11 ms·

On my previous job everyone on the wifi was routed through a VPN connection to a datacenter. Basically 4500 people using the same outgoing IP. CloudFlare really

On my previous job everyone on the wifi was routed through a VPN connection to a datacenter. Basically 4500 people using the same outgoing IP. CloudFlare really made me hate the captcha's and verification pages they put in front of websites. Some websites sometimes were not accessible at all, literally blocked for hours. I understand the position of CloudFlare where they basically don't like governments to block their IP's. On a smaller level this is exactly what CloudFlare is doing. Why is that justified?

acdha 4y ago
Did you have problems with malware, or something like uBlock installed? Normally you won’t see issues with shared IPs unless there’s something unusual about your traffic.
- decide1000 4y ago
  I used Firefox and might have installed uBlock. I wasn't the only one with this issue, it was a general complaint within the department.
  - AaronFriel 4y ago
    I have bad news for your colleagues at $previousJob. There was likely botnet activity in the network - on the users' machines connected through the VPN - triggering anti-DDoS protections.
  - acdha 4y ago
    I’m sure it happened - I just asked because a fair percentage of the time when I get a report like that and investigate with our CDN logs it turns out that they have something like a corporate proxy or browser extension which breaks some bot heuristic looking for standard browsers.
- Nextgrid 4y ago
  Simply having a lot of traffic with differing user-agents/TCP/TLS stacks (yes, CF does fingerprint those too) will often look like a proxy and trigger captchas, even if there's nothing actually malicious about the traffic itself. I guess CF manually maintains lists of known NAT exit IPs to relax these restrictions for major carrier-grade NATs (mobile networks, etc) as they'd have the same problem otherwise.
  - acdha 4y ago
    They also do a lot of things to identify discrete real users - I asked because normally it’s not as simple as a NAT triggering this, especially once people establish reputation within a session. I’ve had multiple times where someone reported that as a problem for our sites and then investigated and found that they did have a system with malware, or a browser extension changing their behavior enough to look like a bot.
    - grepfru_it 4y ago
      >or a browser extension changing their behavior enough to look like a bot. You run privacybadger? To CF purgatory for you!
- ben0x539 4y ago
  Having uBlock installed can't be "something unusual" in this day and age, can it?
  - acdha 4y ago
    That depends on the configuration, but it’s definitely not common for general sites. The original poster mentioned captchas and that’s what I’d expect if you block cookies and JavaScript because there “is this a real browser?” tests use those to avoid hitting people with prompts when they look like a standard browser in its default configuration.
- godelski 4y ago
  I sometimes forget I have my VPN on and don't ever realize until I randomly hit a captcha or youtube tells me I'm in a different country. I'm surprised so many people are getting these because I can go hours without seeing one with my VPN on. I not only have ublock but other privacy things which cause more problems (cookies) than captchas.
BonoboIO 4y ago
Because they are Cloudflare /s
gnopgnip 4y ago
The website operators have different options to decide what to do with the captcha info, they aren't required to block anyone or show multiple interactive captchas.
- viraptor 4y ago
  Yes and no. They can decide not to show the captcha, but not how often it's repeated. The common issue with CF is not that they show a captcha before access. It's that you get just the captchas repeated and never get to the site. If you're using CF for DDoS protection, then blocking and captchas are the features you want to use. Just not abuse.
  - grepfru_it 4y ago
    As of very recently, all of my lg tvs cannot access certain cloudflare sites at all. Keeps spinning at “click here to verify you are human”. Scourge of the internet, they are
- decide1000 4y ago
  That is true but I was blocked from normal webshops. I always blamed the combination of a datacenter IP at the other side of the country + many computers using the shared ip.
- r1ch 4y ago
  I pay for Cloudflare Pro and the lowest I can set the WAF is "Essentially Off", requiring me to block whatever IPs are left at that level (which turns out to be a decent amount of legitimate requests). "Actually Off" apparently requires paying thousands of dollars a month for the enterprise plan.
  - comex 4y ago
    Do you have any more details about what sort of requests are being blocked? I’ve been planning to use Cloudflare for an upcoming project, under the impression that ‘Essentially Off’ really did mean essentially off, and would only block obvious DDoS traffic. I could understand a legitimate user being blocked if they shared an IP with a host actually engaged in a DDoS attack, but short of that, I don’t want anyone being blocked. It sounds like I should look at other CDN options…
viraptor 4y ago
Their "oh no, we need more transparency, we're blocked" without even once mentioning they're causing the same issues is infuriating. It's great they realise there's a problem, but they really need to be on both sides of that issue/solution. A heading called "Lack of transparency with IP blocking"? Let me get my tiniest violin CloudFlare... This is a joke until they stop serving a stream of captchas for some IPs.
- ilyt 4y ago
  I remember their other articles where they were bitching about capchas and related "security" while them being by far the most common one I hit... I still mourn the fact industry got conned into DoH and funnelling all DNS traffic on "modern" and "secure" apps thru cloudflare's 1.1.1.1
  - JamesonNetworks 4y ago
    Its unbelievable that they are taking control out of local sys admin hands rather than enabling them with better tooling. It puts packaged software in the same vein as Comcast and Spectrum hardware or Google WiFi that doesn’t expose router and dhcp settings. We are heading to a world where all software for personal use will need to be custom built to rip out all this user and admin hostile nonsense
    - josephcsible 4y ago
      > they are taking control out of local sys admin hands How so? Do any programs force the use of DoH and not let you configure which server they use?
      - p_l 4y ago
        Mozilla openly mentioned they might block network-wide methods to disable DoH and majority of people do not know that Mozilla (or Chrome etc.) are going to use their own settings, leading to unexpected behaviours.
nonrandomstring 4y ago
There's a deep contradiction/hypocrisy around Cloudflare that can't be ignored. It's funny when I try to click on the article titled "the consequences of blocking IP addresses" to find I cannot read it, because my IP address is blocked by the company that wrote the article! Here's a couple of thoughts I've had about Cloudflare recently; One is that Cloudflare are a problem because they are self appointed policemen who do not know who the good guys or bad guys really are. Such well intentioned but naive "helpers" almost always cause more harm in the world then they solve. Another is that Cloudflare do not understand the nature of Free Speech at a fundamental philosophical level. There are two essential sides to it. The freedom to write/speak must be matched by the freedom to read/listen. Cloudflare's model pf the world recasts this as a "tradeoff" and pits the speakers against the listeners. It does this because there is money to be made from "service providers" but none to be made from ordinary internet "users". It robs Peter to pay Paul.
- judge2020 4y ago
  Fundamentally, it costs Paul time and money to serve Peter a webpage, and that becomes a problem when millions of "people" (read: bots) show up and ask to be served every webpage on Paul's website. That's where the nature of "free speech" ends, when your actions impact someone else negatively (which is why, even in the US, you have the right to speak freely but not the right to force others to listen). Solving this in a way that doesn't block tons of regular users (since doing so would cause the site owners to drop Cloudflare) is precisely where nearly all of Cloudflare's $15B market cap comes from.
  - nonrandomstring 4y ago
    [flagged]
    - nine_k 4y ago
      It's not that Cloudflare volunteers to protect someone's web site form voracious bots. It's a choice made, and often paid for, by the site's owner. So the site owner deliberately accepts that some small percentage of users won't be able to access the site. It may be a reasonable price to pay fr protection against a DoS attack, when no users can access the site anyway.
tomxor 4y ago
I came here to say exactly this, it's extreme hypocrisy. Cloudflare but also others from small to large services justify blocking IP addresses using the basis of "some IPs being a source of too much trouble"... but this doesn't make sense in an internet age of highly NATed and highly recycled IPs. One IP != one person, anything based on this assumption today is severely broken.
- miohtama 4y ago
  It is not Cloudflare blocking. It is the webmaster who chooses to use Cloudflare and its strict settings.
ghoomketu 4y ago
Yes I have been victim of the very same thing too. I had to solve hundreds of captchas visiting almost every single website thanks to the centralized infrastructure of Cloudflare nowadays. The issue is not blocking of IP addresses, the issue is one company hosting almost half the internet and having too much power causing such unintended consequences.
onepointsixC 4y ago
Yes but CloudFlare never expected to have their IP's blocked. It's out of hand now that it's happening to them.
duskwuff 4y ago
FWIW, accessing web sites from a "datacenter" IP address is going to be iffy even if you aren't sharing the IP with a few thousand other users. A lot of web sites, particularly e-commerce sites, restrict traffic or block purchases from datacenter IPs, on the (generally correct) theory that they're likely to be bots.
2000UltraDeluxe 4y ago
Worst part is that it's not just VPN's, but CGNAT IP's too.
miohtama 4y ago
The choice to use CloudFlare is done by the webmaster and setting it to strict security settings is done by webmaster. CloudFlare is just a tool here and if it is an issue the issue can be resolved by communicating with the webmaster. Usually an email is enough. On the other hand, we rarely can opt out from the government blocking.

acdha 4y ago

Did you have problems with malware, or something like uBlock installed? Normally you won’t see issues with shared IPs unless there’s something unusual about your traffic.

decide1000 4y ago
I used Firefox and might have installed uBlock. I wasn't the only one with this issue, it was a general complaint within the department.
- AaronFriel 4y ago
  I have bad news for your colleagues at $previousJob. There was likely botnet activity in the network - on the users' machines connected through the VPN - triggering anti-DDoS protections.
- acdha 4y ago
  I’m sure it happened - I just asked because a fair percentage of the time when I get a report like that and investigate with our CDN logs it turns out that they have something like a corporate proxy or browser extension which breaks some bot heuristic looking for standard browsers.
Nextgrid 4y ago
Simply having a lot of traffic with differing user-agents/TCP/TLS stacks (yes, CF does fingerprint those too) will often look like a proxy and trigger captchas, even if there's nothing actually malicious about the traffic itself. I guess CF manually maintains lists of known NAT exit IPs to relax these restrictions for major carrier-grade NATs (mobile networks, etc) as they'd have the same problem otherwise.
- acdha 4y ago
  They also do a lot of things to identify discrete real users - I asked because normally it’s not as simple as a NAT triggering this, especially once people establish reputation within a session. I’ve had multiple times where someone reported that as a problem for our sites and then investigated and found that they did have a system with malware, or a browser extension changing their behavior enough to look like a bot.
  - grepfru_it 4y ago
    >or a browser extension changing their behavior enough to look like a bot. You run privacybadger? To CF purgatory for you!
ben0x539 4y ago
Having uBlock installed can't be "something unusual" in this day and age, can it?
- acdha 4y ago
  That depends on the configuration, but it’s definitely not common for general sites. The original poster mentioned captchas and that’s what I’d expect if you block cookies and JavaScript because there “is this a real browser?” tests use those to avoid hitting people with prompts when they look like a standard browser in its default configuration.
godelski 4y ago
I sometimes forget I have my VPN on and don't ever realize until I randomly hit a captcha or youtube tells me I'm in a different country. I'm surprised so many people are getting these because I can go hours without seeing one with my VPN on. I not only have ublock but other privacy things which cause more problems (cookies) than captchas.

BonoboIO 4y ago

Because they are Cloudflare /s

gnopgnip 4y ago

The website operators have different options to decide what to do with the captcha info, they aren't required to block anyone or show multiple interactive captchas.

viraptor 4y ago
Yes and no. They can decide not to show the captcha, but not how often it's repeated. The common issue with CF is not that they show a captcha before access. It's that you get just the captchas repeated and never get to the site. If you're using CF for DDoS protection, then blocking and captchas are the features you want to use. Just not abuse.
- grepfru_it 4y ago
  As of very recently, all of my lg tvs cannot access certain cloudflare sites at all. Keeps spinning at “click here to verify you are human”. Scourge of the internet, they are
decide1000 4y ago
That is true but I was blocked from normal webshops. I always blamed the combination of a datacenter IP at the other side of the country + many computers using the shared ip.
r1ch 4y ago
I pay for Cloudflare Pro and the lowest I can set the WAF is "Essentially Off", requiring me to block whatever IPs are left at that level (which turns out to be a decent amount of legitimate requests). "Actually Off" apparently requires paying thousands of dollars a month for the enterprise plan.
- comex 4y ago
  Do you have any more details about what sort of requests are being blocked? I’ve been planning to use Cloudflare for an upcoming project, under the impression that ‘Essentially Off’ really did mean essentially off, and would only block obvious DDoS traffic. I could understand a legitimate user being blocked if they shared an IP with a host actually engaged in a DDoS attack, but short of that, I don’t want anyone being blocked. It sounds like I should look at other CDN options…

viraptor 4y ago

Their "oh no, we need more transparency, we're blocked" without even once mentioning they're causing the same issues is infuriating. It's great they realise there's a problem, but they really need to be on both sides of that issue/solution. A heading called "Lack of transparency with IP blocking"? Let me get my tiniest violin CloudFlare... This is a joke until they stop serving a stream of captchas for some IPs.

ilyt 4y ago
I remember their other articles where they were bitching about capchas and related "security" while them being by far the most common one I hit... I still mourn the fact industry got conned into DoH and funnelling all DNS traffic on "modern" and "secure" apps thru cloudflare's 1.1.1.1
- JamesonNetworks 4y ago
  Its unbelievable that they are taking control out of local sys admin hands rather than enabling them with better tooling. It puts packaged software in the same vein as Comcast and Spectrum hardware or Google WiFi that doesn’t expose router and dhcp settings. We are heading to a world where all software for personal use will need to be custom built to rip out all this user and admin hostile nonsense
  - josephcsible 4y ago
    > they are taking control out of local sys admin hands How so? Do any programs force the use of DoH and not let you configure which server they use?
    - p_l 4y ago
      Mozilla openly mentioned they might block network-wide methods to disable DoH and majority of people do not know that Mozilla (or Chrome etc.) are going to use their own settings, leading to unexpected behaviours.

nonrandomstring 4y ago

There's a deep contradiction/hypocrisy around Cloudflare that can't be ignored. It's funny when I try to click on the article titled "the consequences of blocking IP addresses" to find I cannot read it, because my IP address is blocked by the company that wrote the article! Here's a couple of thoughts I've had about Cloudflare recently; One is that Cloudflare are a problem because they are self appointed policemen who do not know who the good guys or bad guys really are. Such well intentioned but naive "helpers" almost always cause more harm in the world then they solve. Another is that Cloudflare do not understand the nature of Free Speech at a fundamental philosophical level. There are two essential sides to it. The freedom to write/speak must be matched by the freedom to read/listen. Cloudflare's model pf the world recasts this as a "tradeoff" and pits the speakers against the listeners. It does this because there is money to be made from "service providers" but none to be made from ordinary internet "users". It robs Peter to pay Paul.

judge2020 4y ago
Fundamentally, it costs Paul time and money to serve Peter a webpage, and that becomes a problem when millions of "people" (read: bots) show up and ask to be served every webpage on Paul's website. That's where the nature of "free speech" ends, when your actions impact someone else negatively (which is why, even in the US, you have the right to speak freely but not the right to force others to listen). Solving this in a way that doesn't block tons of regular users (since doing so would cause the site owners to drop Cloudflare) is precisely where nearly all of Cloudflare's $15B market cap comes from.
- nonrandomstring 4y ago
  [flagged]
  - nine_k 4y ago
    It's not that Cloudflare volunteers to protect someone's web site form voracious bots. It's a choice made, and often paid for, by the site's owner. So the site owner deliberately accepts that some small percentage of users won't be able to access the site. It may be a reasonable price to pay fr protection against a DoS attack, when no users can access the site anyway.

tomxor 4y ago

I came here to say exactly this, it's extreme hypocrisy. Cloudflare but also others from small to large services justify blocking IP addresses using the basis of "some IPs being a source of too much trouble"... but this doesn't make sense in an internet age of highly NATed and highly recycled IPs. One IP != one person, anything based on this assumption today is severely broken.

miohtama 4y ago
It is not Cloudflare blocking. It is the webmaster who chooses to use Cloudflare and its strict settings.

ghoomketu 4y ago

Yes I have been victim of the very same thing too. I had to solve hundreds of captchas visiting almost every single website thanks to the centralized infrastructure of Cloudflare nowadays. The issue is not blocking of IP addresses, the issue is one company hosting almost half the internet and having too much power causing such unintended consequences.

onepointsixC 4y ago

Yes but CloudFlare never expected to have their IP's blocked. It's out of hand now that it's happening to them.

duskwuff 4y ago

FWIW, accessing web sites from a "datacenter" IP address is going to be iffy even if you aren't sharing the IP with a few thousand other users. A lot of web sites, particularly e-commerce sites, restrict traffic or block purchases from datacenter IPs, on the (generally correct) theory that they're likely to be bots.

2000UltraDeluxe 4y ago

Worst part is that it's not just VPN's, but CGNAT IP's too.

miohtama 4y ago

The choice to use CloudFlare is done by the webmaster and setting it to strict security settings is done by webmaster. CloudFlare is just a tool here and if it is an issue the issue can be resolved by communicating with the webmaster. Usually an email is enough. On the other hand, we rarely can opt out from the government blocking.