Routing Issues with Leased Subnet to Cloudflare-Protected Destinations

I am encountering connectivity issues with my BGP-routed subnet (45.87.175.0/25) when accessing websites and services that are behind Cloudflare’s CDN or protection. Here are the details:

Affected Subnet: 45.87.175.0/25

Observed Behavior: Downloads and connectivity to Cloudflare-protected destinations fail from any IP in this subnet.

Tests Performed:

Traceroutes from 45.87.175.1 to Cloudflare IPs result in dropped packets.
Successful connectivity from 1GServers’ IPs suggests the issue is specific to my subnet.

RROHAN I am encountering connectivity issues with my BGP-routed subnet (45.87.175.0/25)...

DarkDeviL•7/1/24, 4:43 PM

I'm wondering, do you really mean /25 here?

If so, that would explain it very well, as BGP routers on the Internet won't accept anything smaller than a /24 of IPv4, and a /48 of IPv6.

DarkDeviL•7/1/24, 4:47 PM

If you need to use something smaller than a /24 of IPv4, the only thing you can do, is to announce the corresponding /24 to the global Internet, on the edge of your network, and then internally (after it reaches your routers that handle the public /24), you're then routing the smaller chunks to wherever you need it to go.

The public will that way see the /24, but never the /25.

DDarkDeviL I'm wondering, do you really mean /25 here? If so, that would explain it very w...

Upioti•7/1/24, 4:51 PM

Same

Upioti•7/1/24, 4:51 PM

/25? wtf

Chaika•7/1/24, 4:52 PM

Eitherway it's likely to be outside of the scope of this discord/cf. If you just want a hint, https://bgp.tools/prefix/45.87.175.0/24#connectivity IPXO is announcing the /24 via Equinix as well. I've heard before they do so on suspensions or payment issues to blackhole traffic/stop use of the prefix. Something you'd have to follow up with them eitherway, If you're trying to use 1GServers only they should be announcing it unless you're trying to anycast/multi-home

CChaika Eitherway it's likely to be outside of the scope of this discord/cf. If you just...

Upioti•7/1/24, 4:53 PM

It seems like its ONLY connected to equinix rn

Chaika•7/1/24, 4:54 PM

there's some routes being announced by 1gserver, you can see under the "super lg"

Chaika•7/1/24, 4:54 PM

looks like maybe just peering and not transit though, idk, not my specialty lol

CChaika there's some routes being announced by 1gserver, you can see under the "super lg...

Upioti•7/1/24, 4:55 PM

Only announcing to HE

Upioti•7/1/24, 4:55 PM

Upioti•7/1/24, 4:56 PM

Obviously all traffic will go to IPXO, they have way more presence

UUpioti /25? wtf

DarkDeviL•7/1/24, 4:57 PM

Not sure about the wtf part was in relation to anything I wrote, but -

It was meant as in you can use the /25 just fine, the traffic will just on the public Internet be sent to the equivalent of the /24.

Attempting to send:

IPv4 /25-/32
IPv6 /49-/128

To the public Internet, will be a no-go.

DarkDeviL•7/1/24, 4:58 PM

You need to be extremely lucky to find any networks accepting sizes in those areas.

DarkDeviL•7/1/24, 4:59 PM

Regarding the /24 supernet, it seemed unannounced according to https://bgp.tools when I looked earlier (before being afk for I guess ~ 2 - 2.5 hours) though.

DarkDeviL•7/1/24, 5:00 PM

https://bgp.he.net said low visibility, seen on 1 out of ~ 648.

DDarkDeviL You need to be extremely lucky to find any networks accepting sizes in those are...

Upioti•7/1/24, 5:00 PM

more like 0

DarkDeviL•7/1/24, 5:00 PM

(which definitely has changed now)

Chaika•7/1/24, 5:01 PM

unless I'm misremembering I believe I saw someone saying once that they use Equinix with their decent presence to try to blackhole traffic when suspension or payment failure, etc occurs

Chaika•7/1/24, 5:02 PM

probably the best lead for him is to ask them about it, and ask 1gservers about the announcement/make sure he's not trying to do just the /25 lol, eitherway outside of this disc

CChaika unless I'm misremembering I believe I saw someone saying once that they use Equi...

DarkDeviL•7/1/24, 5:04 PM

Definitely not impossible to do something like that.

And it would also make (financial) sense to do, e.g. "suspend" (and make sure that the suspension is being felt) unpaid services though.

CChaika probably the best lead for him is to ask them about it, and ask 1gservers about ...

DarkDeviL•7/1/24, 5:04 PM

A huge

, and also why I initially asked / suggested to look in to that /25 part.

ROHANOP•7/1/24, 5:06 PM

Sorry, my bad just typing error but yeah same issue for /24

ROHANOP•7/1/24, 5:06 PM

i am just using /25 subnet out of /24 but issue is for whole /24 subnet.

DarkDeviL•7/1/24, 5:10 PM

If you are actually announcing the /24 in your BGP configurations, then you would need to contact the service provider that you're attempting to announce it from, for further assistance.

ROHANOP•7/1/24, 5:11 PM

yes, my BGP provider is 1GServers and i told them regard this issue, but they told this issue by cloudflare because cloudflare blocked that subnet to access cloudflare proxified sites / cloudflare subscribed products.

also i am not into networking so can you explain me if i am making any mistakes?

RROHAN I am encountering connectivity issues with my BGP-routed subnet (45.87.175.0/25)...

DarkDeviL•7/1/24, 5:20 PM

Traceroutes from 45.87.175.1 to Cloudflare IPs result in dropped packets.

DarkDeviL•7/1/24, 5:20 PM

and

RROHAN yes, my BGP provider is 1GServers and i told them regard this issue, but they to...

DarkDeviL•7/1/24, 5:20 PM

cloudflare blocked that subnet to access cloudflare proxified sites / cloudflare subscribed products.

DarkDeviL•7/1/24, 5:20 PM

Sounds somehow contradicting to me.

DarkDeviL•7/1/24, 5:21 PM

And leads me towards:

What exactly do you see?
What exactly did you do, in order to see that?

ROHANOP•7/1/24, 5:21 PM

Haha also created ticket on cloudflare and they marked as pending

DDarkDeviL Sounds somehow contradicting to me.

ROHANOP•7/1/24, 5:26 PM

I was trying to download the installation files for CPanel from their source https://securedownloads.cpanel.net/latest, but the download failed. AaPanel seems to have a similar issue. My suspicion is that Cloudflare's proxying is interfering with the download process on my VPS. It seems like my VPS cannot access websites behind Cloudflare's network using those specific IP addresses.

ROHANOP•7/1/24, 5:28 PM

i utilised that subnet for virtualization use.

ROHANOP•7/1/24, 5:30 PM

Screenshot_2024-06-29_at_11.04.55_PM.png

DarkDeviL•7/1/24, 5:41 PM

On June 5, 2024,

AS14315

AS14315

(

1GSERVERS, LLC

1GSERVERS, LLC

) was added, and

AS834

AS834

(

IPXO LLC

IPXO LLC

) was removed, from the Route Origin Authorizations (ROA) to announce your Internet.

ROHANOP•7/1/24, 5:41 PM

Ohk, and

DarkDeviL•7/1/24, 5:43 PM

On July 1, 2024, this change was reversed, by removing

AS14315

AS14315

(

1GSERVERS, LLC

1GSERVERS, LLC

), and adding

AS834

AS834

(

IPXO LLC

IPXO LLC

) instead.

ROHANOP•7/1/24, 5:43 PM

f, this is strange

DarkDeviL•7/1/24, 5:44 PM

July 1, 2024 was roughly 1 hour, 19 minutes
1 hour, 19 minutes
later than your initial message in this thread.

Chaika•7/1/24, 5:44 PM

it's not really strange, the roa's being removed and ipxo announcing points to just a suspension or payment issue with ipxo. Talk to them.

ROHANOP•7/1/24, 5:45 PM

no i don't have any payment issues with them i have more than 5-6 subnet with them over 1.5 years never faced any issue but on this subnet i got this issue.

DarkDeviL•7/1/24, 5:45 PM

If you didn't do something from your end, regarding that, - then taking to IPXO, as @Chaika so nicely said, will be the way to go.

DDarkDeviL If you didn't do something from your end, regarding that, - then taking to IPXO,...

ROHANOP•7/1/24, 5:46 PM

sure, brother i understood, i really appreciate your efforts.

CChaika it's not really strange, the roa's being removed and ipxo announcing points to j...

ROHANOP•7/1/24, 5:46 PM

Yes i would.

RROHAN yes, my BGP provider is 1GServers and i told them regard this issue, but they to...

Chaika•7/1/24, 5:47 PM

fwiw as far as I know, CF would only block IPs/do IP Jailing in response to a large ddos attack
(which is unlikely, so I don't think they'd be blocking you)

CChaika fwiw as far as I know, CF would only block IPs/do IP Jailing in response to a la...

ROHANOP•7/1/24, 5:47 PM

umm, yes.

Chaika•7/1/24, 5:48 PM

it could be a routing issue or something else though, eitherway step 1 is to contact ipxo and get them to stop announcing and get the roa back authorizing 1g, then you can troubleshoot the rest

CChaika it could be a routing issue or something else though, eitherway step 1 is to con...

ROHANOP•7/1/24, 5:49 PM

sure i do this.

DarkDeviL•7/1/24, 6:23 PM

I'm also adding the reference here: Routing Issues with Subnet 45.87.175.0/25 to Cloudflare-Protected Destinations.

ROHANOP•7/1/24, 6:40 PM

Sure sir, Thanks.

Routing Issues with Leased Subnet to Cloudflare-Protected Destinations

Similar Threads

Similar Threads

Similar Threads