Hiya guys, I enabled "Add visitor location headers" that adds `CF-IPCountry`, but there's an IP tha

Hiya guys, I enabled "Add visitor location headers" that adds

CF-IPCountry

CF-IPCountry

, but there's an IP that I want to exclude from it, since I don't want it to block stuff that we are blocking based on IP. So I basically want to change it's CF-IPCountry from A to B or remove it for that IP, how can I do that?

rdm•12/25/24, 1:43 PM

@Community Champion ^ Also, Merry Christmas

Walshy•12/25/24, 1:44 PM

Why can't we enjoy Christmas without some scammers

rdm•12/25/24, 1:44 PM

Tis the season. And all that

Powerful845tiger•12/25/24, 10:59 PM

https://developers.cloudflare.com/api/resources/diagnostics/subresources/traceroutes/methods/create/
Does the traceroute show the route taken while using Magic Transit, or does it reflect the general route taken from the Cloudflare PoP to the destination IP address?

Cloudflare API | Diagnostics › Traceroutes › Traceroute

Interact with Cloudflare's products and services via the Cloudflare API

PPowerful845tiger https://developers.cloudflare.com/api/resources/diagnostics/subresources/tracero...

Br1ce•12/26/24, 9:42 AM

From memory it's the latter. However the path generally wouldn't be different (maybe an exception with argo for packets enabled?)

I'll double check tomorrow and confirm here

Idle•12/26/24, 1:20 PM

@Community Champion

RRapid Hiya guys, I enabled "Add visitor location headers" that adds `CF-IPCountry`, b...

RapidOP•12/26/24, 4:34 PM

Anyone?

Star•12/26/24, 4:37 PM

Hi everyone , I have a problem with rendering transformed images via cloudflare in my nextjs application.

I'm using Next.js (v14.2.14) App Router with images served through Cloudflare Images Transformation. My image URLs are in the following format:

https://{my-domain}/cdn-cgi/image/width=100/https:/{s3-bucket-name}.s3.{region}.amazonaws.com/[image-path]/image.jpg

Problem: When trying to load these images, Next.js is treating the /cdn-cgi portion of the URL as a page route, resulting in a 404 Not Found error instead of loading the image properly.

My setup:

Next.js App Router
Images hosted on AWS S3
Using Cloudflare Images for image optimization and transformation
Application hosted on Vercel

I would really appreciate any help regarding this , thank you!

Walshy•12/26/24, 7:01 PM

what does the hostname look like in the ssl for saas dash?

Walshy•12/26/24, 7:03 PM

what's the status

Walshy•12/26/24, 7:05 PM

usual situation is hostname is inactive... what's the domain - feel free to dm

Walshy•12/26/24, 7:06 PM

is your worker route covering all domains?

Walshy•12/26/24, 7:06 PM

e.g. is your route

*/*

*/*

Walshy•12/26/24, 7:09 PM

yeah you'll want a route of

*/*

*/*

Walshy•12/26/24, 7:09 PM

abc.customer.com

abc.customer.com

customers-proxy.example.com

customers-proxy.example.com

Walshy•12/26/24, 7:11 PM

it shouldn't even match those but there's likely some weird specific thing happening there

Walshy•12/26/24, 7:12 PM

https://developers.cloudflare.com/cloudflare-for-platforms/cloudflare-for-saas/start/advanced-settings/worker-as-origin/
should always use

*/*

*/*

route if using ssl for saas

Walshy•12/26/24, 7:14 PM

awesome, surprised this worked at all - i'm ooo and can't debug it now but it may be matching some other route/rule or something

Chaika•12/26/24, 7:14 PM

I noticed that ~2 months ago, think it was a more recent change
If the dns record in the external account is proxied = worker routes uses the cname target (ex: fallback.mydomain.com/* worker route matches). If unproxied, it matches a wildcard worker route or the exact external hostname

Walshy•12/26/24, 7:15 PM

both should be matching HostHost :thonk:

WWalshy both should be matching `Host` :thonk:

Chaika•12/26/24, 7:17 PM

on the upside, it's a cool quirk that could be (ab)used to prevent anyone from enabling proxy/using their cf config on saas lol

Chaika•12/26/24, 7:17 PM

*/*

*/*

-> actual fallback
fallback.mydomain.com/*fallback.mydomain.com/* -> "Disable Proxy to use this service"

Original message was deleted

Chaika•12/26/24, 7:26 PM

oh ouch, if you've got other stuff on the domain *.<zonename>/**.<zonename>/*, Service: NoneNone as recommended in that guide will exclude it

Chaika•12/26/24, 7:26 PM

<zonename>/*<zonename>/* to exclude grabbing main domain too

Chaika•12/26/24, 7:27 PM

A recommended setup is usually to totally isolate your customer domains to a separate domain from your normal stuff, like <companyname>saas.com or whatever sounds good, as not only do you avoid issues with that, but you also avoid issues with the fact all your SaaS setups share your zone's configuration (and also rules/etc counts which can be used to toggle on settings for them)

sakty•12/26/24, 8:55 PM

test

den•12/26/24, 11:57 PM

hello

wesker2022•12/27/24, 2:49 AM

Sorry, I received a DoS attack, the requests have already started to reduce, however, I still cannot access my site. Do you know what I should do? Not even the WAF rules work. If you could help me, I would appreciate it.

Wwesker2022 Sorry, I received a DoS attack, the requests have already started to reduce, how...

Cyb3r-Jak3•12/27/24, 3:03 AM

In your WAF logs, do you see the requests being denied to L7 DDoS block?

CCyb3r-Jak3 In your WAF logs, do you see the requests being denied to L7 DDoS block?

wesker2022•12/27/24, 3:06 AM

Yes, in the events it appears that it continues blocking L7 DoS, but it even blocks me for 3 days now, the requests dropped from 450K to 20 - 35K, which is what my site normally receives,

SuperHelpflare•12/27/24, 3:11 AM

Is the affected zone running a VPN-like service?

Cloudflare updated the Terms of Service on Dec 3, 2024 to explicitly call out that proxy services, like a VPN service, are prohibited from running on Cloudflare's network unless explicitly approved.

If you are looking to use Cloudflare’s network to privately and securely connect to the Internet, Cloudflare makes a free VPN product available to any user that already runs on Cloudflare's network - Cloudflare WARP. Users can download it and begin connecting through Cloudflare at no cost on every major operating system.

For any further questions, please refer to

abusereply@cloudflare.com

abusereply@cloudflare.com

Original message was deleted

wesker2022•12/27/24, 3:12 AM

No, it's just an endpoint of my API

Original message was deleted

wesker2022•12/27/24, 3:14 AM

What I do have is a Websocket connection since I provide real-time services to my users, I don't know if that is also restricted.

Original message was deleted

wesker2022•12/27/24, 3:15 AM

Thanks friend, I already opened a ticket but what they responded to me is that the site is blocked and that I have to contact bugs @cloudflare.com but when I sent my complaint they responded that my group does not exist or I do not have permission and they did not solve anything for me.

Walshy•12/27/24, 3:16 AM

What's the ticket number?

WWalshy What's the ticket number?

wesker2022•12/27/24, 3:18 AM

01326353

wesker2022•12/27/24, 3:20 AM

This is the image of the attack I received

wesker2022•12/27/24, 3:21 AM

I am currently down to this amount, which is what I manage.

Walshy•12/27/24, 3:22 AM

we shouldn't have directed to the bugs email, i'll get that fixed.

Walshy•12/27/24, 3:22 AM

for questions or appeals, please email

abusereply@cloudflare.com

abusereply@cloudflare.com

Original message was deleted

wesker2022•12/27/24, 3:23 AM

?????

Original message was deleted

wesker2022•12/27/24, 3:30 AM

The client connects to the server through a websocket connection and going through Cloudflare, once connected the user can connect with another user to establish a connection. This connection is like a private chat, 1 to 1, it is not to take the websocket connection to a final proxy, like v2ray does (I didn't know you could do that.)

Original message was deleted

wesker2022•12/27/24, 3:31 AM

Even so, assuming that cflare blocks me by "proxy", they should suspend my domain or something like that because I had an attack of more than 450K requests in less than 1 hour, I normally have between 15K and 45K, it is understandable that it was an attack.

Original message was deleted

wesker2022•12/27/24, 3:34 AM

I'm looking for that new VPN change you mention but I can't find the page or link.

wesker2022•12/27/24, 3:40 AM

I understand but as I repeat it is not a VPN or proxy, they are just normal users who connect in real time using the weboscket protocol for this, unless of course I can no longer use websocket in this sense they should say so, but even so as I repeat if they were wrong and my domain is violating that term I think they should suspend the domain but there was a DoS attack, or unless Cloudflare does auto attacks?

Original message was deleted

wesker2022•12/27/24, 3:42 AM

Yes, it is an API, I do not think it infringes as such, as I repeat, I have already given a summary of the use I give it but in this case, as in the image I passed, the increase in requests was a hit, which is not at all normal with the traffic I use.

Original message was deleted

wesker2022•12/27/24, 3:51 AM

I don't really understand your answer, I'm looking for where it says you can't use an API, but it's even in WAF it has API protection, now I can't use API, can't I use websocket? hahaha

wesker2022•12/27/24, 3:52 AM

Even so, I think the domain should be suspended, and not have an attack of 450K requests in less than 1 hour. I hope the email responds and tells me if I can't use APIs or websocket so I can move :/

Walshy•12/27/24, 3:56 AM

It's perfectly fine to have APIs on Cloudflare

Hiya guys, I enabled "Add visitor location headers" that adds `CF-IPCountry`, but there's an IP tha

Is the affected zone running a VPN-like service?

Similar Threads

Similar Threads

Is the affected zone running a VPN-like service?

Similar Threads