deleted

PencilNavigator•7/12/23, 4:12 PM

ESNI packs will simply just get dropped before getting out of china route

PencilNavigator•7/12/23, 4:13 PM

ECH is based on DoH which gets blocked too just like DoT

PencilNavigator•7/12/23, 4:14 PM

well they managed to block it

PencilNavigator•7/12/23, 4:14 PM

not only, the IPs too

ChaikaOP•7/12/23, 4:15 PM

ech isn't based on doh or require it either, but I'm guessing they could somewhat easily block all connections with encrypted sni or encrypted client hello with deep packet inspection

CChaika ech isn't based on doh or require it either, but I'm guessing they could somewha...

PencilNavigator•7/12/23, 4:15 PM

yes

PencilNavigator•7/12/23, 4:15 PM

connections are blocked if sth like esni is detected

PencilNavigator•7/12/23, 4:15 PM

just to note esni works fine inside china network

PencilNavigator•7/12/23, 4:16 PM

but going out of china network it likely won't work

ChaikaOP•7/12/23, 4:18 PM

apparently it's not a simple matter of inspecting the packets, at least according to google, and I guess ech/esni was designed to literally counter that. ECH has really low adoption right now eitherway

EErisa https://developers.cloudflare.com/ddos-protection/managed-rulesets/http/configur...

lokiwind•7/12/23, 5:00 PM

Erisa hello, when using this api, the ddos_l7 ddos_l7 ruleset kind
kind
should be "zonezone", right?

lokiwind•7/12/23, 5:01 PM

I didn't see it in the documentation

fleabeard•7/12/23, 5:54 PM

Anyone know if it's possible to self-host subdomain.website.comsubdomain.website.com while simultaneously hosting website.comwebsite.com through Cloudflare's DNS?

Ffleabeard Anyone know if it's possible to self-host `subdomain.website.com` while simultan...

ChaikaOP•7/12/23, 5:56 PM

Self-host DNS for it? Yea, you can create NS Records in Cloudflare to delegate the subdomain to your own nameservers.
If you just mean a normal web server (a/aaaa/cname), then yea you can just create those records unproxied

CChaika Self-host DNS for it? Yea, you can create NS Records in Cloudflare to delegate t...

fleabeard•7/12/23, 5:57 PM

Thanks, I think the first is what I'm after. My domain is hosted on Cloudflare, but I want to self-host a subdomain from my own server at home. So a NS record is what I would want to use here?

ChaikaOP•7/12/23, 5:59 PM

What do you mean "self-host a subdomain"? Do you want to host the DNS for it (like with bind or powerdns), or do you want to just serve a non-proxied (i.e straight to your origin, not through Cloudflare) Web Server/other type of server?

CChaika What do you mean "self-host a subdomain"? Do you want to host the DNS for it (li...

fleabeard•7/12/23, 6:05 PM

Hmm, that's a good question lol. Currently my root website.com is proxied through Cloudflare to my Linode VPS. I was hoping to point (hopefully proxied) to my self-hosted server for the subdomain.com website. I believe pfSense has a Dynamic DDNS function for Cloudflare to do this but I'm not entirely sure how to plumb it all to get it working. If that makes sense?

Ffleabeard Hmm, that's a good question lol. Currently my root website.com is proxied throug...

ChaikaOP•7/12/23, 6:09 PM

That makes sense yea, your initial wording made me think you were trying to do something different.
Cloudflare offers something called Cloudflare Tunnels, which you can install on your self-hosted server, they establish an outbound connection to Cloudflare, and then proxy requests to your local web server. They are very handy for self-hosting, they don't require any port forwarding or dynamic dns, they don't care at all if your IP changes since they connect outbound: https://developers.cloudflare.com/cloudflare-one/connections/connect-apps/install-and-setup/tunnel-guide/remote/

Alternatively, you could use something like dynamic dns utlity with Cloudflare support and port forward either proxied or unproxied

Via the dashboard · Cloudflare Zero Trust docs

Follow this step-by-step guide to get your first tunnel up and running using Zero Trust.