blog

blocking cloudflare IP-range be like.xhtml (4783B)

<article xmlns="http://www.w3.org/1999/xhtml" xml:lang="en" lang="en" class="h-entry">
<a href="/articles/blocking%20cloudflare%20IP-range%20be%20like"><h1>blocking cloudflare IP-range be like</h1></a>
<p>So, like an absolute madperson I tried blocking cloudflare IP-ranges on my laptop, cloudflare nicely provide the list their website (otherwise there is stuff like peeringDB and ISPs looking glasses). Also my laptop has it's own DNS resolver (with unbound) with no forwarding so I ended up getting a bunch of unreachale hosts just because they where using a cloudflare-bound nameserver.</p>
<h2>Configuration</h2>
<details>
<summary>configuration file for nftables</summary>
<pre><code>
#!/sbin/nft -f
flush ruleset
table inet filter {
        # https://www.cloudflare.com/ips-v4
        set cloudflare_ipv4 {
                type ipv4_addr
                flags interval
                elements = {
                        173.245.48.0/20,
                        103.21.244.0/22,
                        103.22.200.0/22,
                        103.31.4.0/22,
                        141.101.64.0/18,
                        108.162.192.0/18,
                        190.93.240.0/20,
                        188.114.96.0/20,
                        197.234.240.0/22,
                        198.41.128.0/17,
                        162.158.0.0/15,
                        104.16.0.0/12,
                        172.64.0.0/13,
                        131.0.72.0/22
                }
        }
        # https://www.cloudflare.com/ips-v6
        set cloudflare_ipv6 {
                type ipv6_addr
                flags interval
                elements = {
                        2400:cb00::/32,
                        2606:4700::/32,
                        2803:f800::/32,
                        2405:b500::/32,
                        2405:8100::/32,
                        2a06:98c0::/29,
                        2c0f:f248::/32
                }
        }
        chain output {
                type filter hook output priority 0
                policy accept
                #ct state invalid drop
                ip daddr @cloudflare_ipv4 counter reject
                ip6 daddr @cloudflare_ipv6 counter reject
        }
        chain input {
                type filter hook output priority 0
                policy accept
                #ct state invalid drop
                ip saddr @cloudflare_ipv4 counter reject
                ip6 saddr @cloudflare_ipv6 counter reject
        }
}
</code></pre>
</details>
<h2>Unreachable services</h2>
<ul>
	<li>Cloudflare Interception service (border-patrol reverse proxy) and anything behind it</li>
	<li>Cloudflare Nameserver service (DNS for your own domains)</li>
	<li>Cloudflare DNS-over-TCP/HTTPS service (centralising all your DNS to one point)</li>
	<li>DigitalOcean and Linode nameservers goes to Cloudflare IPs, probably cloudflare own nameservers</li>
</ul>
<h2>Unreachable hosts</h2>
<p>Here is some notable ones, reduced to the NS zone when applicable:</p>
<ul>
	<li>A bunch of the fediverse (feels similar as to when IPv4 goes occasionally down for me)</li>
	<li>joinmastodon.org</li>
	<li>Some blogs, few from people which I though to be a bit privacy-conscious. For example angristan.fr and PatternsInTheVoid.net</li>
	<li>www.DeepL.com</li>
	<li>LineageOS.org, openwrt.org, mxlinux.org, elementary.io, parrotlinux.org, alpinelinux.org</li>
	<li>adafruit.com</li>
	<li>SSLLabs.com</li>
	<li>cryptocoding.net</li>
	<li>lojban.org</li>
	<li>explainxkcd.com (XKCD is fine btw)</li>
	<li>questionablecontent.net</li>
	<li>pirate-punk.net, ektoplazm.com, jamendo.com</li>
	<li>nhentai.net</li>
	<li>pixiv.net</li>
	<li>gitlab.com</li>
	<li>matrix.org, vector.im, riot.im</li>
	<li>www.mozilla.org</li>
	<li>readthedocs.io</li>
	<li>lkml.org</li>
</ul>
<p>Note: most of the time the <code>www.domain.tld</code> host is a <code>CNAME</code> to <code>www.domain.tld.cdn.cloudflare.net</code>. Which at least means that the rest of the domain should be reachable.</p>
<p>I applied this filterting on the 2020-05-17 and ended up reverting it few days later because I needed access to most of these sites and I couldn't use Tor for the few of them because cloudflare is basically anti-tor by design and opinion.</p>
<p>This means that quite a lot of websites can be censored, same goes for domains. And cloudflare litterally declares that they are basically an extension of the cops as they are taking actions based on their own morality compass (juridiction) and actively working with the states.</p>
<p><a href="https://queer.hacktivis.me/objects/6c94523f-22af-4028-95ff-37044087905c">Fediverse post for comments</a>, published on 2020-06-02T20:00:00Z, last updated on 2020-06-02T20:13:00Z</p>
</article>