How do I disable ratelimits for a domain on a Cloudflare Tunnel?

I have a Nextcloud instance that goes through Cloudflare Tunnel and I am consistently hitting the ratelimit. This has never happened before and I just want to get rid of it. I can't seem to figure it out, would appreciate any help, thanks!
No description
37 Replies
Daniel
DanielOP11mo ago
No I never changed any of the ratelimiting rules, this appears to be new default behavior
Daniel
DanielOP11mo ago
No description
Daniel
DanielOP11mo ago
No description
Erisa
Erisa11mo ago
The rate limit with rule ID of worker can be removed upon request to support if you are on a paid Workers plan. Please create a support ticket. ?support
Flare
Flare11mo ago
To contact Cloudflare Support about an issue, please visit the Support Portal and fill in the form on the portal. After submission, you will receive confirmation over email. Some issues, such as Account or Billing related issues, cannot be solved by the community. Any plan level can open a ticket for these topics. For more information on the methods by which you can contact Support for your plan level, see Contacting Cloudflare Support - Cloudflare Docs
Erisa
Erisa11mo ago
The limit is documented here https://developers.cloudflare.com/workers/platform/limits/#request
Cloudflare’s abuse protection methods do not affect well-intentioned traffic. However, if you send many thousands of requests per second from a small number of client IP addresses, you can inadvertently trigger Cloudflare’s abuse protection.
Ayaan
Ayaan11mo ago
wait, how did you access example.com? it shouldn't be your domain.
Erisa
Erisa11mo ago
They probably used inspect element to redact their domain the same way it says ipv6-address which is the high effort way to do it
Daniel
DanielOP11mo ago
Wait, so I cannot get rid of this if I'm on the free plan?
Erisa
Erisa11mo ago
Are you on Workers Free?
Daniel
DanielOP11mo ago
Yeah
Erisa
Erisa11mo ago
In fact, are you using Workers at all? Can you explain more?
Daniel
DanielOP11mo ago
I never messed with that stuff All I'm using are Cloudflare Tunnels to access nextcloud and other services My guess is that Nextcloud is sending a bunch of individual requests when syncing, which causes it to constantly hit the ratelimit
Erisa
Erisa11mo ago
That's odd then since the rate limit is specific for Workers. Do you have other "Optimization" features enabled on the zone like Early Hints or Automatic Signed Exchanges?
Daniel
DanielOP11mo ago
I was setting up a new computer, which meant downloading all the files I want to be synced. I've done this many times before without any issues on the Cloudflare-end of things, so it's odd to see it ratelimit now Where can I check that?
Erisa
Erisa11mo ago
https://dash.cloudflare.com/?to=/:account/:zone/speed/optimization/recommendations and https://dash.cloudflare.com/?to=/:account/:zone/speed/optimization/other Also the IPv6 address you redacted, is it 2a06:98c0:3600::103? That's the IP for requests coming from Workers
Daniel
DanielOP11mo ago
No It's my actual IPv6 address (just looked it up)
Erisa
Erisa11mo ago
Okay Can you check the optimization settings then?
Daniel
DanielOP11mo ago
Yeah doing that rn
Erisa
Erisa11mo ago
I'm wondering if one of the ones which is implemented with Workers in the backend might be interfering
Daniel
DanielOP11mo ago
No description
Daniel
DanielOP11mo ago
No description
Erisa
Erisa11mo ago
Its cropped too early for me to see Early Hints
Daniel
DanielOP11mo ago
My bad It's enabled Should I disable it?
Erisa
Erisa11mo ago
Yes can you try disabling it I appreciate this isn't something that's made immediately clear and actually shouldn't be happening in the first place, but hopefully it helps
Daniel
DanielOP11mo ago
I'll have to wait until tonight when I'm back at the computer with the issue (the big nextcloud sync). I'll let you know if it fails or succeeds, thank you for your help
Erisa
Erisa11mo ago
The logic I'm followiig here is that Early Hints is implemented using a Worker in the backend of the feature, so its possible the system is mistakenly attributing these Worker requests to your zone and rate limiting them with the Worker rate limit No problem, ping me whenever and I'll respond if/when I'm around
Daniel
DanielOP11mo ago
One extra thing to note: The one thing I did change recently was adding a configurable "offline" page to show when a KVP is true, which is to be used when my server is under scheduled maintenance. I am using workers routes for these. I'm not too familiar with this, so perhaps that could have been the cause?
Erisa
Erisa11mo ago
Is the route active all the time?
Daniel
DanielOP11mo ago
Actually I think so It's only supposed to show a separate page when a KVP is set to true But I think everything is always going through it, which could explain the ratelimit The worker:
export default {
async fetch(request, env, ctx) {
const url = new URL(request.url);
if (url.pathname === "/status") {
let currentState = await env.MAINTENANCE_KV.get("maintenance");
return new Response(`Maintenance mode ${currentState}`, { status: 200 });
}

let maintenanceMode = await env.MAINTENANCE_KV.get("maintenance");

if (maintenanceMode === "on" || url.toString().includes("maintenance.example.com")) {
const html = <"html of the page as a string">;
return new Response(html, { status: 503, headers: {
"content-type": "text/html;charset=UTF-8",
}, });
}
return fetch(request);
},
}
export default {
async fetch(request, env, ctx) {
const url = new URL(request.url);
if (url.pathname === "/status") {
let currentState = await env.MAINTENANCE_KV.get("maintenance");
return new Response(`Maintenance mode ${currentState}`, { status: 200 });
}

let maintenanceMode = await env.MAINTENANCE_KV.get("maintenance");

if (maintenanceMode === "on" || url.toString().includes("maintenance.example.com")) {
const html = <"html of the page as a string">;
return new Response(html, { status: 503, headers: {
"content-type": "text/html;charset=UTF-8",
}, });
}
return fetch(request);
},
}
Can I disable it without deleting it? I don't see a button anywhere
Erisa
Erisa11mo ago
You can remove the route but keep the worker Then to re-enable just add the route back
Daniel
DanielOP11mo ago
I have like 8 routes though That's quite tedious
Erisa
Erisa11mo ago
Well There isn't a disable button, sorry
Daniel
DanielOP11mo ago
Unfortunate
Erisa
Erisa11mo ago
And yeah if your requests are going via a Worker and you dont have Workers Paid then seeing limits is expected and the first step to prevent that is to subscribe to Workers Paid. Also if you check the settings for each route, there should be a "fail open"/"fail closed", make sure thats set to fail open
Daniel
DanielOP11mo ago
Alright I don't use workers enough to justify paying for it, so I think I'll just remove it for now. This is probably resolved now, thanks again for your help
Erisa
Erisa11mo ago
Sure no problem, let me know if it comes back
Want results from more Discord servers?
Add your server