logo

blog

My little blog can’t be this cute!

blocking cloudflare IP-range be like.xhtml (4783B)


  1. <article xmlns="http://www.w3.org/1999/xhtml" xml:lang="en" lang="en" class="h-entry">
  2. <a href="/articles/blocking%20cloudflare%20IP-range%20be%20like"><h1>blocking cloudflare IP-range be like</h1></a>
  3. <p>So, like an absolute madperson I tried blocking cloudflare IP-ranges on my laptop, cloudflare nicely provide the list their website (otherwise there is stuff like peeringDB and ISPs looking glasses). Also my laptop has it's own DNS resolver (with unbound) with no forwarding so I ended up getting a bunch of unreachale hosts just because they where using a cloudflare-bound nameserver.</p>
  4. <h2>Configuration</h2>
  5. <details>
  6. <summary>configuration file for nftables</summary>
  7. <pre><code>
  8. #!/sbin/nft -f
  9. flush ruleset
  10. table inet filter {
  11. # https://www.cloudflare.com/ips-v4
  12. set cloudflare_ipv4 {
  13. type ipv4_addr
  14. flags interval
  15. elements = {
  16. 173.245.48.0/20,
  17. 103.21.244.0/22,
  18. 103.22.200.0/22,
  19. 103.31.4.0/22,
  20. 141.101.64.0/18,
  21. 108.162.192.0/18,
  22. 190.93.240.0/20,
  23. 188.114.96.0/20,
  24. 197.234.240.0/22,
  25. 198.41.128.0/17,
  26. 162.158.0.0/15,
  27. 104.16.0.0/12,
  28. 172.64.0.0/13,
  29. 131.0.72.0/22
  30. }
  31. }
  32. # https://www.cloudflare.com/ips-v6
  33. set cloudflare_ipv6 {
  34. type ipv6_addr
  35. flags interval
  36. elements = {
  37. 2400:cb00::/32,
  38. 2606:4700::/32,
  39. 2803:f800::/32,
  40. 2405:b500::/32,
  41. 2405:8100::/32,
  42. 2a06:98c0::/29,
  43. 2c0f:f248::/32
  44. }
  45. }
  46. chain output {
  47. type filter hook output priority 0
  48. policy accept
  49. #ct state invalid drop
  50. ip daddr @cloudflare_ipv4 counter reject
  51. ip6 daddr @cloudflare_ipv6 counter reject
  52. }
  53. chain input {
  54. type filter hook output priority 0
  55. policy accept
  56. #ct state invalid drop
  57. ip saddr @cloudflare_ipv4 counter reject
  58. ip6 saddr @cloudflare_ipv6 counter reject
  59. }
  60. }
  61. </code></pre>
  62. </details>
  63. <h2>Unreachable services</h2>
  64. <ul>
  65. <li>Cloudflare Interception service (border-patrol reverse proxy) and anything behind it</li>
  66. <li>Cloudflare Nameserver service (DNS for your own domains)</li>
  67. <li>Cloudflare DNS-over-TCP/HTTPS service (centralising all your DNS to one point)</li>
  68. <li>DigitalOcean and Linode nameservers goes to Cloudflare IPs, probably cloudflare own nameservers</li>
  69. </ul>
  70. <h2>Unreachable hosts</h2>
  71. <p>Here is some notable ones, reduced to the NS zone when applicable:</p>
  72. <ul>
  73. <li>A bunch of the fediverse (feels similar as to when IPv4 goes occasionally down for me)</li>
  74. <li>joinmastodon.org</li>
  75. <li>Some blogs, few from people which I though to be a bit privacy-conscious. For example angristan.fr and PatternsInTheVoid.net</li>
  76. <li>www.DeepL.com</li>
  77. <li>LineageOS.org, openwrt.org, mxlinux.org, elementary.io, parrotlinux.org, alpinelinux.org</li>
  78. <li>adafruit.com</li>
  79. <li>SSLLabs.com</li>
  80. <li>cryptocoding.net</li>
  81. <li>lojban.org</li>
  82. <li>explainxkcd.com (XKCD is fine btw)</li>
  83. <li>questionablecontent.net</li>
  84. <li>pirate-punk.net, ektoplazm.com, jamendo.com</li>
  85. <li>nhentai.net</li>
  86. <li>pixiv.net</li>
  87. <li>gitlab.com</li>
  88. <li>matrix.org, vector.im, riot.im</li>
  89. <li>www.mozilla.org</li>
  90. <li>readthedocs.io</li>
  91. <li>lkml.org</li>
  92. </ul>
  93. <p>Note: most of the time the <code>www.domain.tld</code> host is a <code>CNAME</code> to <code>www.domain.tld.cdn.cloudflare.net</code>. Which at least means that the rest of the domain should be reachable.</p>
  94. <p>I applied this filterting on the 2020-05-17 and ended up reverting it few days later because I needed access to most of these sites and I couldn't use Tor for the few of them because cloudflare is basically anti-tor by design and opinion.</p>
  95. <p>This means that quite a lot of websites can be censored, same goes for domains. And cloudflare litterally declares that they are basically an extension of the cops as they are taking actions based on their own morality compass (juridiction) and actively working with the states.</p>
  96. <p><a href="https://queer.hacktivis.me/objects/6c94523f-22af-4028-95ff-37044087905c">Fediverse post for comments</a>, published on 2020-06-02T20:00:00Z, last updated on 2020-06-02T20:13:00Z</p>
  97. </article>