# Trolls Getting Past .htaccess, 'IP Blocker', & Cloudflare **URL:** \ **Category:** Hosting Support\ **Created:** [April 21, 2022, 11:37pm UTC](https://forum.infinityfree.com/t/trolls-getting-past-htaccess-ip-blocker-cloudflare/60796 "2022-04-21T23:37:18Z")\ **Posts on this page:** 19\ **Page:** 1
**Author:** ![keddie](https://forum.infinityfree.com/letter_avatar/keddie/32/5_5575768a8748004e209b776fc1b2916d.png) [@keddie](https://forum.infinityfree.com/u/keddie)\ **Post date:** [April 21, 2022, 11:37pm UTC](https://forum.infinityfree.com/t/trolls-getting-past-htaccess-ip-blocker-cloudflare/60796/1 "2022-04-21T23:37:18Z")
epiz\_25072880 / [keddie28.com](http://keddie28.com) I’ve had issues with trolls on my site and forum, and have implemented blocks of specific IPs and IP ranges. They are in place in .htaccess (in the site’s & forum’s root folders), the CP’s ‘IP Block’ feature, and via Cloudflare’s own Security \> WAF blocking tool. However, they are still accessing the site via thes blocked IPs. From my limited knowledge of the issues behind this, they evidently have unmasked the direct IP of the server my site is on, and are bypassing all the measures I’ve put in place. I’ve read about being allocated a different server IP and using methods to hide/mask it, but that’s obviously not going to happen on a free acct., so… Does anyone have any other recommendations on how I can successfully block IPs and IP ranges with measures more definitive/secure/bulletproof than the ones I’m utilizing (and failing)? I do have another website on another server, and could go to the trouble of swapping sites onto the opposing servers… IF I have all the bulletproof anonymizing in place beforehand to make it worthwhile… I wouldn’t want to, but it is a last-ditch option. ---
**Author:** ![Greenreader9](https://forum.infinityfree.com/user_avatar/forum.infinityfree.com/greenreader9/32/22847_2.png) [@Greenreader9](https://forum.infinityfree.com/u/Greenreader9)\ **Post date:** [April 22, 2022, 12:35am UTC](https://forum.infinityfree.com/t/trolls-getting-past-htaccess-ip-blocker-cloudflare/60796/2 "2022-04-22T00:35:50Z")
> [@keddie](#): > > they evidently have unmasked the direct IP of the server my site is on, and are bypassing all the measures I’ve put in place. Considering there are over two hundred website on the server IP, accessing it directly is highly unlikely. Plus, there is no getting around the control panels “Block IP” feature (I mean technically yes, but don’t get me started there). One of the two things are most likely happening: 1. You are blocking the wrong IP (You may be detecting the Cloudflare IP instead of the real IP. Can you PM me the IP(s) that you are trying to block? I can check them). 2. You are blocking them incorrectly (Not likely, but still possible. Screenshot your WAF rules in that PM to me as well.) Does your forum have an IP detector and blocker on it? It should, and that should offer you a one-click-block type thing. Also, note that relying on IP blocks is not the best, since a DNS change, or the use of a VPN can easily change an IP (I can change the IP of my computer 2 different ways in under a minute). ---
**Author:** ![Oxy](https://forum.infinityfree.com/user_avatar/forum.infinityfree.com/oxy/32/37989_2.png) [@Oxy](https://forum.infinityfree.com/u/Oxy)\ **Post date:** [April 22, 2022, 9:41am UTC](https://forum.infinityfree.com/t/trolls-getting-past-htaccess-ip-blocker-cloudflare/60796/3 "2022-04-22T09:41:41Z")
visitor - CF - hosting CF is here in the middle and all the traffic is going through it no direct connection visitor \<\> hosting and if your forum is unable to retrieve the actual visitor IP instead, it sees Cloudflare IP (because Cloudflare actually talks to origin / host) then you need to add an extension. you judge which one: 1 - [phpBB • CloudFlare IP - Contribution Details](https://www.phpbb.com/customise/db/extension/cloudflare_ip/) 2 - [https://stackoverflow.com/questions/41669342/cloudflare-users-ip-issue-on-phpbb](https://stackoverflow.com/questions/41669342/cloudflare-users-ip-issue-on-phpbb) And then when you have a real IP then you follow the normal path through the forum and block the user by email, by IP, by country, etc. * * * Cloudflare I think only supports the 0/24 block range as far as protection regarding possible DDoS is concerned - you need to do it all on CF. There is no point in doing a block on .htaccess here on hosting because when someone has an origin IP then it is too late and every visit to your site (blocked or not) counts and consumes resources, means in the sense if someone wants to DDoS your site and you blocked his IP via .htaccess the server must pop up again with 403 and also process every request … that is why CF is used - which is between the visitor and the origin ---
**Author:** ![Thewebuser22](https://forum.infinityfree.com/user_avatar/forum.infinityfree.com/thewebuser22/32/25592_2.png) [@Thewebuser22](https://forum.infinityfree.com/u/Thewebuser22)\ **Post date:** [April 22, 2022, 3:11pm UTC](https://forum.infinityfree.com/t/trolls-getting-past-htaccess-ip-blocker-cloudflare/60796/4 "2022-04-22T15:11:39Z")
Just curious, how does cloudflare not crash from these DDoS attacks? ---
**Author:** ![jaikrishna.t](https://forum.infinityfree.com/user_avatar/forum.infinityfree.com/jaikrishna.t/32/57109_2.png) [@jaikrishna.t](https://forum.infinityfree.com/u/jaikrishna.t)\ **Post date:** [April 22, 2022, 3:44pm UTC](https://forum.infinityfree.com/t/trolls-getting-past-htaccess-ip-blocker-cloudflare/60796/5 "2022-04-22T15:44:43Z")
Because the service is modelled to prevent DDOS attacks, don’t be 🐣 ---
**Author:** ![Thewebuser22](https://forum.infinityfree.com/user_avatar/forum.infinityfree.com/thewebuser22/32/25592_2.png) [@Thewebuser22](https://forum.infinityfree.com/u/Thewebuser22)\ **Post date:** [April 22, 2022, 3:47pm UTC](https://forum.infinityfree.com/t/trolls-getting-past-htaccess-ip-blocker-cloudflare/60796/6 "2022-04-22T15:47:23Z")
Yeah, but I was wondering how they mitigate the attack without taking the “blow” themselves. I usually ask these questions on the side because the poster (OxyDac, in this case) can respond to it while it being not too off-topic (it might help the OP better understand how to implement and use cloudflare), but if it is going to be a full-blown discussion then I might as well create a separate topic. ---
**Author:** ![Admin](https://forum.infinityfree.com/user_avatar/forum.infinityfree.com/admin/32/36437_2.png) [@Admin](https://forum.infinityfree.com/u/Admin)\ **Post date:** [April 22, 2022, 4:49pm UTC](https://forum.infinityfree.com/t/trolls-getting-past-htaccess-ip-blocker-cloudflare/60796/7 "2022-04-22T16:49:51Z")
> [@Thewebuser22](#): > > Yeah, but I was wondering how they mitigate the attack without taking the “blow” themselves. That’s the thing: they don’t. If a website using Cloudflare gets attacked, it’s Cloudflare’s servers taking the hit. But this isn’t really a problem, because Cloudflare has a huge network, and an army of engineers whose sole purpose it is to keep websites online and fast at all times. So their platform can take a ton of abuse. So it is theoretically possible to bring down Cloudflare with a DDoS attack that’s big enough, but it would probably have to be the biggest DDoS attack ever to get their systems on their knees. * * * A question: what do those trolls actually do on your site? Is it automated spam, or just people being mean? If they use predictable IP addresses, then blocking them both in .htaccess and in Cloudflare should do the trick. So why doesn’t it? ---
**Author:** ![keddie](https://forum.infinityfree.com/letter_avatar/keddie/32/5_5575768a8748004e209b776fc1b2916d.png) [@keddie](https://forum.infinityfree.com/u/keddie)\ **Post date:** [April 22, 2022, 7:09pm UTC](https://forum.infinityfree.com/t/trolls-getting-past-htaccess-ip-blocker-cloudflare/60796/8 "2022-04-22T19:09:45Z")
I’ll answer in regards to two specific visitors I’ve been blocking for months, as any answer that succeeds in answering how they continue to access my site makes all other issues superfluous. I’ve been blocking two specific IPs via .htaccess, the CP’s “IP Block” feature, and CF. I’ve only implemented CF in recent months, but these blocked IPs have been getting through before and after my implementation of CF. I’ve successfully blocked other IPs and ranges using each method- and each method I’ve tested by blocking known IPs , including my own IP. I’ve also used .htaccess validators, and am reasonably confident the .htaccess files are written and implemented properly. I’ve also blocked one of the two IPs on the backend of phpBB. I’ve used many tools to trace/ID the two offending IPs; one always comes up as a Comcast customer, the other Verizon. I’ve blocked them by specific IP, and by differing methods of blocking ranges. None have, thus far, succeeded. The image shows today’s visits from the blocked IPs, as well as the blocking used in CF and IP Block. [https://ibb.co/Z8G46Gg](https://ibb.co/Z8G46Gg) The .htaccess is straightforward enough: order allow,deny allow from all deny from 174.203.105.195 deny from 73.197.99.175 Again, all IP tracing I’ve done never varies from those locations and providers. ---
**Author:** ![wackyblackie](https://forum.infinityfree.com/user_avatar/forum.infinityfree.com/wackyblackie/32/43350_2.png) [@wackyblackie](https://forum.infinityfree.com/u/wackyblackie)\ **Post date:** [April 23, 2022, 12:20am UTC](https://forum.infinityfree.com/t/trolls-getting-past-htaccess-ip-blocker-cloudflare/60796/9 "2022-04-23T00:20:38Z")
Your code would work with Apache versions below 2.4, however, that is not what our servers run. Our servers run Apache 2.4+, so you must use the correct code: ```plaintext Require all granted Require not ip 174.203.105.195 Require not ip 73.197.99.175 ``` ---
**Author:** ![Greenreader9](https://forum.infinityfree.com/user_avatar/forum.infinityfree.com/greenreader9/32/22847_2.png) [@Greenreader9](https://forum.infinityfree.com/u/Greenreader9)\ **Post date:** [April 23, 2022, 12:53am UTC](https://forum.infinityfree.com/t/trolls-getting-past-htaccess-ip-blocker-cloudflare/60796/10 "2022-04-23T00:53:38Z")
@keddie, if you use that code yourself, I would recommend changing it to what @wackyblackie sugested. [https://httpd.apache.org/docs/trunk/howto/access.html](https://httpd.apache.org/docs/trunk/howto/access.html) ---
**Author:** ![Thewebuser22](https://forum.infinityfree.com/user_avatar/forum.infinityfree.com/thewebuser22/32/25592_2.png) [@Thewebuser22](https://forum.infinityfree.com/u/Thewebuser22)\ **Post date:** [April 23, 2022, 1:08am UTC](https://forum.infinityfree.com/t/trolls-getting-past-htaccess-ip-blocker-cloudflare/60796/11 "2022-04-23T01:08:12Z")
Ah. So that’s why my IP blocking methods didn’t work. Good to know! I guess `Order` is deprecated now. ---
**Author:** ![keddie](https://forum.infinityfree.com/letter_avatar/keddie/32/5_5575768a8748004e209b776fc1b2916d.png) [@keddie](https://forum.infinityfree.com/u/keddie)\ **Post date:** [April 23, 2022, 2:09am UTC](https://forum.infinityfree.com/t/trolls-getting-past-htaccess-ip-blocker-cloudflare/60796/12 "2022-04-23T02:09:49Z")
> [@wackyblackie](#): > > ```auto > > Require all granted > Require not ip 174.203.105.195 > Require not ip 73.197.99.175 > > > ``` I’ll implement that now. Any idea why the CF block and CP ‘IP Block’ tools aren’t blocking them? I mean, I’m wearing a belt, suspenders, and another set of suspenders… I don’t see how CF is missing it, because that’s the first line of defense, and I doubt the ‘IP Block’ is conflicting with .htaccess, as the obsolete wording I used should render .htaccess useless, ignored by the server altogether… Also, a couple Qs about blocking ranges: is 114.119.0.0/16 still correct for blocking the entire range of the last two subsets? is 114.119.232.0/24 still correct for blocking the entire range of the last subset? Does blocking both a range (ie 114.119.232.0/24) AND an IP within that range (ie 114.119.232.121) cause any conflicts, or is it just considered superfluous / redundant? ---
**Author:** ![Oxy](https://forum.infinityfree.com/user_avatar/forum.infinityfree.com/oxy/32/37989_2.png) [@Oxy](https://forum.infinityfree.com/u/Oxy)\ **Post date:** [April 23, 2022, 7:32am UTC](https://forum.infinityfree.com/t/trolls-getting-past-htaccess-ip-blocker-cloudflare/60796/13 "2022-04-23T07:32:06Z")
> **[The trusted source for IP address data, leading IP data provider](https://ipinfo.io/)** > > Get accurate and reliable IP address information with IPinfo. Trusted by over 400,000 users, developers and businesses, we handle more than 40 billion API requests per month. Sign up for free account today. > **[CIDR to IPv4 Address Range Utility Tool | IPAddressGuide](https://www.ipaddressguide.com/cidr)** > > Free IP address tool to translate IPv4 address range into CIDR (Classless Inter-Domain Routing) format and vice-versa. ![1](https://forum-cdn.infinityfree.net/original/3X/b/1/b17b4a0b47042913affa87ad8491ed50cadded4a.png) ![2](https://forum-cdn.infinityfree.net/original/3X/4/3/43c4277e51dcc9661ffbd36f1217dc7fa923d027.png) but comcast has a lot of ASN in addition also ipv6 ![image](https://forum-cdn.infinityfree.net/original/3X/4/8/4824842205c25ea0ae17824484b4463e63009ecb.png) ---
**Author:** ![keddie](https://forum.infinityfree.com/letter_avatar/keddie/32/5_5575768a8748004e209b776fc1b2916d.png) [@keddie](https://forum.infinityfree.com/u/keddie)\ **Post date:** [April 24, 2022, 3:16pm UTC](https://forum.infinityfree.com/t/trolls-getting-past-htaccess-ip-blocker-cloudflare/60796/14 "2022-04-24T15:16:29Z")
I’ve updated my .htaccess to include the ranges OxyDac pointed out, and subscribed to [ipinfo.io](http://ipinfo.io). I’m a graphic designer, the polar opposite of a coding wiz. I’ve spent a couple weeks perusing google results from the last year on the latest coding tips & tricks for writing .htaccess, and not a damned one of them mentioned the new lexicon (\< RequireAll \>, etc). Is there a site / link anyone can recommend that has a tutorial that’s not completely obsolete to what’s running on this server? Likewise, I’ve tried boning up on what to ban when trying to exclude bad apples from my sites. I’ve found range calculators, and many tutorials, and so far [ipinfo.io](http://ipinfo.io) gives the most comprehensive details on tracing. But, beyond the known IP and IP range of the scum I want to block, I’ve not found one tutorial that explains a thing about what else I should be blocking. ASN? IPV6? I’ve seen them mentioned dozens of times when researching what to block, but not one explanation of how/where to find that info, why and when I should block it, much less HOW to successfully block it. Does anyone know of a tutorial on IP/Range blocking that’s as comprehensive and point-blank as OxyDac’s write-up on protecting a site from EP overload? ([How to protect your website that is on Cloudflare plus Logs](https://forum.infinityfree.com/t/how-to-protect-your-website-that-is-on-cloudflare-plus-logs/44751)) ---
**Author:** ![Greenreader9](https://forum.infinityfree.com/user_avatar/forum.infinityfree.com/greenreader9/32/22847_2.png) [@Greenreader9](https://forum.infinityfree.com/u/Greenreader9)\ **Post date:** [April 24, 2022, 4:39pm UTC](https://forum.infinityfree.com/t/trolls-getting-past-htaccess-ip-blocker-cloudflare/60796/15 "2022-04-24T16:39:14Z")
> [@keddie](#): > > not one of them mentioned the new lexicon (\< RequireAll \>, etc) Well, because it’s new. And lots of people don’t follow the docs, so they don’t know it’s changed…. It’s confusing and often frustrating, welcome to the world of web development! There are a bunch of [.htaccess examples here](https://tinkertechlab.com/webhosting/htaccess/), and 90% of them have been tested on InfinityFree servers. As for HTML/CSS, the Apps “Sololearn” and “Mimo” are two good options. > [@keddie](#): > > I’ve not found one tutorial that explains a thing about what else I should be blocking. You block what you want to block. Do you want to block specific URLs? IP addresses? Every website is different, so there really is not a “one size fits all” blocking list. > [@keddie](#): > > but not one explanation of how/where to find that info Again, it’s different for every website. First, you have to locate the person you want to block, then obtain their IP (Using PHP, analytical software, etc). > [@keddie](#): > > why and when I should block it Why - Because you don’t want that person/bot on your website When - Whenever you want to > [@keddie](#): > > much less HOW to successfully block it. Does anyone know of a tutorial on IP/Range blocking That’s easy 🙂 See example #2 [https://tinkertechlab.com/webhosting/htaccess/block-ip](https://tinkertechlab.com/webhosting/htaccess/block-ip) ---
**Author:** ![hq2273](https://forum.infinityfree.com/letter_avatar/hq2273/32/5_5575768a8748004e209b776fc1b2916d.png) [@hq2273](https://forum.infinityfree.com/u/hq2273)\ **Post date:** [April 24, 2022, 6:44pm UTC](https://forum.infinityfree.com/t/trolls-getting-past-htaccess-ip-blocker-cloudflare/60796/16 "2022-04-24T18:44:41Z")
> [@keddie](#): > > Any idea why the CF block and CP ‘IP Block’ tools aren’t blocking them? may they just using your site not DDOS it, however I worry more about weak hosting for users than DDOS, a normal wind for ants is tornado so I don’t want weak like ants and ban my users just because of more refreshing pages, also new users is very important and I don’t want to lose it, in the free plan I can spend more money on ads and after earn enough money I can provide better host plan for my users and make grow my business, so I hope this problem/limit fixed ---
**Author:** ![Oxy](https://forum.infinityfree.com/user_avatar/forum.infinityfree.com/oxy/32/37989_2.png) [@Oxy](https://forum.infinityfree.com/u/Oxy)\ **Post date:** [April 24, 2022, 7:51pm UTC](https://forum.infinityfree.com/t/trolls-getting-past-htaccess-ip-blocker-cloudflare/60796/17 "2022-04-24T19:51:17Z")
> [@keddie](#): > > ASN? IPV6? I’ve seen them mentioned dozens of times when researching what to block, but not one explanation of how/where to find that info, why and when I should block it AS [Autonomous system (Internet) - Wikipedia](https://en.wikipedia.org/wiki/Autonomous_system_(Internet)) You can also find ASN on [ipinfo.io](http://ipinfo.io) when you give an IP, it shows you which organization it belongs to and it tells you if it’s ISP or VPN or HOSTING etc. or all together. when to block ASN? Mostly when it belongs to some hosting [Please read](https://forum.infinityfree.com/t/10000-forum-users-celebration-special-event/22673/6924) and when you simply have no choice because a simple IP ban doesn’t help because they keep coming back with a new IP or there are a large number of IPs and blocking ranges that make it easier for you to put a block on the entire ASN. What should not normally do is to block the ASN from some ISP because there are 99% of your real visitors (people) as opposed to bots, VPN and Tor. there are also several paid VPNs that use residential IPs to bypass the block but fortunately there are still few of them why CF does not block ? probably something is wrong in your settings or is the wrong priority but it’s a question more for a Cloudflare community forum * * * > [@Admin](#): > > > [@Thewebuser22](#): > > > > Yeah, but I was wondering how they mitigate the attack without taking the “blow” themselves. > > But this isn’t really a problem, because Cloudflare has a huge network Just for the sake of comparison The biggest ever DDoS attack in world history = 3.47 terabytes per second (UDP reflection attack - 15 minutes) Cloudflare’s network capacity = 121 Tbps ---
**Author:** ![keddie](https://forum.infinityfree.com/letter_avatar/keddie/32/5_5575768a8748004e209b776fc1b2916d.png) [@keddie](https://forum.infinityfree.com/u/keddie)\ **Post date:** [April 25, 2022, 4:52pm UTC](https://forum.infinityfree.com/t/trolls-getting-past-htaccess-ip-blocker-cloudflare/60796/18 "2022-04-25T16:52:54Z")
You misunderstood my Qs. I wasn’t asking specific to IF, as I well know the answers you provided. I’m asking if anyone knows a tutorial that explains IP/Range/domain blocking and when/why one should implement the next level of blocking. An “ITTT” approach to explaining the steps, if you will. I loathe tutorials that lack proper explanations, as they leave the reader no better informed than before. Most tutorials on the subject are of the “Shut up and do what I say” variety, which is about as useful as a tree surgeon explaining to John Hopkins grads how to use a band-aid. ---
**Author:** ![system](https://infinityfree-forum-uploads.s3.dualstack.eu-central-1.amazonaws.com/original/3X/b/0/b024fd3fa88bae093c9576e55c2c94e33f890206.svg) [@system](https://forum.infinityfree.com/u/system)\ **Post date:** [May 2, 2022, 4:53pm UTC](https://forum.infinityfree.com/t/trolls-getting-past-htaccess-ip-blocker-cloudflare/60796/19 "2022-05-02T16:53:09Z")
This topic was automatically closed 7 days after the last reply. New replies are no longer allowed.