How do I disable ratelimits for a domain on a Cloudflare Tunnel?

I have a Nextcloud instance that goes through Cloudflare Tunnel and I am consistently hitting the ratelimit. This has never happened before and I just want to get rid of it. I can't seem to figure it out, would appreciate any help, thanks!

DanielOP•1/8/24, 4:04 AM

I never changed any of the ratelimiting rules, this appears to be new default behavior

DanielOP•1/8/24, 4:06 AM

DanielOP•1/8/24, 4:06 AM

DDaniel Click to see attachment

Erisa•1/8/24, 8:34 AM

The rate limit with rule ID of worker can be removed upon request to support if you are on a paid Workers plan. Please create a support ticket.

Erisa•1/8/24, 8:34 AM

?support

Flare•1/8/24, 8:34 AM

To contact Cloudflare Support about an issue, please visit the Support Portal and fill in the form on the portal. After submission, you will receive confirmation over email.

Some issues, such as Account or Billing related issues, cannot be solved by the community. Any plan level can open a ticket for these topics.
For more information on the methods by which you can contact Support for your plan level, see Contacting Cloudflare Support - Cloudflare Docs

Erisa•1/8/24, 8:35 AM

The limit is documented here https://developers.cloudflare.com/workers/platform/limits/#request

Cloudflare’s abuse protection methods do not affect well-intentioned traffic. However, if you send many thousands of requests per second from a small number of client IP addresses, you can inadvertently trigger Cloudflare’s abuse protection.

Erisa•1/8/24, 10:12 AM

They probably used inspect element to redact their domain

Erisa•1/8/24, 10:12 AM

the same way it says ipv6-address

Erisa•1/8/24, 10:12 AM

which is the high effort way to do it

EErisa The rate limit with rule ID of worker can be removed upon request to support if ...

DanielOP•1/8/24, 12:02 PM

Wait, so I cannot get rid of this if I'm on the free plan?

Erisa•1/8/24, 12:03 PM

Are you on Workers Free?

DanielOP•1/8/24, 12:03 PM

Yeah

Erisa•1/8/24, 12:03 PM

In fact, are you using Workers at all?

Erisa•1/8/24, 12:03 PM

Can you explain more?

DanielOP•1/8/24, 12:03 PM

I never messed with that stuff

DanielOP•1/8/24, 12:03 PM

All I'm using are Cloudflare Tunnels to access nextcloud and other services

DanielOP•1/8/24, 12:03 PM

My guess is that Nextcloud is sending a bunch of individual requests when syncing, which causes it to constantly hit the ratelimit

Erisa•1/8/24, 12:04 PM

That's odd then since the rate limit is specific for Workers.
Do you have other "Optimization" features enabled on the zone like Early Hints or Automatic Signed Exchanges?

DanielOP•1/8/24, 12:04 PM

I was setting up a new computer, which meant downloading all the files I want to be synced. I've done this many times before without any issues on the Cloudflare-end of things, so it's odd to see it ratelimit now

EErisa That's odd then since the rate limit is specific for Workers. Do you have other ...

DanielOP•1/8/24, 12:04 PM

Where can I check that?

Erisa•1/8/24, 12:05 PM

https://dash.cloudflare.com/?to=/:account/:zone/speed/optimization/recommendations and https://dash.cloudflare.com/?to=/:account/:zone/speed/optimization/other

Erisa•1/8/24, 12:05 PM

Also the IPv6 address you redacted, is it

2a06:98c0:3600::103

2a06:98c0:3600::103

? That's the IP for requests coming from Workers

DanielOP•1/8/24, 12:06 PM

DanielOP•1/8/24, 12:07 PM

It's my actual IPv6 address (just looked it up)

Erisa•1/8/24, 12:07 PM

Okay

Erisa•1/8/24, 12:07 PM

Can you check the optimization settings then?

DanielOP•1/8/24, 12:07 PM

Yeah doing that rn

Erisa•1/8/24, 12:07 PM

I'm wondering if one of the ones which is implemented with Workers in the backend might be interfering

DanielOP•1/8/24, 12:08 PM

DanielOP•1/8/24, 12:08 PM

DDaniel Click to see attachment

Erisa•1/8/24, 12:08 PM

Its cropped too early for me to see Early Hints

DanielOP•1/8/24, 12:09 PM

My bad

DanielOP•1/8/24, 12:09 PM

It's enabled

DanielOP•1/8/24, 12:09 PM

Should I disable it?

Erisa•1/8/24, 12:09 PM

Yes can you try disabling it

Erisa•1/8/24, 12:10 PM

I appreciate this isn't something that's made immediately clear and actually shouldn't be happening in the first place, but hopefully it helps

DanielOP•1/8/24, 12:11 PM

I'll have to wait until tonight when I'm back at the computer with the issue (the big nextcloud sync). I'll let you know if it fails or succeeds, thank you for your help

Erisa•1/8/24, 12:11 PM

The logic I'm followiig here is that Early Hints is implemented using a Worker in the backend of the feature, so its possible the system is mistakenly attributing these Worker requests to your zone and rate limiting them with the Worker rate limit

DDaniel I'll have to wait until tonight when I'm back at the computer with the issue (th...

Erisa•1/8/24, 12:11 PM

No problem, ping me whenever and I'll respond if/when I'm around

DanielOP•1/8/24, 12:13 PM

One extra thing to note:

The one thing I did change recently was adding a configurable "offline" page to show when a KVP is true, which is to be used when my server is under scheduled maintenance. I am using workers routes for these. I'm not too familiar with this, so perhaps that could have been the cause?

Erisa•1/8/24, 12:22 PM

Is the route active all the time?

DanielOP•1/8/24, 12:29 PM

Actually I think so

DanielOP•1/8/24, 12:29 PM

It's only supposed to show a separate page when a KVP is set to true

DanielOP•1/8/24, 12:29 PM

But I think everything is always going through it, which could explain the ratelimit

DanielOP•1/8/24, 12:31 PM

The worker:

export default {
  async fetch(request, env, ctx) {
    const url = new URL(request.url);
    if (url.pathname === "/status") {
      let currentState = await env.MAINTENANCE_KV.get("maintenance");
      return new Response(`Maintenance mode ${currentState}`, { status: 200 });
    }

    let maintenanceMode = await env.MAINTENANCE_KV.get("maintenance");

    if (maintenanceMode === "on" || url.toString().includes("maintenance.example.com")) {
      const html = <"html of the page as a string">;
      return new Response(html, { status: 503, headers: {
        "content-type": "text/html;charset=UTF-8",
      }, });
    }
    return fetch(request);
  },
}

export default {
  async fetch(request, env, ctx) {
    const url = new URL(request.url);
    if (url.pathname === "/status") {
      let currentState = await env.MAINTENANCE_KV.get("maintenance");
      return new Response(`Maintenance mode ${currentState}`, { status: 200 });
    }

    let maintenanceMode = await env.MAINTENANCE_KV.get("maintenance");

    if (maintenanceMode === "on" || url.toString().includes("maintenance.example.com")) {
      const html = <"html of the page as a string">;
      return new Response(html, { status: 503, headers: {
        "content-type": "text/html;charset=UTF-8",
      }, });
    }
    return fetch(request);
  },
}

DanielOP•1/8/24, 12:31 PM

Can I disable it without deleting it? I don't see a button anywhere

Erisa•1/8/24, 12:32 PM

You can remove the route but keep the worker

Erisa•1/8/24, 12:32 PM

Then to re-enable just add the route back

export default { async fetch(request, env, ctx) { const url = new URL(request.url); if (url.pathname === "/status") { let currentState = await env.MAINTENANCE_KV.get("maintenance"); return new Response(`Maintenance mode ${currentState}`, { status: 200 }); } let maintenanceMode = await env.MAINTENANCE_KV.get("maintenance"); if (maintenanceMode === "on" || url.toString().includes("maintenance.example.com")) { const html = <"html of the page as a string">; return new Response(html, { status: 503, headers: { "content-type": "text/html;charset=UTF-8", }, }); } return fetch(request); }, }

How do I disable ratelimits for a domain on a Cloudflare Tunnel?

Similar Threads

Similar Threads

Similar Threads