Skip to content

Commit dcb0957

Browse files
dazzling-no-moredazzling-no-more
committed
feat(exit-node): detect Akamai/CF bot-blocks at relay, add unity.com to defaults
1 parent 0797919 commit dcb0957

7 files changed

Lines changed: 449 additions & 76 deletions

File tree

‎assets/fronting-groups/curated.json‎

Lines changed: 55 additions & 21 deletions
Original file line numberDiff line numberDiff line change
@@ -1,42 +1,65 @@
11
{
22
"_comment": [
33
"Curated fronting groups derived from patterniha/MITM-DomainFronting",
4-
"(https://github.com/patterniha/MITM-DomainFronting). The Xray config",
5-
"in that project ships a tested set of (sni, edge, member-domain)",
6-
"tuples for Vercel, Fastly, AWS CloudFront, and direct-to-GitHub paths.",
4+
"(https://github.com/patterniha/MITM-DomainFronting) plus the",
5+
"subsequent expansions tracked in config.fronting-groups.example.json",
6+
"(PR #1191: vercel/fastly expansion + github-central/alive/gist/pubmed).",
77
"This file is the same data, restructured for rahgozar's `fronting_groups`",
88
"config shape. See docs/fronting-groups.md.",
99
"",
1010
"Edge IPs rotate. If a group stops working, re-resolve `sni`",
1111
"(`nslookup <sni>` or `dig +short <sni>`) and replace the IP in-place.",
12-
"Order matters — first group whose `domains` list matches wins, so the",
13-
"more-specific GitHub-direct groups appear before fastly (which would",
14-
"otherwise eat `*.githubusercontent.com` via suffix match).",
12+
"Order matters — github-* groups precede fastly because fastly's",
13+
"`githubusercontent.com` suffix would otherwise eat",
14+
"`objects-origin.githubusercontent.com` under first-match-wins; pinned",
15+
"by `curated_groups::tests::curated_bundle_parses`. Each domain is",
16+
"covered by exactly one group — `match_fronting_group` is single-shot",
17+
"and returns the first match, so duplicate routes never get tried as",
18+
"fallbacks (a dial failure surfaces the error rather than iterating).",
1519
"",
1620
"The `_comment` key is ignored by the deserializer (Config doesn't use",
17-
"`deny_unknown_fields`)."
21+
"`deny_unknown_fields`).",
22+
"",
23+
"Must stay structurally identical (same groups in the same order with",
24+
"matching name / ip / sni / domains) to config.fronting-groups.example.json's",
25+
"`fronting_groups` array — `curated_groups::tests::example_file_mirrors_curated_bundle`",
26+
"pins this so the CLI example and the UI's Load curated fronting groups",
27+
"button can't drift. Formatting and ordering of unrelated top-level keys",
28+
"(`_comment`, `mode`, etc.) are not part of the contract."
1829
],
1930
"fronting_groups": [
2031
{
21-
"name": "github-direct",
22-
"ip": "140.82.121.4",
23-
"sni": "github.com",
32+
"name": "github-central",
33+
"ip": "140.82.113.21",
34+
"sni": "central.github.com",
2435
"domains": [
25-
"gist.github.com"
36+
"objects-origin.githubusercontent.com",
37+
"api.individual.githubcopilot.com",
38+
"glb-db52c2cf8be544.github.com",
39+
"api.githubcopilot.com"
2640
]
2741
},
2842
{
29-
"name": "github-content-direct",
30-
"ip": "140.82.121.6",
31-
"sni": "central.github.com",
43+
"name": "github-alive",
44+
"ip": "140.82.112.26",
45+
"sni": "alive.github.com",
3246
"domains": [
33-
"objects-origin.githubusercontent.com"
47+
"alive.github.com",
48+
"live.github.com"
49+
]
50+
},
51+
{
52+
"name": "github",
53+
"ip": "140.82.121.3",
54+
"sni": "github.com",
55+
"domains": [
56+
"gist.github.com"
3457
]
3558
},
3659
{
3760
"name": "vercel",
38-
"ip": "76.76.21.21",
39-
"sni": "react.dev",
61+
"ip": "216.230.84.193",
62+
"sni": "nextjs.org",
4063
"domains": [
4164
"ai-sdk.dev",
4265
"cursor.com",
@@ -71,7 +94,7 @@
7194
},
7295
{
7396
"name": "fastly",
74-
"ip": "151.101.0.223",
97+
"ip": "151.101.128.223",
7598
"sni": "pypi.org",
7699
"domains": [
77100
"buzzfeed.com",
@@ -111,17 +134,28 @@
111134
"redditstatic.com",
112135
"redditstatus.com",
113136
"www.fastly.com",
137+
"www.pinterest.com",
114138
"www.python.org",
115139
"xtls.github.io"
116140
]
117141
},
118142
{
119-
"name": "cloudfront",
120-
"ip": "75.2.60.5",
143+
"name": "amazon-cloudfront",
144+
"ip": "3.33.186.135",
121145
"sni": "kubernetes.io",
122146
"domains": [
147+
"bitballoon.com",
123148
"netlify.app",
124-
"netlify.com"
149+
"netlify.com",
150+
"netlifystatus.com"
151+
]
152+
},
153+
{
154+
"name": "pubmed",
155+
"ip": "34.107.134.59",
156+
"sni": "pubmed.ncbi.nlm.nih.gov",
157+
"domains": [
158+
"pmc.ncbi.nlm.nih.gov"
125159
]
126160
}
127161
]

‎config.exit-node.example.json‎

Lines changed: 4 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -1,5 +1,5 @@
11
{
2-
"_comment": "Example config for using rahgozar with an exit-node deployment to bypass Cloudflare anti-bot blocks on chatgpt.com / claude.ai / grok.com / x.com. See assets/exit_node/README.md for the deployment walkthrough.",
2+
"_comment": "Example config for using rahgozar with an exit-node deployment to bypass datacenter-IP bot-blocks. Cloudflare (chatgpt.com / claude.ai / grok.com / x.com) and Akamai (unity.com and similar) both flag Apps Script's outbound Google datacenter IPs; the exit node fixes both. See assets/exit_node/README.md for the deployment walkthrough.",
33
"mode": "apps_script",
44
"google_ip": "216.239.38.120",
55
"front_domain": "www.google.com",
@@ -21,15 +21,16 @@
2121
"psk": "PUT_YOUR_EXIT_NODE_PSK_HERE",
2222
"_comment_mode": "selective: only `hosts` route via exit node (recommended). full: every request routes via exit node (slower, ~250-500ms extra hop).",
2323
"mode": "selective",
24-
"_comment_hosts": "Hostnames to route through the exit node. Matches exact OR dot-anchored suffix (chatgpt.com covers api.chatgpt.com etc.). Extend for any CF-anti-bot blocked sites you need.",
24+
"_comment_hosts": "Hostnames to route through the exit node. Matches exact OR dot-anchored suffix (chatgpt.com covers api.chatgpt.com etc.). Extend for any datacenter-IP-blocked sites you need (rahgozar logs a hint when it detects an Akamai / Cloudflare bot-block response).",
2525
"hosts": [
2626
"chatgpt.com",
2727
"claude.ai",
2828
"x.com",
2929
"grok.com",
3030
"openai.com",
3131
"aistudio.google.com",
32-
"ai.google.dev"
32+
"ai.google.dev",
33+
"unity.com"
3334
]
3435
}
3536
}

‎config.fronting-groups.example.json‎

Lines changed: 31 additions & 45 deletions
Original file line numberDiff line numberDiff line change
@@ -1,6 +1,35 @@
11
{
2-
"_comment": "Domain coverage mirrors assets/fronting-groups/curated.json (the bundle the UI Load curated fronting groups button installs). Edit IPs in-place if a group stops working - re-resolve sni with nslookup/dig and replace. The trailing github-direct / github-content-direct groups are alternate IP routes for gist.github.com / objects-origin.githubusercontent.com; the proxy uses first-match so they only activate if the leading group fails to resolve.",
2+
"_comment": "Domain coverage mirrors assets/fronting-groups/curated.json (the bundle the UI Load curated fronting groups button installs). Edit IPs in-place if a group stops working - re-resolve sni with nslookup/dig and replace. The github-* groups appear before fastly because fastly's `githubusercontent.com` suffix would otherwise eat `objects-origin.githubusercontent.com` under first-match-wins; pinned by `curated_groups::tests::curated_bundle_parses`. Each domain is covered by exactly one group — `match_fronting_group` is single-shot and returns the first match, so duplicate routes never get tried as fallbacks (a dial failure surfaces the error rather than iterating).",
3+
"mode": "direct",
34
"fronting_groups": [
5+
{
6+
"name": "github-central",
7+
"ip": "140.82.113.21",
8+
"sni": "central.github.com",
9+
"domains": [
10+
"objects-origin.githubusercontent.com",
11+
"api.individual.githubcopilot.com",
12+
"glb-db52c2cf8be544.github.com",
13+
"api.githubcopilot.com"
14+
]
15+
},
16+
{
17+
"name": "github-alive",
18+
"ip": "140.82.112.26",
19+
"sni": "alive.github.com",
20+
"domains": [
21+
"alive.github.com",
22+
"live.github.com"
23+
]
24+
},
25+
{
26+
"name": "github",
27+
"ip": "140.82.121.3",
28+
"sni": "github.com",
29+
"domains": [
30+
"gist.github.com"
31+
]
32+
},
433
{
534
"name": "vercel",
635
"ip": "216.230.84.193",
@@ -65,6 +94,7 @@
6594
"githubusercontent.com",
6695
"pinimg.com",
6796
"pinterest.com",
97+
"pypi.org",
6898
"redd.it",
6999
"reddit.app.link",
70100
"reddit.com",
@@ -94,57 +124,13 @@
94124
"netlifystatus.com"
95125
]
96126
},
97-
{
98-
"name": "github-central",
99-
"ip": "140.82.113.21",
100-
"sni": "central.github.com",
101-
"domains": [
102-
"objects-origin.githubusercontent.com",
103-
"api.individual.githubcopilot.com",
104-
"glb-db52c2cf8be544.github.com",
105-
"api.githubcopilot.com"
106-
]
107-
},
108-
{
109-
"name": "github-alive",
110-
"ip": "140.82.112.26",
111-
"sni": "alive.github.com",
112-
"domains": [
113-
"alive.github.com",
114-
"live.github.com"
115-
]
116-
},
117-
{
118-
"name": "github",
119-
"ip": "140.82.121.3",
120-
"sni": "github.com",
121-
"domains": [
122-
"gist.github.com"
123-
]
124-
},
125127
{
126128
"name": "pubmed",
127129
"ip": "34.107.134.59",
128130
"sni": "pubmed.ncbi.nlm.nih.gov",
129131
"domains": [
130132
"pmc.ncbi.nlm.nih.gov"
131133
]
132-
},
133-
{
134-
"name": "github-direct",
135-
"ip": "140.82.121.4",
136-
"sni": "github.com",
137-
"domains": [
138-
"gist.github.com"
139-
]
140-
},
141-
{
142-
"name": "github-content-direct",
143-
"ip": "140.82.121.6",
144-
"sni": "central.github.com",
145-
"domains": [
146-
"objects-origin.githubusercontent.com"
147-
]
148134
}
149135
]
150136
}

0 commit comments

Comments
 (0)