If they do use Cloudflare though, they'd see the cf-connecting-ip as the Cloudflare's cross-cf worke

If they do use Cloudflare though, they'd see the cf-connecting-ip as the Cloudflare's cross-cf worker's IP, which is

2a06:98c0:3600::103

2a06:98c0:3600::103

(regardless of anything else, always that IPv6)

CChaika If the external service doesn't have AAAA records/support IPv6, how would you be...

berkinovish•7/2/24, 10:42 PM

That's a very good point actually, didn't think of that

CChaika If they do use Cloudflare though, they'd see the cf-connecting-ip as the Cloudfl...

berkinovish•7/2/24, 10:44 PM

That's exactly what they are seeing according to their support:

Invalid IP address: >2a06:98c0:3600::103

Invalid IP address: >2a06:98c0:3600::103

.

If I understand correctly, would they need to enable "Pseudo IPv4" on their Cloudflare account then?

. It's a decently big international service though, so not sure why we are the only ones hitting it with our Workers

Bberkinovish That's exactly what they are seeing according to their support: `Invalid IP addr...

ChaikaOP•7/2/24, 10:44 PM

ohhh ok I thought they weren't on Cloudflare since you said "so not hosted on Cloudflare"

berkinovish•7/2/24, 10:45 PM

Yeah it's not hosted on my Cloudflare account I meant indeed, was unaware they were on Cloudflare

ChaikaOP•7/2/24, 10:45 PM

If I understand correctly, would they need to enable "Pseudo IPv4" on their Cloudflare account then?

~~No, it'll always be that IPv6, regardless of their settings or yours.~~ It's just the IP Workers use cross-zone/account. You can use the CF-Worker header to tell which zone sent it
Edit: Psuedo IPv4 on their zone would, your settings don't effect anything though

ChaikaOP•7/2/24, 10:47 PM

if you wanted docs to refer them to: https://developers.cloudflare.com/fundamentals/reference/http-request-headers/#cf-connecting-ip-in-worker-subrequests

In cross-zone subrequests from one Cloudflare zone to another Cloudflare zone, the CF-Connecting-IP value will be set to the Worker client IP address '2a06:98c0:3600::103' for security reasons.

Cloudflare Docs

Cloudflare HTTP request headers · Cloudflare Fundamentals docs

Cloudflare passes all HTTP request headers to your origin web server and adds additional headers as specified below.

CChaika > If I understand correctly, would they need to enable "Pseudo IPv4" on their Cl...

berkinovish•7/2/24, 10:49 PM

I see, that's very helpful! So this is an edge case, since we are both using Cloudflare Workers (I'm assuming they are), but they are on a different zone, they get the internal worker IPv6 address in

CF-Connecting-IP

CF-Connecting-IP

, even though they don't have IPv6 set up.

If I understand correctly, there is no easy fix for this on both our sides right?

berkinovish•7/2/24, 11:05 PM

In any case, extremely helpful already, so thanks a lot!

Bberkinovish I see, that's very helpful! So this is an edge case, since we are both using Clo...

ChaikaOP•7/3/24, 12:05 AM

I see, that's very helpful! So this is an edge case, since we are both using Cloudflare Workers (I'm assuming they are), but they are on a different zone, they get the internal worker IPv6 address in CF-Connecting-IP, even though they don't have IPv6 set up.

Yep

If I understand correctly, there is no easy fix for this on both our sides right?

I thought about it again and tested it, and Psuedo IPv4 does convert the Worker's IPv6 into a Class-E IPv4, but it's not an easy fix and has a lot of drawbacks of its own. Some legacy systems require IPv4 for fraud reasons or do GeoIP lookups, both of which would fail. Having non-real IPv4s in logging/analytics systems is messy as well if trying to understand/piece together logs or build reports.
In a perfect world they would tell your traffic apart from the CF-Worker header when it's a worker, otherwise enough people using CF Workers will run into other rate limits/issues. If they were a partner you were closely tied to, you could pass the actual user's IP in a seperate header too depending on the purpose of your integration.

ChaikaOP•7/3/24, 12:10 AM

You always have the cumbersome but feasible option of using a proxy that your worker sends requests through as well

Original message was deleted

ChaikaOP•7/3/24, 12:26 AM

(this got buried, you might want to ask this in #workers-ai btw)

CChaika > I see, that's very helpful! So this is an edge case, since we are both using C...

berkinovish•7/3/24, 7:52 AM

Thanks so much @Chaika, this really was incredibly helpful. I passed the info (and suggested solutions) on the other service. Definitely an error they'll be running into again if more and more people start using Cloudflare Workers!

cole•7/3/24, 1:13 PM

I want to check on whether I am missing something obvious...

I have a worker bound to a domain like

api.something.com

api.something.com

. And then I set up SaaS hostnames for it. In order to do that, I set up a route

*/*

*/*

in order to match all of the requests.

Unfortunately, that means I cannot also have another SaaS worker at

other-api.something.com

other-api.something.com

. (Because the

*/*

*/*

route is taken). Is that expected?

A way to make this work would be to write specific routes for SaaS (instead of

*/*

*/*

). But that would be ~ 1 route per custom hostname. Is that expected or advisable to write that many routes?

*/*

*/*

is a nice solution, but it only works once per Zone. Which means one SaaS worker per zone

bottiger•7/3/24, 8:05 PM

when specifying build configuration there are a ton of frameworks to choose from. However, I you none of those and just have a bash script for deployment - I assume this is fine?

Bbottiger when specifying build configuration there are a ton of frameworks to choose from...

ChaikaOP•7/3/24, 8:07 PM

of course, build config presets are just meant to help guide, you can do whatever your app needs to get built

bottiger•7/3/24, 8:08 PM

perfect, thank you

Ccole I want to check on whether I am missing something obvious... I have a worker b...

ChaikaOP•7/3/24, 8:09 PM

What are you looking for exactly, how would two SaaS workers help you? Routes are matched on the incoming hostname which is their custom hostname, they couldn't CNAME at a specific subdomain and get a specific worker for example. You could use a worker or a snippet as a gateway though alongside custom hostname metadata and then use service binding and such to direct to the right one

lsmmle•7/4/24, 3:53 AM

quick question about workers, if I use all 100,000 requests of the free plan, the worker will just stop working until the daily reset, right?

Llsmmle quick question about workers, if I use all 100,000 requests of the free plan, th...

ChaikaOP•7/4/24, 3:55 AM

it can take a bit for it to stop working/fail espec if they all come in at once, and the exact behavior depends on the worker route settings (can make it fail open -> requests straight to origin) or fail closed (worker custom domains just do this). If the question is just about billing you won't get charged for more or forced to upgrade or anything, it'll just eventually stop working

lsmmle•7/4/24, 3:55 AM

Ok thanks

lsmmle•7/4/24, 3:56 AM

is there a way to upgrade to the $5/month plan for the 300.000 daily requests but disable billing for requests past the 300.000?

Llsmmle is there a way to upgrade to the $5/month plan for the 300.000 daily requests bu...

ChaikaOP•7/4/24, 3:57 AM

Workers Paid includes 10 mil requests for free, it's not broken down daily or anything like that

ChaikaOP•7/4/24, 3:57 AM

You can setup Alerts for when you go above a specific threshold, but no hard cutoffs

lsmmle•7/4/24, 3:57 AM

so 10 million requests per month?

ChaikaOP•7/4/24, 3:57 AM

10 million included per month
+$0.30 per additional million and then you get billed for cpu time as well (and there's an included tier of that)
https://developers.cloudflare.com/workers/platform/pricing/

lsmmle•7/4/24, 3:58 AM

hmmm ok thanks for the info

IIMGNXTION (blzzzzzrd)I know the Rate Limiter is still in Beta, but does it work? 🤷‍♂️ I have mine se...

ChaikaOP•7/4/24, 2:15 PM

respond with 429/specific status code and you can see it in web traffic analytics (pro or higher)

ChaikaOP•7/4/24, 2:15 PM

I have mine set to 1,500 per minute (per key) and I have some cases where I'm seeing 10x that (15k per minute - assumed to be per key)

Is the traffic distributed? Rate limiter is per Cloudflare location/pop

IIMGNXTION (blzzzzzrd)> you can see it in web traffic analytics I'm looking at the Metrics tab on the ...

ChaikaOP•7/4/24, 2:17 PM

Under your website/zone "Analytics & Logs" -> Traffic. You'd have to be sending all the requests through that zone though, wouldn't see any if they were direct to workers.dev

IIMGNXTION (blzzzzzrd)> Is the traffic distributed? I don't think so. I just deployed it with Wrangler...

ChaikaOP•7/4/24, 2:18 PM

I mean, is the incoming traffic distributed?

ChaikaOP•7/4/24, 2:18 PM

Workers by default run in every cloudflare location everywhere

ChaikaOP•7/4/24, 2:19 PM

If you get 1499 requests in EWR/New York and 1499 in LHR/London and 1499 in SLC/Salt Lake City, your rate limiter wouldn't be exceeded

IIMGNXTION (blzzzzzrd)Hmm. 🤔 Okay, I don't think so, but I don't really know where to check that, but...

ChaikaOP•7/4/24, 2:29 PM

You could use a Durable Object as a rate limiter then per key to have globally consistent limits

IIMGNXTION (blzzzzzrd)@Chaika Compute setting is "Global". Is there no way to check the response codes...

ChaikaOP•7/4/24, 2:37 PM

Web Analytics isn't what you want, that's more Google Analytics type /client-side analytics

ChaikaOP•7/4/24, 2:38 PM

Web Traffic Analytics is server-side and under each website "Analytics & Logs" -> Traffic

ChaikaOP•7/4/24, 2:38 PM

Magic Link: https://dash.cloudflare.com/?to=/:account/:zone/analytics/traffic

ChaikaOP•7/4/24, 2:39 PM

all you have to do is have Pro or higher and send the traffic through that website on a worker custom domain or route, and you can see response codes on there:

ChaikaOP•7/4/24, 2:41 PM

If you wanted more granular/user specific stuff, you send metrics to Analytics Engine: https://developers.cloudflare.com/analytics/analytics-engine/, with the index being some id for the api key and the double/value being blocked or not, and then you could filter off that. You could also just send only rate-limited response metrics, up to you

IIMGNXTION (blzzzzzrd)@Chaika But, see, the thing is, I don't think that Traffic Analytics is showing ...

ChaikaOP•7/4/24, 2:50 PM

are your requests going through that website?

If they do use Cloudflare though, they'd see the cf-connecting-ip as the Cloudflare's cross-cf worke

Similar Threads

Similar Threads

Similar Threads