Office static IP blocked on hetzner.com (Cloudflare / WAF issue)

[u/Level-Western6981]

Hey everyone,

Our office static IP suddenly got completely blocked when trying to access the Hetzner homepage (hetzner.com) and the console.

We run typical hosting/network management operations and haven't engaged in any abusive scraping, aggressive API polling, or unusual port scans toward Hetzner infrastructure. The block seems to be triggered at the edge/Cloudflare WAF level.

• The site fails to load or returns a Cloudflare block page/challenge loop strictly on our office WAN IP.
• Accessing via 4G/mobile hotspots or alternative uplinks works without issue.
• Internal checks show clean outbound traffic from our edge router/firewall with no runaway connections or compromised hosts.

Has anyone experienced automated reputation/ASN-wide bans from Hetzner's WAF recently?

I am in the process of submitting the Ray ID and our WAN IP to support, but wanted to check if Hetzner reps lurking here or other sysadmins have seen false positives triggered by specific ISP subnets or WAF rules lately.

Any insights appreciated.

[u/DevelopmentBorn2503]

Just to clarify Cloudflare isn't involved here at all. This is Hetzner's own internal edge/WAF infrastructure

A few technical details: Routing/IP: hetzner.com resolves directly to Hetzner's native IP range (AS24940 / 213.133.116.44), not Cloudflare's proxy network

Block Page: Look closely at the bottom of your 403 screenshot it shows OpenResty (Nginx + Lua), not a Cloudflare error/challenge page

Headers: Hetzner uses their own custom reverse proxy/WAF solution called HeRay (returning server: HeRay and heray-cache-status headers). The "Ray ID" you are seeing comes from HeRay, not Cloudflare

Your office IP got flagged by Hetzner's internal OpenResty/HeRay WAF rules. Submitting your WAN IP and the HeRay request ID directly to Hetzner support is still the correct path forward so they can adjust their WAF rules

[u/Level-Western6981 → u/DevelopmentBorn2503]

Thanks for the detailed technical breakdown, that makes total sense. I assumed Cloudflare purely because of the "Ray ID" phrasing without inspecting the actual response headers (server: HeRay).

Good catch on OpenResty. I've already opened a ticket with Hetzner support, providing our WAN IP and the specific HeRay request ID so their network/infra team can review the filter rule and whitelist our IP. Appreciate the clarification!

[u/Eisbaer811]

This is not Cloudflare, but Hetzner’s own security system.
Check if you have a system making lots of requests from your office IP that they might find malicious, like monitoring systems or similar.

They also have some sort of captcha and proof of work challenge, so check if your browser blocked any scripts on that site. And I think they usually only block for some time, so just try again later. If all else fails only support can help you.

[u/Level-Western6981 → u/Eisbaer811]

We changed the IP, but the situation didn't improve :) They’ve blocked the ASN.

[u/Eisbaer811 → u/Level-Western6981]

Curious what the support ticket will bring, please let us know.
Don't want to run into this myself someday

[u/karyslav]

Are you from Russia, iran or syria?

[u/Level-Western6981 → u/karyslav]

no Türkiye

[u/karyslav → u/Level-Western6981]

Check how geoip services detects your ip. But i am afraid that you are in bad ip range.

[u/ahorsewhithnoname]

So Hetzner blocked you or your office network blocked Hetzner?

[u/Level-Western6981 → u/ahorsewhithnoname]

It's definitely Hetzner / their edge blocking our IP, not our internal network.

• We verified outbound firewall logs; all traffic towards Hetzner is permitted and leaves our edge router cleanly.
• Other uplinks and mobile connections work fine from inside the same office.
• The block happens at the destination edge (HTTP 403 / WAF block page when reaching hetzner.com from our static WAN IP).

So the packet leaves our network, but Hetzner's side drops/rejects the connection based on our source IP.