Removing 1 IP from blocked ASN range

[dan_eff]

I’ve seen people getting blocked by Cloudflare protected websites and I’ve used the service myself, but the table’s have turned and I couldn’t find a way to ask Cloudflare to remove an IP address.

• We’re a small tech organisation < 10 people
• We use Perimeter81 for our corporate VPN in order to have a static gateway which we use to create a perimeter and allowlist the IP for several of our services.
• Perimeter81’s static gateway’s run off public cloud (but the IP is static). In our case our gateway is Germany and Perimeter81 is using DigitalOcean there.
• We’ve used it for more than 3 years.
• It seems Cloudflare block the full DigitalOcean ASN as part of some of their firewall offerings

I understand the rationale behind blocking public cloud ranges for web traffic, but it often massively interferes with the work we’re doing (requiring constant bypassing and maintenance…and ultimately degrading our security posture).

The question is, is it possible to appeal to Cloudflare have our IP added to an allowlist/removed from the block list?

[sandro]

Same issue as New Company - UK Masquerade Addresses Blocked? - #3 by sandro

Cloudflare does not block addresses, site owners do.

[dan_eff]

That’s an incorrect answer.

Does CF offer a WAF? Yes.
Does CF maintain ruleset for that WAF? Yes.

Can you explain clearly how this isn’t the case?

[sandro]

@dan_eff

That’s an incorrect answer

If you are that familiar with Cloudflare, why are you asking for help?

The answer is correct, Cloudflare does not block anything. You need to contact the site owners.

[DarkDeviL]

@dan_eff

Can you explain clearly how this isn’t the case?

Does Chownow.com blocking ASN 22462 - #9 by DarkDeviL make it clear enough?

@DarkDeviL

→ https://dash.cloudflare.com/?to=/:account/:zone/security/waf/custom-rules

It is very common for certain website owners to choose to block AS numbers of cloud / hosting providers (dedicated servers, VPS, and so on), as it is very rarely that legitimate users would be connecting to a website that way.

Doing so can often limit a lot of bot traffic, or otherwise useless noise, that your site receives.

How website owners choose to use the WAF (such as e.g. potentially wide blocking rules as in the example screenshots above) is completely up to them.

The only option for a (potential) resolution would be through the website owner.

@dan_eff

block the full DigitalOcean ASN

Considering all the junk traffic originating from them, it makes perfect sense for website owners to do that, regardless whether they use Cloudflare or not…