Howdy, Stranger!

It looks like you're new here. If you want to get involved, click one of these buttons!


Shells Virtual Desktop
BMail.ag - Secure Email Service
Server.net
CPLicense.net
VPS Server
Buy VPN
Vultr
VMs for AI
HostDare
ReliableSite White-Label Dedicated Hosting for Resellers
InterServer VPS
BMail.ag - Secure Email Service
Best VPN
High-Performance Bare Metal Server Solutions
Karvl.com
Server Mania Cloud Hosting
DataWagon Hosting
AlphaVPS Hosting
Evoxt.com
Clouvider
VPS Hosting with NVMe
Residential IPs in the US & 4G Mobile Proxies in EU & US with Unlimited Bandwidth
ReliableSite White-Label Dedicated Hosting for Resellers
Rabisu - Hosting Solutions
Shells Virtual Desktop
New on LowEndTalk? Please Register and read our Community Rules.

All new Registrations are manually reviewed and approved, so a short delay after registration may occur before your account becomes active.

Why does Cloudflare suck so bad?

135

Comments

  • edited May 2024

    @emgh said:

    @totally_not_banned said:

    @kevinds said:

    @totally_not_banned said:
    I'd guess your ISP must have a horrible reputation then. If i were in your position i'd build a little router that routes everything over VPN (or get some out of the box solution if something worthwhile exists and you feel like spending money). The big question will be where you put your exit though. Like i said above results differ a lot depending on DCs/providers. Coming from one of Hetzner's IPs for example will highly likely only make your situation worse.

    It likely does, but again, no idea why...

    I have and or can get admin access to every host connected to my ASN, already watch the gateway routers for any bad traffic.

    Yeah, it's not really transparent what exactly goes into those ratings even if Hetzner being a major source of abuse being somewhat obvious. Personally i have a theory that not a lot of human webtraffic originating on a given IP block also results in bad ratings, so if it's some kind of corporate network with not a lot of random webtraffic originating there it might very well be the reason for the bad repuation.

    I wouldn’t even say it’s a theory, you’re definitely right. Signs of high % of automated usage from a certain identifiable block/range/ASN 100 % comes into play. But there’s a lot more to it as well, as you know.

    It’s not really different compared to when @jar blocks an IP range or an ASN, if Gmail sends him 100 spam emails per day, he still won’t block them, but if HostPapa does the same, he might.

    That's not exactly what i meant to say. It's more about not being a common source of traffic at all even without there being any actual abuse. Basically what Outlook is doing to small scale mail servers: No established reputation? Off to the dump you go...

    This is why I’m not getting the ”all these companies lose so much by blocking me” comments, because they don’t. The whole point of these automated ratings is to block shit, they’re well aware humans sometimes face the consequence of this, it’s just a numbers game.

    Well, i can see why people are annoyed when it happens while using a regular ISP (how far a corporate network qualifies here is somewhat debatable) but even then it's really just a fight against windmills. Sure you might pester this or that site into adding exceptions (which only serve you personally and maybe the other 5 guys on the same network) but the actual sources of those ratings will not change their ways so whatever you do there'll always be literal millions of sites left blocking you (and similar people). It's not ideal but in my opinion time is way better spent figuring out how to adapt. This is the modern internet after all and there's no reversing it.

    Thanked by 1emgh
  • kevindskevinds Member, LIR

    @emgh said:
    You really don’t get it, but that’s fine tbh

    Nope, I really don't..

    Best I can tell, there is some database somewhere that says our IP block and/or ASN is bad..

    Until I can figure out what it is, and maybe hope they fix it, all I have is one site at a time..

    Some are more difficult than others.. Most are a simple email, bigger companies, getting past level 1 and level 2 support to find someone who actually understands, can be a challenge.

  • @kevinds said:
    Some websites are just endless captchas

    Sounds like the web browsed from a Hetzner IP ;)

  • emghemgh Member, Megathread Squad

    @totally_not_banned couldn’t have said it better myself. Companies will measure how much they gain vs. lose by their anti-bot measures. They’re completely fine with losing $1 worth of clients if $2 in abuse was stopped. That’s what I meant with ’numbers game’, there’s no moral involved here, nor is there any grudges towards any specific ASN or any specific person.

    Thanked by 1totally_not_banned
  • kevindskevinds Member, LIR

    @totally_not_banned said:
    Sounds like the web browsed from a Hetzner IP ;)

    Websites that only partially work are much more annoying though..

  • emghemgh Member, Megathread Squad

    @kevinds said:

    @emgh said:
    You really don’t get it, but that’s fine tbh

    Nope, I really don't..

    Simply put, if their algoritm block your IP range or ASN, and they deem that they win more than they lose with their blocking solution as whole, you can always make it your mission to try to get whitelisted from site after site, but the issue remains, and you likely can’t change that, so either you deem the fighting time well spent, or, you adapt.

  • edited May 2024

    @kevinds said:

    @totally_not_banned said:
    Sounds like the web browsed from a Hetzner IP ;)

    Websites that only partially work are much more annoying though..

    Well, if you are in central Europe i could give you a recommendation. It's actually quite cheap currently. Paypal, Ebay, Cloudflare and Maxmind approved (Paypal & Ebay might differ a bit if you aren't located in Germany though) ;)

  • kevindskevinds Member, LIR
    edited May 2024

    @emgh said:
    Simply put, if their algoritm block your IP range or ASN, and they deem that they win more than they lose with their blocking solution as whole, you can always make it your mission to try to get whitelisted from site after site, but the issue remains, and you likely can’t change that, so either you deem the fighting time well spent, or, you adapt.

    Well, what is adapting?

    Asking the RIR for a different ASN and IP block? - Not going to happen

    Not use the internet? - Also not going to happen

    Running traffic through a VPN? - Possible but a huge PITA, especially for streaming services. But at least doable... Usually using a VPN will get one blocked from using a website, not the other way around..

  • emghemgh Member, Megathread Squad

    @kevinds said:

    @emgh said:
    Simply put, if their algoritm block your IP range or ASN, and they deem that they win more than they lose with their blocking solution as whole, you can always make it your mission to try to get whitelisted from site after site, but the issue remains, and you likely can’t change that, so either you deem the fighting time well spent, or, you adapt.

    Well, what is adapting?

    Asking the RIR for a different ASN and IP block? - Not going to happen

    Not use the internet? - Also not going to happen

    Running traffic through a VPN? - Possible but a huge PITA, especially for streaming services.

    If it helps, some Windscribe servers are labeled ’Windflix’ I believe, but yeah, I suspect finding a VPN that works for streaming everywhere and performs good might be hard.

  • edited May 2024

    @kevinds said:
    Possible but a huge PITA, especially for streaming services. But at least doable... Usually using a VPN will get one blocked from using a website, not the other way around..

    Well, like i've said, the magic is in the actual numbers and with a tiny bit of setup won't even notice that you are using a VPN. Everyone connecting to my wifi or plugging into my router does regardless of whenever they want to or not ;)

    Edit: For sites sensible to such stuff you might want to make sure to not use a reduced MTU though.

  • emghemgh Member, Megathread Squad

    Although, I can’t recall not being able to stream stuff with iCloud private relay/Cloudflare warp, but I also nearly don’t stream.

  • kevindskevinds Member, LIR

    @emgh said:
    Although, I can’t recall not being able to stream stuff with iCloud private relay/Cloudflare warp, but I also nearly don’t stream.

    Cloudflare Warp passes your original IP along with the traffic, so sites that are expecting it, will still see the original IP..

    Which is why it works well for Cloudflare protected sites. Non-Cloudflare sites is a coin toss what with the IP based tracking.

  • emghemgh Member, Megathread Squad

    @kevinds said:

    @emgh said:
    Although, I can’t recall not being able to stream stuff with iCloud private relay/Cloudflare warp, but I also nearly don’t stream.

    Cloudflare Warp passes your original IP along with the traffic, so sites that are expecting it, will still see the original IP..

    Which is why it works well for Cloudflare protected sites. Non-Cloudflare sites is a coin toss what with the IP based tracking.

    That was a long time ago

  • kevindskevinds Member, LIR

    @emgh said:
    That was a long time ago

    Which part?

  • emghemgh Member, Megathread Squad

    @kevinds said:

    @emgh said:
    That was a long time ago

    Which part?

    The origin IP being included in the request. I believe it’s not nowadays.

    Haven’t verified though.

    Origin IP might still make a difference in captchas on Cloudflare sites somehow, I have no idea how that works. But I don’t believe it’s viewable to the site however.

  • kevindskevinds Member, LIR

    @emgh said:

    @kevinds said:

    @emgh said:
    That was a long time ago

    Which part?

    The origin IP being included in the request. I believe it’s not nowadays.

    Neat.

    Thanked by 1emgh
  • JosephFJosephF Member

    @emgh said:
    @kevinds Anyway, I’d guess that ditching customized Firefox for Chrome & getting Cloudflare Warp will better it

    What will Cloudflare WARP accomplish?

  • kevindskevinds Member, LIR

    @JosephF said:
    What will Cloudflare WARP accomplish?

    VPN, same as any other.

  • daviddavid Member
    edited May 2024

    @totally_not_banned said: I'd say there is something fishy about OPs connection/config. I'm on a (private) VPN (with uBlock, CanvasBlocker, NoScript and a rotating user agent...) and i only very rarely get Cloudflare challenges at all (when sites select some kind of aggressive filtering i guess) and even then it's nothing more than clicking the checkbox once.

    There's one thing Cloudflare 100% doesn't like when doing their challenges though and that is: Faked user agents. Doesn't really matter if you lie about the OS but if you are running FF and claim to be Chrome or something similar you are in for a captcha loop of doom.

    My user agent is normal, nothing is faked.

    Mozilla/5.0 (X11; Linux x86_64; rv:125.0) Gecko/20100101 Firefox/125.0

    The IP is a static Vultr IP address. Part of the reason I use wireguard, is that ISP routing is sometimes really slow, and it's much faster through wireguard. For example, without wireguard, sometimes a download will crawl, with an hour to complete. Connect to wireguard, and it's done in 2-3 seconds.

  • daviddavid Member

    Site admins are free to do as they please and use Cloudflare to block visitors they don't like.

    I am also free to do as I please, and ignore those sites (that I consider to be broken).

    They're choosing to solve a problem by pushing their burden onto their visitors. I think that's a poor way to solve their problem, but their choice.

    The problem that's now become mine, I choose to solve by not visiting those sites. I guess the site admin is happy because I'm not wasting their resources, and my life is more peaceful not having to deal with their annoyance. I guess it's a win-win situation, in a dystopian way.

  • FatGrizzlyFatGrizzly Member, Host Rep

    Cloudflare warp no longer sends the origin IP.

    my initial guess was they forced split tunneling in cloudflare subnets, and now they removed it/

  • edited May 2024

    @david said:

    @totally_not_banned said: I'd say there is something fishy about OPs connection/config. I'm on a (private) VPN (with uBlock, CanvasBlocker, NoScript and a rotating user agent...) and i only very rarely get Cloudflare challenges at all (when sites select some kind of aggressive filtering i guess) and even then it's nothing more than clicking the checkbox once.

    There's one thing Cloudflare 100% doesn't like when doing their challenges though and that is: Faked user agents. Doesn't really matter if you lie about the OS but if you are running FF and claim to be Chrome or something similar you are in for a captcha loop of doom.

    My user agent is normal, nothing is faked.

    Mozilla/5.0 (X11; Linux x86_64; rv:125.0) Gecko/20100101 Firefox/125.0

    The IP is a static Vultr IP address. Part of the reason I use wireguard, is that ISP routing is sometimes really slow, and it's much faster through wireguard. For example, without wireguard, sometimes a download will crawl, with an hour to complete. Connect to wireguard, and it's done in 2-3 seconds.

    The answer here is likely Vultr. Those cloud instances (pretty much like Hetzner's) just get abused to death by scrapers, exploit scanners and whatnot. I've moved my exit off of Hetzner for pretty much the exact same reason (a big mail provider(tm) outright rejecting to send my emails over their servers - i've been a client of theirs for literal decades with zero even just suspicious sending activity - just for being on a Hetzner IP is what drove me over the edge a couple years back) and i count myself extremely lucky to end up where i am currently (i initially wanted to move to IONOS, which probably wouldn't have been much better and just switched last minute to a provider i knew nothing about when IONOS's site confused me).

    My VPN use grew out of necessity from using 4G connections where providers tried to prevent tethering, later because i had found a very cheap way to gain access to big ISP's(tm) wifi-to-go network (those home routers running public access points), which meant that i could legally leech internet of my neighbors at the expense of connecting through an open network and when that went away i used my already quite beefy wifi equipment to become a permanent guest on the free wifi of a shop a couple 100m down the road (until they got scared, tried to block me - good luck blocking a spoofed MAC address... - and finally just shutdown the open network). Good times.

    These days i've mostly just become used to the upside of being able to connect from anywhere in the world without risking being locked for suspicious access. Also my IP reputation is so good that coming from the provider i'm currently using would likely be a straight downgrade, so why bother not running VPN when it's all done transparently at my router anyways?

    TL;DR: If Cloudflare annoys you your best option is likely to look for a provider with better IP reputation.

  • Don't use an hourly-billing provider like Vultr as a VPN exit for general web browsing. I proxy some of my browsing via GreenCloudVPS and VirMach and have no issues with Cloudflare.

    (I use hourly-billing providers to get around region blocks to watch the Olympics, though; being able to rotate IPs easily has so far worked to bypass anti-VPN blocks, for the last 3-4 Olympics.)

  • @david said: My user agent is normal, nothing is faked.

    If I saw that user agent in my logs, I would block it as well.

  • tentortentor Member, Host Rep

    @sillycat said: If I saw that user agent in my logs, I would block it as well.

    So much hate to Linux users...

  • emghemgh Member, Megathread Squad

    @tentor said:

    @sillycat said: If I saw that user agent in my logs, I would block it as well.

    So much hate to Linux users...

    No, just entitled ones.

    Thanked by 1sillycat
  • emghemgh Member, Megathread Squad

    @sillycat said:

    @david said: My user agent is normal, nothing is faked.

    If I saw that user agent in my logs, I would block it as well.

    Combine it with a hourly VPS IP lol...

    Dude literally makes effort to look like automated traffic.

  • tentortentor Member, Host Rep

    @emgh said: Dude literally makes effort to look like automated traffic.

    So any Linux user using Firefox is an automated traffic in your opinion? Should they alter their UA to pretend a normie Windows user?

  • emghemgh Member, Megathread Squad

    @tentor said: So any Linux user using Firefox is an automated traffic in your opinion?

    Nope, it's a numbers game.

    Linux + Hourly VPN IP = mostly shit traffic. Do with that information as you please.

    @tentor said: Should they alter their UA to pretend a normie Windows user?

    Well, they could try. Probably won't fix the issue though.

  • edited May 2024

    @emgh said:

    Well, they could try. Probably won't fix the issue though.

    Yeah, pretty unlikely. My browser switches pretty evenly between claiming to be FF on Linux, Windows or MacOS. Doesn't really make any noticeable difference. Like i've said, claiming to be a wrong type of browser makes Cloudflare choke during captchas but as long as i report as some kind of Firefox (which is what i actually use) they are perfectly fine with it.

    Regularly it doesn't to matter at all. I can report to be Edge on Windows and sites don't give a shit (even if i allow cookies and they could very well wonder why that browser that used to be Safari on MacOS 5 minutes ago just magically became Chrome on Linux).

    Thanked by 1emgh
Sign In or Register to comment.