15 ms·
Cloudflare misidentifies Hetzner IPs as being located in Iran
- preisschild 2y agoYeah, google does it too. I could not use certain Hetzner IPs to download container image on my kubernetes nodes at all. Even the official registry.k8s.io registry is hosted on Google Cloud Services and basic stuff like the pause image cant be pulled.
- kodama-lens 2y agoI can confirm this. All Google container registries, including the official k8s repos are unaccessible via some hetzner ipv4 domains. There is a GitHub issue that also covers the problem and it states you should report thos IPS to their support. I did but support says they can't do anything until the ip region list is updated. IPv6 as a workaround is also difficult because some of the image I need are on GitHub and they are still not ipv6 accessible
- wiredfool 2y agoFor a while, Google was blocking IPv6 from Linode, to similar effect.
- preisschild 2y agoI noticed some IPv6 addresses were getting blocked too. We reported a lot IPs to Hetzner, but since we use autoscaling new blocked ones just kept on appearing.
- Jach 2y agoGoogle's IP to location mapping is so bad it has to be intentional. I was in Japan and using my home network as a VPN quite a bit, after a while Google decided my home comcast IP had to be located in Japan. Even though others in the household were still there, they started getting default-Japanese pages on google/maps/youtube/... It didn't fix itself back until a couple weeks after I got home, even filled out https://support.google.com/websearch/contact/ip https://support.google.com/websearch/contact/ip
- ipaddr 2y agoThey finger print your browser. You need to vpn to your home and serve from your US browser not tunnel traffic back to your Japan machine.
- Jach 2y agoI'd be more willing to bet that it's because my GPS location is in Japan, which is the strongest signal of my physical location. Nevertheless, my home IP is used by multiple people, they probably know who they are and that they're not in Japan. My own signals are a mix of VPN'd/non-VPN'd apps on my phone and laptop (not strict about the VPN, some Japan sites require a Japanese IP), and I do often NoMachine back to my home machine and access google services just like I do at home.
- 38 2y agoI mean, so? Why should it matter where they are located?
- greyface- 2y agoIt's the interpretation of some cloud providers that exchanging datagrams with entities in OFAC-sanctioned countries constitutes a prohibited transaction.
- londons_explore 2y agoWhich is plainly stupid. They should interpret the law to mean "We will treat every request from Iran as a non-paying customer, and won't offer anything outside the free-tier" Even if that isn't the way was written, it is plain that it falls within the intent of the law, and is beneficial to US businesses.
- cute_boi 2y agoDo you think the people who makes rules and legislation are that smart?
- londons_explore 2y agoNo, but I expect the judges who interpret the law to see that. No judge will send a google employee to prison because someone located in Iran managed to download a copy of the docker image to Alpine Linux from the google/amazon container registry...
- JoshuaRogers 2y agoThey also won’t reimburse said employee for the lawyer they needed to hire or the lost revenue from being in court and not at work. Even if vindicated, the process can be costly.
- golergka 2y ago
- tgma 2y agoMy theory is lots of people who want to circumvent Iranian internet censorship rely on tunnels/VPNs hosted on Hetzner, which correlates those IPs with `Accept-Language: fa` and GPS locations collected from Android or other similar behavior.
- Alex-Programs 2y agoYeah, I had the same theory when Google did this with a free-tier VPN IP that was in Turkey. It claimed I was in Tehran - and, when I looked at the map of servers, the Turkish server I was connected to was the closest to Tehran.
- lutoma 2y agoI think a more likely explanation is that Hetzner just acquired some IPv4 address ranges that were previously used in Iran
- rany_ 2y agoI think that might be less likely given the trade restrictions. There's no way an Iranian ISP just gave Hetzner those IPv4 addresses free of charge.
- rany_ 2y agoThat's almost certainly the case. I use Tor semi-regularly and many Tor exit relay IPs are identified as being in Iran which is just not possible.
- greyskull 2y agoMight be pertinent to suffix this with (2023), though I see there are still recent replies
- jkaplowitz 2y agoIt's a still-unresolved issue as far as I know; the linked ticket was only closed last year because Gitlab has no control over it as long as they want to continue using Cloudflare. The companies which do have control over it have not fixed it so far.
- scandox 2y agoWould be an easy way to conduct an adhoc trade war...AWS doesn't need competition from a pesky German host let's just make things faintly awkward...
- osiemens 2y agoI wonder if this is related to something I found when I moved my hosting from DO to Hetzner: https://on-no.net/posts/moving-providers-and-tainted-ips/ https://on-no.net/posts/moving-providers-and-tainted-ips/ TL;DR is that the IP that my new instance was assigned had previously been used as part of an advertising CDN based in Iran. It wouldn't surprise me if this is some game of whack-a-mole between interested parties who are at turns applying and attempting to evade blocks.
- paulv 2y agoDoes this kind of thing affect Hetzner IPs in their US datacenters?
- jsheard 2y agoIt looks like they use different ASNs for the US datacenters, so probably not in this case. Nuremberg, Falkenstein and Helsinki all share the problematic AS24940 block mentioned in the OP, but Ashburn is on AS213230 and Hillsboro is on AS212317.
- dathinab 2y agoit's pretty absurd that cloudflare can just effectively cripple a cloud provider by tagging part of their IPv4 range as Iranian and not fixing their issues in over a year (and AFIK have no intention to fix them at all) like I wonder if Hetzner has any way to legally force them to stop misclassifying their IP
- dools 2y agoKinda seems like it might have legs as a defamation lawsuit...
- amatecha 2y agoWhat's absurd to me is that Cloudflare gains more and more control over the internet, by people voluntarily submitting to its domination. My favorite is trying to go someone's random blog with like 5 posts (because they have a singular post about the technical topic I'm trying to figure something out about) and I can't access the site because Cloudflare has decided my locked-down Firefox ("resist fingerprinting" + strict privacy mode etc.) running on OpenBSD is somehow malicious. So much for the open web. (nevermind the audacity that "we can't spy on you sufficiently" is enough to serve a 403 Forbidden response header)
- deleted 2y ago[deleted]
- literallycancer 2y agoMight have something to do with how that particular website is using Cloudflare.
- anonzzzies 2y agoIt is extremely hard to stop DDOS attacks without CF; my hoster has DDOS protection, but when there was a very large attack on our site, only CF could remedy it, and did so immediately when we panicked-moved dns and switched on bot fight. Entire attack that my hoster couldn't stop was gone. How do you do this without CF if you are a small company?
- TheTr1ckt3r 2y agoThis whole issue of blocking Iranian IPs and not allowing them to download Docker containers for ‘legal’ reasons is ridiculous. Additionally, trying to detect and ban VPNs used by Iranians, which will affect the next user of that IP, is equally absurd
- appendix-rock 2y agoWhat do you suggest, then? What’s your legal opinion?
- citrin_ru 2y ago1. avoid geoip blocks because geoip is inaccurate 2. When maintaining geoip don’t mark servers physically located in DE but used by a foreign company as located somewhere else because it will quickly go stale and misleading in the first place
- deleted 2y ago[deleted]
- RadiozRadioz 2y agoI'm frequently reminded how thankful I am to live in a country with a strong, positive international reputation. Even ignoring actual quality-of-life stuff associated with where I live - simply not being from a country with a "dodgy" reputation makes many things so much easier. I don't have to think about blocked websites. Companies accept my payments. Couriers ship to me. With my passport, I walk straight to the front of the fast lane, past the large queue of people who didn't happen to be born somewhere rich, western and politically stable. I don't take it for granted, and it makes me sad that this distinction exists.
- Onavo 2y agoIt's more that you are on the right side in a unipolar world. When the world shifts to multipolarity in the next few years, the problem will solve itself.
- kiba 2y agoMultipolarity is a more dangerous world, as we have seen Russia asserts itself at the expense of Ukraine.
- cabirum 2y ago[flagged]
- buran77 2y agoUnless you happen to not be aligned with or really on the wrong side of that fabled ideal power monopole. It can quickly knock you from ignorance to reality. Imagine Russia was that monopole of power. Or look no further than a dictatorship. Great if your interests align or you're willing to bend them until they do, hell if they don't. The US is the closest thing we have to a monopole these days and I'm sure it's sweet for some and very bitter for others.
- QuercusMax 2y ago"According to a 2024 analysis by The Washington Post, 60% of low-income countries were under some form of U.S. financial sanction. The analysis also concluded that the U.S. imposes three times as many sanctions as any other country or international body." - from https://en.wikipedia.org/wiki/United_States_sanctions https://en.wikipedia.org/wiki/United_States_sanctions Really quite ridiculous that there are sanctions on something like 1/3 of the world.
- alberth 2y agoThis probably wasn’t cloudflare doing per se. It was probably Maxmind, which is the most widely used IP to Geolocation service out that. And cloudflare uses it as well. https://developers.cloudflare.com/network/ip-geolocation/ https://developers.cloudflare.com/network/ip-geolocation/
- ewpratten 2y agoHey OP. On behalf of Cloudflare, we take information accuracy very seriously. I raised the linked issue internally with the team, and they have reason to suspect this has already been addressed. That being said, if you (or anyone else here) are still seeing this issue occur, please raise a ticket with our support team (https://developers.cloudflare.com/support/contacting-cloudflare-support/ https://developers.cloudflare.com/support/contacting-cloudfl...) so we can investigate further. Thanks :)
- wasteduniverse 2y ago[dead]
- ggm 2y agohttps://geolocatemuch.com/ https://geolocatemuch.com/ is the way.
- TZubiri 2y agook
- ksajadi 2y agoThis is not limited to Cloudflare. Google has the same issue and it turns out the IPs were being used by the Iranian hosting companies connected to internet surveillance but they keep moving around. So far we only observed this in Hetzner German DCs, which is consistent with the news about illicit activities by Iranian companies in Germany, two years ago during the last uprising against the Iranian government (the Woman, Life, Freedom movement) We also wrote about this https://blog.cloud66.com/hetzner-connectivity-issues-due-to-sanction-busting-activities https://blog.cloud66.com/hetzner-connectivity-issues-due-to-...
- thundergolfer 2y agoHappened to use with GCP too. We had Oracle Cloud instances being flagged as from Iran and had to file forms with them to get them to not block the IPs.
- lxgr 2y agoFalsehoods lawyers believe about the Internet: You can identify a person (and their jurisdiction) from “their” IP address.
- nradov 2y agoIt's not a falsehood though. IP address is a reasonably reliable means of geolocation. Lawyers tend to be more comfortable with gray areas than engineers. Intent counts for a lot in assessing legal compliance.
- lxgr 2y agoFrom a "best practice"/CYA perspective, sure. But I'm not a lawyer, and looking purely at the outcome of IP blocks (which is usually that regular people are inconvenienced, but the people such policies are actually designed to keep out just shrug and use a $5/month VPN), I can still say that it looks a bit silly.
- gsich 2y agoNo need for anticipatory obedience though. If whois says it's not Iran - who cares.
- lxgr 2y agoThis makes me wonder, though: Who started the IP checks? I think there's a high chance this by itself was anticipatory obedience, since it's fairly easy and cost-effective to do and it gives companies at least something to point at in case of a lawsuit. But my point is that all of this compliance theater does add up; every once in a while mistakes (as outlined in TFA) do happen. Even if they don't, almost free isn't the same thing as free – and some company will inevitably go even further, it'll set a precedent, and the cost to everybody will increase, with questionable benefit.
- saurik 2y agoBut it isn't a grey area: it simply doesn't work. It doesn't matter if it correctly identifies most people: it has to correctly identity most terrorists, and it simply doesn't do that, because if you are a terrorist you just keep rotating through IP addresses on cloud providers and VPNs until the entire service is burnt. It isn't that it sometimes doesn't work: it's that it doesn't work at all when it actually needs to work. We could argue that the services shouldn't let you do that in the first place, but the reality is that services currently do work like that, no one is trying to change that, and if they did try to change it we would all be even less happy with the resulting even-more-powerful surveillance state.
- elwebmaster 2y agoIt should be illegal for providers to override the location information provided by the owner of the IP. Hopefully the FTC will look into this abuse. In the real world this would be the equivalent of me putting my shipping address on an order but the store deciding to ship it to some random place because they “believe” that’s my actual address.
- cr125rider 2y agoNo. Don’t trust client data. Caller ID is garbage because they do this.
- reincoder 2y agoI will describe what we do at IPinfo to avoid such a messup. First of all because we do active measurements and our data is usually less prone to errors like this and when it comes to IP location it is as good as it gets. We have a support team active 247. Then is the issue of update rollout, when things goes wrong (rarely if ever) we can push data updates immediately. We work with our customers and users and try to push immediate fixes. But the most important thing in my opinion we do is this comment itself. If things go wrong we will address it before you come to our support team.
- betaby 2y agoIs Apple store working in Iran? For example, Apple store is working in Russia. I genuinely do not understand how logic works between 1.sanctions 2... 3.let's ban some IPs. What is the chain of reasoning happens on step 2? Why this is not applicable to Google/Apple? There are definitely sanctions against Russia, yet Apple/Play stores work just fine.
- grishka 2y ago> For example, Apple store is working in Russia. Apple hasn't officially sold any hardware in Russia in the last 2+ years. Any Apple devices you can buy come from "parallel import" and are priced 1.5x compared to other countries. As far as I know, the only way you can pay on the app store is from your prepaid balance at some carriers. Play store doesn't accept payments at all, it pops up a modal saying "payments in Russia are paused". I can't understand what these sanctions are intended to achieve either. They just make us angrier because there's nothing we can do besides wait it out.
- sam_lowry_ 2y ago> They just make us angrier because there's nothing we can do besides wait it out. You are not angry enough. Get angrier, go out, kill the highest sitting official you can get your hands on, then be beaten, jailed, signed up to war where you will die and receive a posthumous medal?
- sam_lowry_ 2y agoCorrection: Get angrier, go out, kill the highest sitting official you can get your hands on, then be beaten, jailed, signed up to war where you will detract to the Ukrainian side, fight gloriously and be the first ever Ukrainian solder to enter Moscow, inscribing you name in the annals of Victory next to Julius Caesar.
- TiredOfLife 2y agoNot only is Apple store working in Russia. Apple, who supposedly has stopped selling hardware there, works closely with russian government to remove apps like VPNs from the store.
- reassess_blind 2y agoI was recently reviewing my Google account session history and saw an active session from some small town in western China. Obviously freaked out, rolled all passwords, spent hours scouring what they could’ve had access to, etc. Only for the next day, when Google updates the exact same sessions location to my exact real location on another continent. Google of course won’t show the IP address of sessions anymore, just the “location” so there was no way of confirming beforehand.
- bytenaija 2y agoThis seems to be more than a year ago. Why is it suddenly trending now?
- auguzanellato 2y agoThat probably explains the issues I’m having sometimes when pulling images from Elastic registry on hetzner boxes. At least now I know the reason behind that
- eli-talktalk 2y agogg