ech isn't based on doh or require it either, but I'm guessing they could somewhat easily block all c

ech isn't based on doh or require it either, but I'm guessing they could somewhat easily block all connections with encrypted sni or encrypted client hello with deep packet inspection

CChaika ech isn't based on doh or require it either, but I'm guessing they could somewha...

PencilNavigator•7/12/23, 4:15 PM

yes

PencilNavigator•7/12/23, 4:15 PM

connections are blocked if sth like esni is detected

PencilNavigator•7/12/23, 4:15 PM

just to note esni works fine inside china network

PencilNavigator•7/12/23, 4:16 PM

but going out of china network it likely won't work

ChaikaOP•7/12/23, 4:18 PM

apparently it's not a simple matter of inspecting the packets, at least according to google, and I guess ech/esni was designed to literally counter that. ECH has really low adoption right now eitherway

EErisa https://developers.cloudflare.com/ddos-protection/managed-rulesets/http/configur...

lokiwind•7/12/23, 5:00 PM

Erisa hello, when using this api, the

ddos_l7

ddos_l7

ruleset kind
kind
should be "zone
zone
", right?

lokiwind•7/12/23, 5:01 PM

I didn't see it in the documentation

fleabeard•7/12/23, 5:54 PM

Anyone know if it's possible to self-host

subdomain.website.com

subdomain.website.com

while simultaneously hosting

website.com

website.com

through Cloudflare's DNS?

Ffleabeard Anyone know if it's possible to self-host `subdomain.website.com` while simultan...

ChaikaOP•7/12/23, 5:56 PM

Self-host DNS for it? Yea, you can create NS Records in Cloudflare to delegate the subdomain to your own nameservers.
If you just mean a normal web server (a/aaaa/cname), then yea you can just create those records unproxied

CChaika Self-host DNS for it? Yea, you can create NS Records in Cloudflare to delegate t...

fleabeard•7/12/23, 5:57 PM

Thanks, I think the first is what I'm after. My domain is hosted on Cloudflare, but I want to self-host a subdomain from my own server at home. So a NS record is what I would want to use here?

ChaikaOP•7/12/23, 5:59 PM

What do you mean "self-host a subdomain"? Do you want to host the DNS for it (like with bind or powerdns), or do you want to just serve a non-proxied (i.e straight to your origin, not through Cloudflare) Web Server/other type of server?

CChaika What do you mean "self-host a subdomain"? Do you want to host the DNS for it (li...

fleabeard•7/12/23, 6:05 PM

Hmm, that's a good question lol. Currently my root website.com is proxied through Cloudflare to my Linode VPS. I was hoping to point (hopefully proxied) to my self-hosted server for the subdomain.com website. I believe pfSense has a Dynamic DDNS function for Cloudflare to do this but I'm not entirely sure how to plumb it all to get it working. If that makes sense?

Ffleabeard Hmm, that's a good question lol. Currently my root website.com is proxied throug...

ChaikaOP•7/12/23, 6:09 PM

That makes sense yea, your initial wording made me think you were trying to do something different.
Cloudflare offers something called Cloudflare Tunnels, which you can install on your self-hosted server, they establish an outbound connection to Cloudflare, and then proxy requests to your local web server. They are very handy for self-hosting, they don't require any port forwarding or dynamic dns, they don't care at all if your IP changes since they connect outbound: https://developers.cloudflare.com/cloudflare-one/connections/connect-apps/install-and-setup/tunnel-guide/remote/

Alternatively, you could use something like dynamic dns utlity with Cloudflare support and port forward either proxied or unproxied

Via the dashboard · Cloudflare Zero Trust docs

Follow this step-by-step guide to get your first tunnel up and running using Zero Trust.

fleabeard•7/12/23, 6:10 PM

Yeah, I'm sorry. I'm a newb at all of this so my wording will be problematic

fleabeard•7/12/23, 6:16 PM

I guess what I need is the temporary IPv4 Address. I think it used to be 1.1.1.11.1.1.1 but was changed. Do you happen to know what that would be?

fleabeard•7/12/23, 6:16 PM

Following this as a guide https://www.youtube.com/watch?v=8GYs61ThGBM

MattIPv4•7/12/23, 6:19 PM

https://developers.cloudflare.com/dns/troubleshooting/faq/#what-ip-should-i-use-for-parked-domain--redirect-only--originless-setup you can use 192.0.2.0

fleabeard•7/12/23, 6:20 PM

Cheers!

fleabeard•7/12/23, 6:24 PM

That got me sorted, thanks to you both

who wants to vex mutumboooo•7/12/23, 6:59 PM

is it possible to purchase / register domains via API for non enterprise customers?

Erisa•7/12/23, 7:04 PM

No, it's not

Cyb3r-Jak3•7/12/23, 9:44 PM

You just delete the application covering the URL

Cyb3r-Jak3•7/12/23, 9:44 PM

There is a free plan for up to 50 users

Cyb3r-Jak3•7/12/23, 9:44 PM

How did you set it up?

Cyb3r-Jak3•7/12/23, 9:46 PM

You can put in payment info for it then delete it. It isn't used unless you go over 50 users

Unsmart•7/12/23, 9:47 PM

You might be able to use the API otherwise yeah you might have to enter in the card to use it

Unsmart•7/12/23, 9:47 PM

https://developers.cloudflare.com/api/

Cloudflare API Documentation

Interact with Cloudflare's products and services via the Cloudflare API

Salamus•7/12/23, 10:16 PM

// Create allowlist rule
curl_setopt($ch, CURLOPT_URL, "https://api.cloudflare.com/client/v4/zones/$zone_id/firewall/rules");
curl_setopt($ch, CURLOPT_POSTFIELDS, json_encode(array(
    'filter' => array(
        'expression' => $allowlist_rule
    ),
    'action' => 'allow'
)));

$result = curl_exec($ch);
echo $result;
// Check if allowlist rule addition is successful
if ($result->success === false) {
    echo "Failed to add allowlist rule for domain {$domain} to Cloudflare\n";
    continue;
}

// Create denyrule rule
curl_setopt($ch, CURLOPT_URL, "https://api.cloudflare.com/client/v4/zones/$zone_id/firewall/rules");
curl_setopt($ch, CURLOPT_POSTFIELDS, json_encode(array(
    'filter' => array(
        'expression' => $denyrule_rule
    ),
    'action' => 'block'
)));

// Create allowlist rule
curl_setopt($ch, CURLOPT_URL, "https://api.cloudflare.com/client/v4/zones/$zone_id/firewall/rules");
curl_setopt($ch, CURLOPT_POSTFIELDS, json_encode(array(
    'filter' => array(
        'expression' => $allowlist_rule
    ),
    'action' => 'allow'
)));

$result = curl_exec($ch);
echo $result;
// Check if allowlist rule addition is successful
if ($result->success === false) {
    echo "Failed to add allowlist rule for domain {$domain} to Cloudflare\n";
    continue;
}

// Create denyrule rule
curl_setopt($ch, CURLOPT_URL, "https://api.cloudflare.com/client/v4/zones/$zone_id/firewall/rules");
curl_setopt($ch, CURLOPT_POSTFIELDS, json_encode(array(
    'filter' => array(
        'expression' => $denyrule_rule
    ),
    'action' => 'block'
)));

is this code irregular? It gives an error
"code": 10014,
"message": "firewallrules.api.malformed_request_body"

the expression rule is alright, copied it myself from a working domain

btw i used php

lokiwind•7/13/23, 12:35 PM

I want to prevent users using opera vpn from accessing my website.
Can I do this with workers
What kind of query should I use if I can

// Create allowlist rule curl_setopt($ch, CURLOPT_URL, "https://api.cloudflare.com/client/v4/zones/$zone_id/firewall/rules"); curl_setopt($ch, CURLOPT_POSTFIELDS, json_encode(array( 'filter' => array( 'expression' => $allowlist_rule ), 'action' => 'allow' ))); $result = curl_exec($ch); echo $result; // Check if allowlist rule addition is successful if ($result->success === false) { echo "Failed to add allowlist rule for domain {$domain} to Cloudflare\n"; continue; } // Create denyrule rule curl_setopt($ch, CURLOPT_URL, "https://api.cloudflare.com/client/v4/zones/$zone_id/firewall/rules"); curl_setopt($ch, CURLOPT_POSTFIELDS, json_encode(array( 'filter' => array( 'expression' => $denyrule_rule ), 'action' => 'block' )));

ech isn't based on doh or require it either, but I'm guessing they could somewhat easily block all c

Similar Threads

Similar Threads

Similar Threads