China : Weird bypassing of WAF and Some many redirects

! EpickyHrac · 2024-05-28T19:41:01.641Z

[img](http://zl.epik.tk/u/2024-05-28_14-59-47_NTB.png) i have China IP and cant resolve? [img](http://zl.epik.tk/u/2024-05-28_15-03-29_NTB.png) this works but in CN dont work website on subdomain Hi, I setuped custom site in subdomain only for China country, but i got many many redirects, I dont have idea, why. Please lookup and help me. In `log.log `i run command `curl -L -v epik.tk # but work on CN ip only`. --- ## Settings from dashboard: - [img](http://zl.epik.tk/u/2024-05-28_21-41-40_NTB.png)

!

! EpickyHracOP•5/28/24, 7:43 PM

img img

!

! EpickyHracOP•5/28/24, 7:44 PM

and WAF img (to block non "chinese" traffic)

D

DarkDeviL•5/28/24, 7:45 PM

As for the image under "Redirect Rules
Redirect Rules
Redirect Rules
Redirect Rules" you're linking to, http://zl.epik.tk/u/2024-05-28_21-41-40_NTB.png

change the condition there to become:

hen incoming requests match...

Hostname <-> does not equal <->

cn.epik.tk

cn.epik.tk

cn.epik.tk

cn.epik.tk
AND
Country <-> equals <-> China

D

DarkDeviL•5/28/24, 7:47 PM

By only having the "Country" option, it will redirect everyone, including those that are already on the

cn.epik.tk

cn.epik.tk

cn.epik.tk

cn.epik.tk sub-domain.

DDarkDeviL As for the image under "**`Redirect Rules`**" you're linking to, <http://zl.epik...

!

! EpickyHracOP•5/28/24, 7:48 PM

Okay Changed

!

! EpickyHracOP•5/28/24, 7:48 PM

And works!

!

! EpickyHracOP•5/28/24, 7:48 PM

img

!

! EpickyHracOP•5/28/24, 7:48 PM

Thanks!

!

! EpickyHracOP•5/28/24, 7:49 PM

How i mark as solved

!! EpickyHrac Thanks!

D

DarkDeviL•5/28/24, 7:50 PM

You're welcome, happy to hear it worked.

DDarkDeviL You're welcome, happy to hear it worked. 🙂

!

! EpickyHracOP•5/28/24, 7:50 PM

!! EpickyHrac How i mark as solved 😅 😄

D

DarkDeviL•5/28/24, 7:53 PM

If you right click your thread, can't you under "Edit Tags
Edit Tags
Edit Tags
Edit Tags" add the Solved tag?

!

! EpickyHracOP•5/28/24, 7:54 PM

I check

D

DarkDeviL•5/28/24, 7:54 PM

https://support.discord.com/hc/article_attachments/6289830999063

D

DarkDeviL•5/28/24, 7:54 PM

(Stolen from https://support.discord.com/hc/en-us/articles/6208479917079-Forum-Channels-FAQ)

!

! EpickyHracOP•5/28/24, 7:54 PM

Yes, i can

!

! EpickyHracOP•5/28/24, 7:54 PM

Thx

!

! EpickyHracOP•6/17/24, 4:43 PM

Okay I am back

!

! EpickyHracOP•6/17/24, 4:43 PM

I spotted wierd traffic ignoring WAF rules

!

! EpickyHracOP•6/17/24, 4:44 PM

somehow from China IP, is accasible root domain what i disabled (and replaced to cn.epik.tk as a redirect)

!

! EpickyHracOP•6/17/24, 4:46 PM

ip
```
a2409:###:###:c2f3::1
```
a2409:###:###:c2f3::1
```
a2409:###:###:c2f3::1
```
a2409:###:###:c2f3::1
and ray-id
```
 8951dbd8ae9907a1-HKG 
```
8951dbd8ae9907a1-HKG
```
 8951dbd8ae9907a1-HKG 
```
8951dbd8ae9907a1-HKG
asn :
```
9808
```
9808
```
9808
```
9808
ua:

!! EpickyHrac - ip `a2409:###:###:c2f3::1` - and ray-id` 8951dbd8ae9907a1-HKG ` - asn : `9808`...

D

DarkDeviL•6/17/24, 4:57 PM

Although AS 9808 seems quite Chinese, are you able to share the actual IP?

D

DarkDeviL•6/17/24, 4:58 PM

Also, how exactly are you coming to the conclusion that WAF rules are ignored / bypassed?

DDarkDeviL Also, how exactly are you coming to the conclusion that WAF rules are ignored / ...

!

! EpickyHracOP•6/17/24, 5:44 PM

i dont see that i got that information from api not web

DDarkDeviL Although AS 9808 seems quite Chinese, are you able to share the actual IP?

!

! EpickyHracOP•6/17/24, 5:45 PM

2409:8938:ca0:c2f3::1

!

! EpickyHracOP•6/17/24, 5:45 PM

its cn ip https://radar.cloudflare.com/ip/2409:8938:ca0:c2f3::1

!

! EpickyHracOP•6/17/24, 5:47 PM

wait

!

! EpickyHracOP•6/17/24, 5:47 PM

i can see

!

! EpickyHracOP•6/17/24, 5:47 PM

oh

!

! EpickyHracOP•6/17/24, 5:48 PM

yeee i found a problem,

!

! EpickyHracOP•6/17/24, 5:49 PM

so i have epik.tk and epickyhrac.tk with same hosting and same cf tunnel and in epik.tk i have setuped that waf rule while in epickyhrac.tk i dont so ye

!

! EpickyHracOP•6/17/24, 5:49 PM

but thanks anyway

!

! EpickyHracOP•6/17/24, 5:50 PM

solved

!

! EpickyHracOP•6/17/24, 5:51 PM

*so i just apply that waf rules from epik.tk to epickyhrac.tk *

!! EpickyHrac so i have epik.tk and epickyhrac.tk with same hosting and same cf tunnel and in ...

D

DarkDeviL•6/17/24, 10:46 PM

The classic problem of having multiple different domains, and then forgetting to ensure they all apply the same kind of rules.

D

DarkDeviL•6/17/24, 10:46 PM

Happy to hear it's solved.

!

! EpickyHracOP•6/18/24, 3:24 PM

!

! EpickyHracOP•6/23/24, 3:46 PM

img img
but i want now please, allow access to

dynmap-mc.epik.tk = for all (global)
link-cn.epik.tk = for China country only
How i do that? Please help me

!! EpickyHrac [img](http://zl.epik.tk/u/2024-06-23_17-22-18_e6d1eeb0e9eecee9b990bd15f54a8210.p...

D

DarkDeviL•6/25/24, 12:36 AM

Nothing in these screenshots seems to be related to

dynmap-mc.epik.tk

dynmap-mc.epik.tk

dynmap-mc.epik.tk

dynmap-mc.epik.tk or

link-cn.epik.tk

link-cn.epik.tk

link-cn.epik.tk

link-cn.epik.tk?

DDarkDeviL Nothing in these screenshots seems to be related to `dynmap-mc.epik.tk` or `link...

!

! EpickyHracOP•6/25/24, 8:48 AM

Yes

!

! EpickyHracOP•6/25/24, 8:48 AM

I don't setuped because idk how xd

!! EpickyHrac I don't setuped because idk how xd

D

DarkDeviL•6/25/24, 7:24 PM

How much of it do you actually need?

D

DarkDeviL•6/25/24, 7:26 PM

Like are you both requiring this, but still also requiring the

cn.epik.tk

cn.epik.tk

cn.epik.tk

cn.epik.tk we spoke about last month, or how far does it go?

DDarkDeviL Like are you both requiring this, but still also requiring the `cn.epik.tk` we s...

!

! EpickyHracOP•6/26/24, 4:21 AM

cn.epik.tk is only required for China
And same link-cn.epik.tk

dynmap-mc.epik.tk will be available for all

!! EpickyHrac cn.epik.tk is only required for China And same link-cn.epik.tk dynmap-mc.epik.t...

D

DarkDeviL•6/27/24, 1:58 PM

For the Redirect Rule(s) you have, such as e.g. hte previous we spoke abuot, that would redirect China to speific end points, you would need to create individual exclusions, so that e.g. "

dynmap-mc.epik.tk

dynmap-mc.epik.tk

dynmap-mc.epik.tk

dynmap-mc.epik.tk" would be excluded from the rules.

DDarkDeviL As for the image under "**`Redirect Rules`**" you're linking to, <http://zl.epik...

D

DarkDeviL•6/27/24, 2:02 PM

^

Before (as you needed previously):

When incoming requests match...

Hostname <-> does not equal <->
cn.epik.tk
cn.epik.tk
cn.epik.tk
cn.epik.tk
AND
Country <-> equals <-> China

After:

When incoming requests match...

Hostname <-> is not in <->
dynmap-mc.epik.tk
dynmap-mc.epik.tk
dynmap-mc.epik.tk
dynmap-mc.epik.tk
AND
Hostname <-> does not equal <->
cn.epik.tk
cn.epik.tk
cn.epik.tk
cn.epik.tk
AND
Country <-> equals <-> China

If you also needed to exclude other host names from the redirect, e.g.

example.epik.tk

example.epik.tk

example.epik.tk

example.epik.tk, you would just add the additional host name(s) to the list of exclusions, like e.g.:

Hostname <-> is not in <->
dynmap-mc.epik.tk
dynmap-mc.epik.tk
dynmap-mc.epik.tk
dynmap-mc.epik.tk
example.epik.tk
example.epik.tk
example.epik.tk
example.epik.tk

!! EpickyHrac and WAF [img](http://zl.epik.tk/u/2024-05-28_21-44-04_NTB.png) (to block non "ch...

D

DarkDeviL•6/27/24, 2:07 PM

For the blocking rules like e.g. this one, where you're doing something with "is in
cn.epik.tk
cn.epik.tk
cn.epik.tk
cn.epik.tk", you also add other CN-only hosts, such as e.g. link-cn.epik.tk
link-cn.epik.tk
link-cn.epik.tk
link-cn.epik.tk to the list.

D

DarkDeviL•6/27/24, 2:07 PM

The stuff you're doing is getting more and more complicated, -

D

DarkDeviL•6/27/24, 2:09 PM

I would more likely go in the direction of recommending two different domains for what you're doing, such as for example:

epik.tk

epik.tk

epik.tk

epik.tk -> global domain (including block china, or redirect china to

.cn

.cn

.cn

.cn)

epik.cn

epik.cn

epik.cn

epik.cn -> china-only domain (including block non-china, or redirect non-china to

.tk

.tk

.tk

.tk)

D

DarkDeviL•6/27/24, 2:11 PM

It would be with the cost of an additional domain, but it would add simplicity to your rules and WAF, the more (sub-)domains you add.

China : Weird bypassing of WAF and Some many redirects

Settings from dashboard:

Similar Threads

Similar Threads

Similar Threads