Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

api.nuget.org IP is blacklisted in Russia :( #5806

Closed
Sagrer opened this issue Apr 16, 2018 · 52 comments
Closed

api.nuget.org IP is blacklisted in Russia :( #5806

Sagrer opened this issue Apr 16, 2018 · 52 comments
Assignees
@loic-sharma

Comments

@Sagrer
Copy link

Sagrer commented Apr 16, 2018

Hi.
Today i encountered an issue, similar to #3445
But now one of api.nuget.org IPs is blacklisted by Russian government.
I mean IP 93.184.221.200
I can't give a link to blacklist record (the site use AJAX), but this IP can be checked manually here: http://blocklist.rkn.gov.ru/
It is actually blocked :(.
I think that there is no any hope that this IP will be unbanned.
May be you can just avoid using this IP?
@agr
Copy link
Contributor

agr commented Apr 16, 2018 •
edited

Could you please follow the "Capture MTR" steps here: https://docs.microsoft.com/en-us/nuget/policies/nuget-faq#nugetorg-not-accessible
and send us the results so we better understand what got blocked.

@PastorGL
Copy link

I can confirm (from Russia too, 8.8.8.8 user).

WinMTR output:

|------------------------------------------------------------------------------------------|
|                                      WinMTR statistics                                   |
|                       Host              -   %  | Sent | Recv | Best | Avrg | Wrst | Last |
|------------------------------------------------|------|------|------|------|------|------|
|                             192.168.1.1 -    0 |  150 |  150 |    0 |    0 |    1 |    0 |
|                           217.14.207.27 -    0 |  150 |  150 |    0 |    0 |    5 |    0 |
|                  izhevsk21.mark-itt.net -    0 |  150 |  150 |    1 |    2 |  124 |    1 |
|                 izhevsk207.mark-itt.net -    0 |  150 |  150 |    1 |    6 |  170 |    1 |
|                          198.51.100.101 -    0 |  150 |  150 |   36 |   37 |   49 |   37 |
|                   No response from host -  100 |   30 |    0 |    0 |    0 |    0 |    0 |
|                   No response from host -  100 |   30 |    0 |    0 |    0 |    0 |    0 |
|                   No response from host -  100 |   30 |    0 |    0 |    0 |    0 |    0 |
|                   No response from host -  100 |   30 |    0 |    0 |    0 |    0 |    0 |
|                   No response from host -  100 |   30 |    0 |    0 |    0 |    0 |    0 |
|                   No response from host -  100 |   30 |    0 |    0 |    0 |    0 |    0 |
|                   No response from host -  100 |   30 |    0 |    0 |    0 |    0 |    0 |
|                   No response from host -  100 |   30 |    0 |    0 |    0 |    0 |    0 |
|                   No response from host -  100 |   30 |    0 |    0 |    0 |    0 |    0 |
|                   No response from host -  100 |   30 |    0 |    0 |    0 |    0 |    0 |
|                   No response from host -  100 |   30 |    0 |    0 |    0 |    0 |    0 |
|                   No response from host -  100 |   30 |    0 |    0 |    0 |    0 |    0 |
|                   No response from host -  100 |   30 |    0 |    0 |    0 |    0 |    0 |
|                   No response from host -  100 |   30 |    0 |    0 |    0 |    0 |    0 |
|                   No response from host -  100 |   30 |    0 |    0 |    0 |    0 |    0 |
|                   No response from host -  100 |   30 |    0 |    0 |    0 |    0 |    0 |
|                   No response from host -  100 |   30 |    0 |    0 |    0 |    0 |    0 |
|                   No response from host -  100 |   30 |    0 |    0 |    0 |    0 |    0 |
|                   No response from host -  100 |   30 |    0 |    0 |    0 |    0 |    0 |
|                   No response from host -  100 |   30 |    0 |    0 |    0 |    0 |    0 |
|                   No response from host -  100 |   30 |    0 |    0 |    0 |    0 |    0 |
|                   No response from host -  100 |   30 |    0 |    0 |    0 |    0 |    0 |
|                   No response from host -  100 |   30 |    0 |    0 |    0 |    0 |    0 |
|                   No response from host -  100 |   30 |    0 |    0 |    0 |    0 |    0 |
|                   No response from host -  100 |   30 |    0 |    0 |    0 |    0 |    0 |
|________________________________________________|______|______|______|______|______|______|
   WinMTR v0.92 GPL V2 by Appnor MSP - Fully Managed Hosting & Cloud Provider

PS output:

C:\Users\x> Invoke-WebRequest 'http://72.21.81.200/v3/index.json' -Headers @{Host='api.nuget.org'}
Invoke-WebRequest : Unable to connect to the remote server
At line:1 char:1
+ Invoke-WebRequest 'http://72.21.81.200/v3/index.json' -Headers @{Host ...
+ ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
    + CategoryInfo          : InvalidOperation: (System.Net.HttpWebRequest:HttpWebRequest) [Invoke-WebRequest], WebExc
   eption
    + FullyQualifiedErrorId : WebCmdletWebResponseException,Microsoft.PowerShell.Commands.InvokeWebRequestCommand

Roscomnadzor (Russian state Internet censorship agency) went completely crazy in an attempt to block Telegram and blocked a range of /15 and /12 subnets. So, this is an example of collateral damage.

@agr
Copy link
Contributor

agr commented Apr 17, 2018

Thanks, we are investigating the issue with our CDN provider.

@Sergey-Terekhin
Copy link

Sergey-Terekhin commented Apr 17, 2018 •
edited

Confirm
MTR output:

|------------------------------------------------------------------------------------------|
|                                      WinMTR statistics                                   |
|                       Host              -   %  | Sent | Recv | Best | Avrg | Wrst | Last |
|------------------------------------------------|------|------|------|------|------|------|
|                         router.asus.com -    0 |  116 |  116 |    0 |    0 |    0 |    0 |
|                              10.187.0.1 -    0 |  116 |  116 |    1 |    2 |   83 |    1 |
|                          213.85.208.250 -    0 |  116 |  116 |    1 |    4 |  162 |    3 |
|                            95.167.38.37 -    0 |  116 |  116 |    3 |    4 |   26 |    3 |
|                          213.59.212.235 -    0 |  116 |  116 |    2 |    2 |   12 |    2 |
|          rostelecom.demarc.cogentco.com -    0 |  116 |  116 |   44 |   45 |   65 |   45 |
|hu0-1-0-4.rcr22.fra06.atlas.cogentco.com -    0 |  116 |  116 |   42 |   42 |   43 |   42 |
|  telecomitalia.fra06.atlas.cogentco.com -    0 |  116 |  116 |   45 |   45 |   51 |   45 |
|           racc.franco33.fra.seabone.net -    0 |  116 |  116 |   44 |   46 |   94 |   47 |
|                          195.22.211.203 -    0 |  116 |  116 |   45 |   46 |   97 |   48 |
|                         152.195.101.129 -    0 |  116 |  116 |   42 |   46 |   91 |   43 |
|                          93.184.221.200 -    0 |  116 |  116 |   45 |   45 |   46 |   45 |
|________________________________________________|______|______|______|______|______|______|

   WinMTR v0.92 GPL V2 by Appnor MSP - Fully Managed Hosting & Cloud Provider

@xakep139
Copy link

Link on RKN record with blocked IP 93.184.221.200: https://reestr.rublacklist.net/rec/342748/

@chipitsine
Copy link
Contributor

there's special nuget endpoint for China. can you please implement same for Russia ?

@egorpavlikhin
Copy link

egorpavlikhin commented Apr 17, 2018 •
edited

Put this in hosts file as a workaround
72.21.81.200 api.nuget.org

These should also work:
192.16.48.200
117.18.232.200

@SagePtr
Copy link

SagePtr commented Apr 17, 2018

Can you post full list of domains hosted by 93.184.221.200 ? Because not only nuget broken, but other microsoft services like ajax.aspnetcdn.com

@avgoncharov
Copy link

Hi!
In my case all IPs returns 404 - Not Found.

@EugeneKosmin
Copy link

In my case all IPs returns 404 - Not Found.

@egorpavlikhin's workaround works fine for me. Thanks a lot, BTW!

Try this URL https://api.nuget.org/v3/index.json it must return XML file.

@MaxRyabov
Copy link

MaxRyabov commented Apr 17, 2018 •
edited

404 in all IPs and nuget feeds url (v2 and v3)

@egorpavlikhin
Copy link

Put it in drivers\etc\hosts file. If you visit the IPs from browser they will all return 404. 404 means it's working.

@proff
Copy link

proff commented Apr 17, 2018

93.184.221.200 is unbanned

@dimabelov
Copy link

still not working

@codedokode
Copy link

codedokode commented Apr 17, 2018 •
edited

Please don't do anything. Russian government blocks Russia from accessing millions of IP addresses (yes, millions, it is blocking /12 and /14 networks including lots of completely unrelated sites) trying to catch Telegram Messenger, and this is dubious even by Russian laws. You should not be wasting a second of your time trying to fix what they are intentionally breaking.

Instead, russian users can use VPN to access repositories or host their application on foreign servers that have no problems with connectivity.

@proff
Copy link

proff commented Apr 17, 2018

@dimabelov your provider not is not updated blacklist yet

@Wereuser
Copy link

Wereuser commented Apr 17, 2018 •
edited

  1. Ensure that your NuGet package source use URL https://api.nuget.org/v3/index.json (don`t use https://www.nuget.org/api/v2/ )
  2. Insert into drivers\etc\host file new entry "72.21.81.200 api.nuget.org" (this ip is currently not blocked)
  3. Profit!

@dvdobrovolskiy
Copy link

Confirm
api.nuget.org blocked

@Vertigo093i
Copy link

Vertigo093i commented Apr 17, 2018 •
edited

It is still somewhat blocked. While the subject IP address was already officially removed from the registry it can take awhile for all providers to update their blocking rules. Even a single provider can not update all its routers at the same time (as it happens to me).

@dvdobrovolskiy
Copy link

I believe so. Even that my provider is state scale monster - Rostelekom
api.nuget.org resolves to 152.199.20.1, I can even ping it. But Http/s traffic blocked

@Vertigo093i
Copy link

Vertigo093i commented Apr 17, 2018 •
edited

@dvdobrovolskiy, that's different from the subject IP. Your's one should have not been blocked by RKN. As I remember that one resembles to the IP address for China?
And for me all the problems have been gone within the past hour.

@dvdobrovolskiy
Copy link

Not in the list, yes. But totally blocked. Saddest story. Country-wise. Not wise at all though.

@agr
Copy link
Contributor

agr commented Apr 17, 2018

Azure had some connectivity issues couple of hours ago: https://azure.microsoft.com/en-us/status/history/ but they are mitigated now. @dvdobrovolskiy, you might have been impacted by it.
Clear DNS cache maybe (run ipconfig /flushdns in command line)?
Right now api.nuget.org should resolve to 93.184.221.201.

May I get some fresh info on availability of api.nuget.org? And MTR logs if https://api.nuget.org/v3/index.json is not available.

Thanks.

@dvdobrovolskiy
Copy link

Confirm resolves to 93.184.221.201 and no block

tracert api.nuget.org

Tracing route to cs9.wpc.v0cdn.net [93.184.221.201]
over a maximum of 30 hops:

1 1 ms <1 ms 1 ms 192.168.1.1
2 1 ms 1 ms 1 ms 31.163.64.1
3 1 ms 1 ms 1 ms 87.226.151.158
4 3 ms 3 ms 3 ms 87.226.146.132
5 63 ms 63 ms 62 ms ae41.stkm-cr1.intl.ip.rostelecom.ru [217.107.67.25]
6 87 ms 83 ms 86 ms 5.104.69.12
7 85 ms 85 ms 81 ms 93.184.221.201

Trace complete.

@PavelKhrapkin
Copy link

Restored!

@agr
Copy link
Contributor

agr commented Apr 18, 2018

I suppose, we can consider the issue resolved.

@agr agr closed this as completed Apr 18, 2018
@Shiko1st
Copy link

tracert is ok, browser opens index.json quickly, but in VS not working

@proff
Copy link

proff commented Apr 21, 2018 •
edited

@agr, new ip is banned today
https://reestr.rublacklist.net/rec/347170/

@Shiko1st, you should again add entry to hosts file:
72.21.81.200 api.nuget.org

@Vertigo093i
Copy link

Confirm.
ajax.aspnetcdn.com is also affected since has the same IP.

@Shiko1st
Copy link

Shiko1st commented Apr 21, 2018 via email

@proff
Copy link

proff commented Apr 21, 2018

@agr i think you shouldn't close issue while telegram works fine in Russia (instead of many other sites/services)

@dvdobrovolskiy
Copy link

Year, ajax.aspnetcdn.com blocked.

@vad3x
Copy link

vad3x commented Apr 23, 2018

https://reestr.rublacklist.net/rec/349558/

@roxan200
Copy link

roxan200 commented Apr 23, 2018 •
edited

Thank you! You help us confront with fascist government! The Workaround works great, but Whether this will work for a long time?

@petriashev
Copy link

petriashev commented Apr 23, 2018 •
edited

does not work again...

@agr
Copy link
Contributor

agr commented Apr 23, 2018

Please send MTR logs from locations where it does not work.

@agr agr reopened this Apr 23, 2018
@loic-sharma loic-sharma self-assigned this Apr 23, 2018
@petriashev
Copy link

petriashev commented Apr 23, 2018 •
edited 

|------------------------------------------------------------------------------------------|
|                                      WinMTR statistics                                   |
|                       Host              -   %  | Sent | Recv | Best | Avrg | Wrst | Last |
|------------------------------------------------|------|------|------|------|------|------|
|                                 RT-N56U -    0 |  134 |  134 |    1 |    5 |   22 |   13 |
|                          78.107.125.197 -    0 |  134 |  134 |    2 |    7 |   28 |    3 |
|      plehan9-bng1-local.msk.corbina.net -    0 |  134 |  134 |    2 |    8 |   29 |    2 |
|                   No response from host -  100 |   27 |    0 |    0 |    0 |    0 |    0 |
|                   No response from host -  100 |   27 |    0 |    0 |    0 |    0 |    0 |
|                   No response from host -  100 |   27 |    0 |    0 |    0 |    0 |    0 |
|                   No response from host -  100 |   27 |    0 |    0 |    0 |    0 |    0 |
                    ...
|________________________________________________|______|______|______|______|______|______|
   WinMTR v0.92 GPL V2 by Appnor MSP - Fully Managed Hosting & Cloud Provider

@petriashev
Copy link

it works, thanks

@dvdobrovolskiy
Copy link

It is temporary I believe. MS`s IPs send to ban on regular basis

@demonix
Copy link

demonix commented Apr 25, 2018

dist.niget.org (152.199.20.1) is also blocked in Russia.
https://reestr.rublacklist.net/rec/350082/

@dvdobrovolskiy
Copy link

Add fresh VPN ban (Rostelekom through DPI). Donno what to change. Title or the state

@SagePtr
Copy link

SagePtr commented Apr 25, 2018 •
edited

Donno what to change. Title or the state

Country =(

@loic-sharma
Copy link
Contributor

api.nuget.org should now resolve to an unblocked IP address. Work is underway to move blog.nuget.org, dist.nuget.org, as well as some other lesser known endpoints. We will update this thread as we continue to make progress.

@loic-sharma
Copy link
Contributor

blog.nuget.org and dist.nuget.org should now resolve to an unblocked IP address. Could you confirm @demonix this? Thanks!

@dvdobrovolskiy
Copy link

Unblocked.

@proff
Copy link

proff commented Apr 26, 2018

Temporary works

You can complain to the Interior Ministry for violation of Articles 13.18 of the administrative code and 286 of the criminal code (Roscomnadzor must block only telegram)
sample: https://docs.google.com/document/d/1NAO-Sdch-LFKa3GzFyitTk-tkQ34g5LhE6EL1QonLGI/edit
Ministry of Internal Affairs site: https://мвд.рф/request_main

@dvdobrovolskiy
Copy link

Document looks like cops should care / they don`t

@loic-sharma
Copy link
Contributor

Great! Thanks @dvdobrovolskiy 😃

This issue should now be resolved. If anyone has any connectivity issues, feel free to reply on this thread and we will reopen it.

@dvdobrovolskiy
Copy link

Solved till new ip blocked. I suggest you ignore next claim about blocked ip and suggest proper proxy/vpn with obfuscation etc

@efimomax
Copy link

efimomax commented May 4, 2018

Today (04 May) this IP ([191.236.146.247]) of nugget.org was blocked.

@dvdobrovolskiy
Copy link

just ignore this as our government regulator ignores common sense

@cristinamanum
Copy link
Contributor

cristinamanum commented May 7, 2018 •
edited

Hi @efimomax, could you add some details of your scenario and from what geo region you try to access? Please collect an MTR log from the region that does not work.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Assignees

@loic-sharma loic-sharma

Labels
None yet
Projects
None yet
Milestone
No milestone
Development

No branches or pull requests