Would be an easy way to conduct an adhoc trade war...AWS doesn't need competition from a pesky German host let's just make things faintly awkward...
Cloudflare misidentifies Hetzner IPs as being located in Iran
11–20 of 245 posts
Re: Cloudflare misidentifies Hetzner IPs as being located in Iran
#12I wonder if this is related to something I found when I moved my hosting from DO to Hetzner: https://on-no.net/posts/moving-providers-and-tainted-ips/
TL;DR is that the IP that my new instance was assigned had previously been used as part of an advertising CDN based in Iran. It wouldn't surprise me if this is some game of whack-a-mole between interested parties who are at turns applying and attempting to evade blocks.
Re: Cloudflare misidentifies Hetzner IPs as being located in Iran
#13I mean, so? Why should it matter where they are located?
US sanctions prohibit transfer of goods, technologies, information, etc. to Iran. As a company, this means BSTS (better safe than sorry) CYA (cover your ass) measures for good or worse.
Curiosity may get me on this one, but is sharing information (such as this post/comment) an example of transfer of information (to potentially all countries)?
Re: Cloudflare misidentifies Hetzner IPs as being located in Iran
#14Yeah, google does it too. I could not use certain Hetzner IPs to download container image on my kubernetes nodes at all. Even the official registry.k8s.io registry is hosted on Google Cloud Services and basic stuff like the pause image cant be pulled.
I can confirm this. All Google container registries, including the official k8s repos are unaccessible via some hetzner ipv4 domains.
There is a GitHub issue that also covers the problem and it states you should report thos IPS to their support. I did but support says they can't do anything until the ip region list is updated.
IPv6 as a workaround is also difficult because some of the image I need are on GitHub and they are still not ipv6 accessible
Re: Cloudflare misidentifies Hetzner IPs as being located in Iran
#15Does this kind of thing affect Hetzner IPs in their US datacenters?
Re: Cloudflare misidentifies Hetzner IPs as being located in Iran
#16I mean, so? Why should it matter where they are located?
It's the interpretation of some cloud providers that exchanging datagrams with entities in OFAC-sanctioned countries constitutes a prohibited transaction.
Which is plainly stupid.
They should interpret the law to mean "We will treat every request from Iran as a non-paying customer, and won't offer anything outside the free-tier"
Even if that isn't the way was written, it is plain that it falls within the intent of the law, and is beneficial to US businesses.
Re: Cloudflare misidentifies Hetzner IPs as being located in Iran
#17Earlier quoted context omitted.
It's the interpretation of some cloud providers that exchanging datagrams with entities in OFAC-sanctioned countries constitutes a prohibited transaction.
Which is plainly stupid. They should interpret the law to mean "We will treat every request from Iran as a non-paying customer, and won't offer anything outside the free-tier" Even if that isn't the way was written , it is plain that it falls within the intent of the law, and is beneficial to US businesses.
Do you think the people who makes rules and legislation are that smart?
Re: Cloudflare misidentifies Hetzner IPs as being located in Iran
#18Yeah, google does it too. I could not use certain Hetzner IPs to download container image on my kubernetes nodes at all. Even the official registry.k8s.io registry is hosted on Google Cloud Services and basic stuff like the pause image cant be pulled.
Google's IP to location mapping is so bad it has to be intentional. I was in Japan and using my home network as a VPN quite a bit, after a while Google decided my home comcast IP had to be located in Japan. Even though others in the household were still there, they started getting default-Japanese pages on google/maps/youtube/... It didn't fix itself back until a couple weeks after I got home, even filled out https://support.google.com/websearch/contact/ip
Re: Cloudflare misidentifies Hetzner IPs as being located in Iran
#19Earlier quoted context omitted.
It's the interpretation of some cloud providers that exchanging datagrams with entities in OFAC-sanctioned countries constitutes a prohibited transaction.
Which is plainly stupid. They should interpret the law to mean "We will treat every request from Iran as a non-paying customer, and won't offer anything outside the free-tier" Even if that isn't the way was written , it is plain that it falls within the intent of the law, and is beneficial to US businesses.
Isn't intent of sanctions to weaken the adversary? Providing services, even free-tier (or, may be, especially so), to sanctioned countries is exactly the opposite of that.
Re: Cloudflare misidentifies Hetzner IPs as being located in Iran
#20Earlier quoted context omitted.
Which is plainly stupid. They should interpret the law to mean "We will treat every request from Iran as a non-paying customer, and won't offer anything outside the free-tier" Even if that isn't the way was written , it is plain that it falls within the intent of the law, and is beneficial to US businesses.
Do you think the people who makes rules and legislation are that smart?
No, but I expect the judges who interpret the law to see that.
No judge will send a google employee to prison because someone located in Iran managed to download a copy of the docker image to Alpine Linux from the google/amazon container registry...