Blocking DigitalOcean?

Question

DigitalOcean

Today, our sites that were hosted by DigitalOcean stopped working. Yesterday there was news that DO fell under the distribution of Roskomnadzor. Interested in the opinion of DigitalOcean users, what are you planning to do? What should we do?

Change the IP address of the droplet, in the hope that the new address did not get and will not be blocked or transfer sites to another VPS hosting? Which?

Answer 1

Also got blocked in DO .
The exit is simple
. Stomp into any domestic hoster, buy the cheapest VDS with a good channel and set up a reverse proxy on nginx with approximately the following config:

server {
        listen                  80;
        server_name             domain.ru;
        
        location / {
                proxy_pass http://111.111.111.111:80;
                proxy_connect_timeout                           60;
                proxy_send_timeout                                      60;
                proxy_read_timeout                                      60;
                proxy_redirect                                          off;
                proxy_buffer_size                                       4k;
                proxy_buffers                                           4 32k;
                proxy_busy_buffers_size                         64k;
                proxy_temp_file_write_size                      10m;
                proxy_set_header        Host                    $host;
                proxy_set_header        X-Real-IP               $remote_addr;
                proxy_set_header        X-Forwarded-For $proxy_add_x_forwarded_for;
        }
}

where 111.111.111.111 is the IP address of your droplet in DO
and for https sites

server {
        listen                  443;
        ssl                     on;
        server_name             domain.ru;
        ssl_certificate      /etc/nginx/ssl/domain.ru.crt;
        ssl_certificate_key  /etc/nginx/ssl/domain.ru.key;
        ssl_protocols SSLv3 TLSv1 TLSv1.1 TLSv1.2;
        ssl_ciphers  "RC4:HIGH:!aNULL:!MD5:!kEDH";

        location / {
                proxy_pass https://111.111.111:443;
                proxy_connect_timeout                           60;
                proxy_send_timeout                                      60;
                proxy_read_timeout                                      60;
                proxy_redirect                                          off;
                proxy_buffer_size                                       4k;
                proxy_buffers                                           4 32k;
                proxy_busy_buffers_size                         64k;
                proxy_temp_file_write_size                      10m;
                proxy_set_header        Host                    $host;
                proxy_set_header        X-Real-IP               $remote_addr;
                proxy_set_header        X-Forwarded-For $proxy_add_x_forwarded_for;
        }

}

such a wonderful country we have, of course ...

Answer 2

Apparently blocked all subgrids for new droplets in the regions of Europe, Asia, India
. Only old droplets that have been assigned IP for a long time are working.
floating ip does not help.
Whoever writes that everything is ok, try to start a new droplet.
And there is no guarantee that your old ip will live long.
They started blocking on the 17th
. My droplet became unavailable in Moscow today, i.e. 19, in the morning.
He quickly transferred to another region, by the evening he was also unavailable.
The problem is that ip is apparently not blocked by all providers.
Those. if a site is pinged through your provider, it's not a fact that the other one has the same thing.
ps.
Yes, and support is still silent, although they usually respond quickly with
they seem to have new working subgrids at night.
transferred to a new ip in AMS, while the flight is normal
Slack, by the way, it also worked in the morning

Answer 3

I don’t know, not a single project has come under distribution before, you are sure. What is Roskomnadzor?

Answer 4

By the way, Hetzner was also screwed today.

Answer 5

Our site is outside the blocked IP range, but for some users it still turned out to be inaccessible.
It is not clear what exactly they blocked and how.
We also think how. It is not clear whether changing the droplet will help.
"not a single project has come under distribution"
I was also sure that everything was ok, until they sent a couple of screenshots
, everything works for me personally

Answer 6

What is most interesting, I did not notice interruptions with telegrams =). I don't use proxy or vpn. Didn't even flinch in the direction of the transition. Somehow they don't shoot very well =)

Answer 7

Guys, let's do Western construction ..
who has blocked DOMAIN by rkno?
let's add the ip addresses of state structures to similar domains..in dns..so that they also snatch out hello from rkn..
how to quickly get in..include a domain in black rkna?

Answer 8

Floating IP helped me out - especially if several services are spinning on an additional flight

Answer 9

List in
DigitalOcean topic
128.199.0.0/16
139.59.0.0/16
159.89.0.0/16
159.203.0.0/16
165.227.0.0/16
167.99.0.0/16
174.138.0.0/17
188.166.0.0/17.206.20

Answer 10

A similar problem with Digital Ocean, 6 virtual machines are blocked in different subnets.
There is also access to Hetzner virtual machines.

Answer 11

On https://tjournal.ru/69458-roskomnadzor-prodolzhaet... they wrote that at least 180 thousand .ru sites could be blocked. It is not clear - if so, why is there so little noise?
My site is blocked on DO, I have to move. But to the Russian out of spite I will not go to the provider.

Answer 12

cloudflare. So far, everything is fine, turned on on a free account, everything works. The upside is that you stay on DO, the downside is that Cloudflare addresses can also be reached soon. In any case, this solution allows you to immediately return the sites to work and think further.

Answer 13

I have one of the machines in DO with an unfiltered address. Can anyone tell me how to easily transfer all sites from another droplet to it? I don’t want to do it site by site, and in general there are a lot of settings in the system, I don’t want to screw up.
It is a pity that there is no way to restore a snapshot from another droplet to an existing droplet.
PS. By the way, here https://zapret.info/ it is convenient to check if your IP is included in the block lists.

Answer 14

Change Droplet IP Address

I changed it 5 times in the hope that the new IP would not be included in the list of blocked ones, but to no avail. Or am I that unlucky.

Answer 15

We are saved temporarily with the help of CloudFlare. But this is temporary, we will migrate to another hoster. DO support is not going to do anything and contact the RKN about blocked subnets in the Russian Federation. They also wrote to the RKN hotline and to the Agora. From the RKN - zero emotions, three letters did not receive a single answer, from Agora - "documents are being collected and submitted to the arbitration court against the Prosecutor General's Office and the RKN"