Most of the images comes from `assets.mysite.com`, but I have a part where I bring some of the image

RRapid Most of the images comes from `assets.mysite.com`, but I have a part where I bri...

C

Chaika•3/21/24, 7:25 PM

The way you use Image Resizing is either through the URL or through a Worker
The URL is like this:
If it's on the same hostname, you can give it a relative path:
https://i.chaika.me/cdn-cgi/image/width=1800,quality=75,format=auto/e9ed1ae4adfe4c8d8ea938d1a3c7f67f
or, you can give it the full url
https://i.chaika.me/cdn-cgi/image/width=1800,quality=75,format=auto/https://i.chaika.me/e9ed1ae4adfe4c8d8ea938d1a3c7f67f

C

Chaika•3/21/24, 7:25 PM

If you enable resize from any origin, you can pass in any website there and it'll resize it.

C

Chaika•3/21/24, 7:25 PM

Or you can use a Worker to restrict it better, but you'd be paying for a worker invocation on every image (still not too expensive though)

R

RapidOP•3/21/24, 9:02 PM

I see, okay, yeah I need it for another domain that is not mine, wonder why there's no simple config to do that though

CChaika If you enable resize from any origin, you can pass in any website there and it'l...

R

RapidOP•3/21/24, 9:03 PM

Where is "there" btw

RRapid Where is "there" btw

C

Chaika•3/21/24, 9:03 PM

at the end of the url like in:
https://i.chaika.me/cdn-cgi/image/width=1800,quality=75,format=auto/https://i.chaika.me/e9ed1ae4adfe4c8d8ea938d1a3c7f67f

C

Chaika•3/21/24, 9:03 PM

https://developers.cloudflare.com/images/transform-images/transform-via-url/

Cloudflare Docs

Transform via URL · Cloudflare Image Optimization docs

You can convert and resize images by requesting them via a specially-formatted URL. This way you do not need to write any code, only change HTML …

C

Chaika•3/21/24, 9:03 PM

https://<ZONE>/cdn-cgi/image/<OPTIONS>/<SOURCE-IMAGE>

R

RapidOP•3/21/24, 9:03 PM

Oh didn't notice the full URL. Thanks

R

RapidOP•3/21/24, 9:04 PM

Yeah I have done it for most of my site, just missing on external URLs (contentful)

L

LeonB•3/21/24, 9:26 PM

hello, I'm interested to use the live stream feature described here.
https://developers.cloudflare.com/stream/get-started#start-your-first-live-stream
I have an encoder in AWS that is outputting live video 24/7 and I'd like to send it to cloudflare. thing is, the video is in MPEG DASH format. the encoder can do http POSTS as needed in step 1 of the doc. but for my clients I'll need a DASH MPD url rather than a RTMPS url. Is this possible?

Cloudflare Docs

Get started · Cloudflare Stream docs

You must first create a Cloudflare account and create an API token to begin using Stream.

L

LeonB•3/21/24, 9:27 PM

here is an example of the type of player that will need to play the video:
https://reference.dashif.org/dash.js/latest/samples/dash-if-reference-player/index.html

Dash JavaScript Player

LLeonB hello, I'm interested to use the live stream feature described here. https://dev...

I

Isaac McFadyen•3/21/24, 9:42 PM

I don't believe Stream can do inputs from DASH unfortunately.

L

LeonB•3/21/24, 9:49 PM

ok, thx for the info

KKasumi Firewalld should log everything and there are no different logs where I can look...

D

DarkDeviL•3/21/24, 10:40 PM

Have you tried looking at your firewall rules, having the following in your mind?

-> First rule that matches wins, following rules (or actions) are not taken.

KKasumi Click to see attachment

D

DarkDeviL•3/21/24, 10:41 PM

sudo firewall-cmd --permanent --zone=dmz --add-rich-rule='rule family="ipv4" source address="0.0.0.0/0" service name="http" drop'
sudo firewall-cmd --permanent --zone=dmz --add-rich-rule='rule family="ipv4" source address="0.0.0.0/0" service name="https" drop'

sudo firewall-cmd --permanent --zone=dmz --add-rich-rule='rule family="ipv4" source address="0.0.0.0/0" service name="http" drop'
sudo firewall-cmd --permanent --zone=dmz --add-rich-rule='rule family="ipv4" source address="0.0.0.0/0" service name="https" drop'

sudo firewall-cmd --permanent --zone=dmz --add-rich-rule='rule family="ipv4" source address="0.0.0.0/0" service name="http" drop'
sudo firewall-cmd --permanent --zone=dmz --add-rich-rule='rule family="ipv4" source address="0.0.0.0/0" service name="https" drop'

sudo firewall-cmd --permanent --zone=dmz --add-rich-rule='rule family="ipv4" source address="0.0.0.0/0" service name="http" drop'
sudo firewall-cmd --permanent --zone=dmz --add-rich-rule='rule family="ipv4" source address="0.0.0.0/0" service name="https" drop'

These two rules are NOT have any logging enabled.

K

Kasumi•3/21/24, 10:41 PM

Should be. Because it worked once

KKasumi Click to see attachment

D

DarkDeviL•3/21/24, 10:42 PM

Since you have the above two DROP rules, it will NEVER get to

LogDenied=all

LogDenied=all

.

DDarkDeviL ``` sudo firewall-cmd --permanent --zone=dmz --add-rich-rule='rule family="ipv4"...

K

Kasumi•3/21/24, 10:42 PM

Never learned how to enable the logging for it

D

DarkDeviL•3/21/24, 10:43 PM

In addition the above mentions, you can also play with the priority, if needed.

K

Kasumi•3/21/24, 10:45 PM

Never used that

D

DarkDeviL•3/21/24, 10:45 PM

The same (e.g. the order matters) happens with

iptables -A

iptables -A

and

iptables -I [optional_position]

iptables -I [optional_position]

.

If you already have a previous rule matching, then appending with

iptables -A

iptables -A

, the new rule you add would never match, you would need

iptables -I [optional_position]

iptables -I [optional_position]

to insert it before the previous rule.

K

Kasumi•3/21/24, 10:45 PM

Do I need to remove all ingress rules or can I re place then

K

Kasumi•3/21/24, 10:46 PM

Its like that rn

K

Kasumi•3/21/24, 10:48 PM

In the offline one it looks like that

D

DarkDeviL•3/21/24, 10:50 PM

Assuming you want logging for the two DROP rules you have, you could try something like:

sudo firewall-cmd --permanent --zone=dmz --add-rich-rule='rule family="ipv4" source address="0.0.0.0/0" service name="http" log prefix="HTTP-/080-DROP: " drop'
sudo firewall-cmd --permanent --zone=dmz --add-rich-rule='rule family="ipv4" source address="0.0.0.0/0" service name="https" log prefix="HTTPS/443-DROP: " drop'

sudo firewall-cmd --permanent --zone=dmz --add-rich-rule='rule family="ipv4" source address="0.0.0.0/0" service name="http" log prefix="HTTP-/080-DROP: " drop'
sudo firewall-cmd --permanent --zone=dmz --add-rich-rule='rule family="ipv4" source address="0.0.0.0/0" service name="https" log prefix="HTTPS/443-DROP: " drop'

sudo firewall-cmd --permanent --zone=dmz --add-rich-rule='rule family="ipv4" source address="0.0.0.0/0" service name="http" log prefix="HTTP-/080-DROP: " drop'
sudo firewall-cmd --permanent --zone=dmz --add-rich-rule='rule family="ipv4" source address="0.0.0.0/0" service name="https" log prefix="HTTPS/443-DROP: " drop'

sudo firewall-cmd --permanent --zone=dmz --add-rich-rule='rule family="ipv4" source address="0.0.0.0/0" service name="http" log prefix="HTTP-/080-DROP: " drop'
sudo firewall-cmd --permanent --zone=dmz --add-rich-rule='rule family="ipv4" source address="0.0.0.0/0" service name="https" log prefix="HTTPS/443-DROP: " drop'

K

Kasumi•3/21/24, 10:51 PM

okay

D

DarkDeviL•3/21/24, 10:51 PM

At this point, I'm not sure if "/" is an acceptable character there though.

D

DarkDeviL•3/21/24, 10:51 PM

However:

K

Kasumi•3/21/24, 10:51 PM

but I have to remove the accept ones and drop ones and add them new=

KKasumi Click to see attachment

D

DarkDeviL•3/21/24, 10:52 PM

Stuff like what you see here: "filter_IN_dmz_REJECT"

D

DarkDeviL•3/21/24, 10:52 PM

HTTP-/080-DROP:

HTTP-/080-DROP:

and

HTTPS/443-DROP:

HTTPS/443-DROP:

will literally be the tag in the above example

D

DarkDeviL•3/21/24, 10:52 PM

The

-/080

-/080

is just an example for alignment purposes, so they have the same length...

K

Kasumi•3/21/24, 10:53 PM

okay

D

DarkDeviL•3/21/24, 10:53 PM

If the

complains, you can name them

INSECURE-HTTP-DROP

INSECURE-HTTP-DROP

and

SECURE-HTTP-DROP

SECURE-HTTP-DROP

/

SECURE-HTTPS-DROP

SECURE-HTTPS-DROP

instead or whatever you prefer.

K

Kasumi•3/21/24, 10:54 PM

Okay so I can just paste it and remove the old drops?

D

DarkDeviL•3/21/24, 10:54 PM

Yes.

K

Kasumi•3/21/24, 10:54 PM

Okay

K

Kasumi•3/21/24, 10:54 PM

I'll try

K

Kasumi•3/21/24, 10:59 PM

Should I replace the Cloudflare IPSet and accept rules in the one file to the top and everything to the bottom?

K

Kasumi•3/21/24, 10:59 PM

dont want to remove everything :gx_laugh:

D

DarkDeviL•3/21/24, 11:00 PM

But again, my suspicion it would be the order of priority that makes it all fall apart.

sudo firewall-cmd --permanent --zone=dmz --add-rich-rule='rule family="ipv4" priority=1 source ipset="Cloudflarev4" service name="https" accept'
sudo firewall-cmd --permanent --zone=dmz --add-rich-rule='rule family="ipv6" priority=1 source ipset="Cloudflarev6" service name="https" accept'
sudo firewall-cmd --permanent --zone=dmz --add-rich-rule='rule family="ipv4" priority=1 source ipset="Cloudflarev4" service name="http" accept'
sudo firewall-cmd --permanent --zone=dmz --add-rich-rule='rule family="ipv6" priority=1 source ipset="Cloudflarev6" service name="http" accept'
sudo firewall-cmd --permanent --zone=dmz --add-rich-rule='rule family="ipv4" priority=32767 source address="0.0.0.0/0" service name="http" drop'
sudo firewall-cmd --permanent --zone=dmz --add-rich-rule='rule family="ipv4" priority=32767 source address="0.0.0.0/0" service name="https" drop'

sudo firewall-cmd --permanent --zone=dmz --add-rich-rule='rule family="ipv4" priority=1 source ipset="Cloudflarev4" service name="https" accept'
sudo firewall-cmd --permanent --zone=dmz --add-rich-rule='rule family="ipv6" priority=1 source ipset="Cloudflarev6" service name="https" accept'
sudo firewall-cmd --permanent --zone=dmz --add-rich-rule='rule family="ipv4" priority=1 source ipset="Cloudflarev4" service name="http" accept'
sudo firewall-cmd --permanent --zone=dmz --add-rich-rule='rule family="ipv6" priority=1 source ipset="Cloudflarev6" service name="http" accept'
sudo firewall-cmd --permanent --zone=dmz --add-rich-rule='rule family="ipv4" priority=32767 source address="0.0.0.0/0" service name="http" drop'
sudo firewall-cmd --permanent --zone=dmz --add-rich-rule='rule family="ipv4" priority=32767 source address="0.0.0.0/0" service name="https" drop'

sudo firewall-cmd --permanent --zone=dmz --add-rich-rule='rule family="ipv4" priority=1 source ipset="Cloudflarev4" service name="https" accept'
sudo firewall-cmd --permanent --zone=dmz --add-rich-rule='rule family="ipv6" priority=1 source ipset="Cloudflarev6" service name="https" accept'
sudo firewall-cmd --permanent --zone=dmz --add-rich-rule='rule family="ipv4" priority=1 source ipset="Cloudflarev4" service name="http" accept'
sudo firewall-cmd --permanent --zone=dmz --add-rich-rule='rule family="ipv6" priority=1 source ipset="Cloudflarev6" service name="http" accept'
sudo firewall-cmd --permanent --zone=dmz --add-rich-rule='rule family="ipv4" priority=32767 source address="0.0.0.0/0" service name="http" drop'
sudo firewall-cmd --permanent --zone=dmz --add-rich-rule='rule family="ipv4" priority=32767 source address="0.0.0.0/0" service name="https" drop'

sudo firewall-cmd --permanent --zone=dmz --add-rich-rule='rule family="ipv4" priority=1 source ipset="Cloudflarev4" service name="https" accept'
sudo firewall-cmd --permanent --zone=dmz --add-rich-rule='rule family="ipv6" priority=1 source ipset="Cloudflarev6" service name="https" accept'
sudo firewall-cmd --permanent --zone=dmz --add-rich-rule='rule family="ipv4" priority=1 source ipset="Cloudflarev4" service name="http" accept'
sudo firewall-cmd --permanent --zone=dmz --add-rich-rule='rule family="ipv6" priority=1 source ipset="Cloudflarev6" service name="http" accept'
sudo firewall-cmd --permanent --zone=dmz --add-rich-rule='rule family="ipv4" priority=32767 source address="0.0.0.0/0" service name="http" drop'
sudo firewall-cmd --permanent --zone=dmz --add-rich-rule='rule family="ipv4" priority=32767 source address="0.0.0.0/0" service name="https" drop'

MIGHT be able to fix that, if you insist on the two drop rules.

C

Cyb3r-Jak3•3/21/24, 11:00 PM

Could this pleased be moved to a thread.

CCyb3r-Jak3 Could this pleased be moved to a thread.

K

Kasumi•3/21/24, 11:00 PM

:thumbsUpYesAbsolutely:

CCyb3r-Jak3 Could this pleased be moved to a thread.

D

DarkDeviL•3/21/24, 11:01 PM

I was actually thinking myself to suggest we moved it to #off-topic, as it is somewhat more firewall than Cloudflare now, but I'll

on thread too.

E

Erisa•3/21/24, 11:18 PM

Thread is fine, no need for off-topic

K

Kasumi•3/21/24, 11:18 PM

Yes

R

Ray•3/21/24, 11:25 PM

K

Kasumi•3/21/24, 11:25 PM

Soon

A

addison•3/22/24, 4:37 AM

any reason why a video proxied from b2 to cloudflare would not let you seek?

Most of the images comes from `assets.mysite.com`, but I have a part where I bring some of the image

Similar Threads

Similar Threads

Similar Threads