Could not create paste: server error or not responding - Cloudflare related

[AdamB2023]

Describe the problem/question

My PrivateBin worked fine for a while, but Cloudflare forced rules migration, and it stopped after that.
While clicking send error is returned: Could not create paste: server error or not responding.

Cloudflare Page Rules for hostname:
Disable Security, Browser Integrity Check: Off, Web Application Firewall: Off, Polish: Off, Auto Minify: Off, Rocket Loader: Off, Mirage: Off, Security Level: Essentially Off, Cache Level: Bypass, Disable Zaraz, Origin Cache Control: Off, Opportunistic Encryption: Off, Disable Apps

Cloudflare Cache Rules for hostname: Bypass cache

Cloudflare Configuration Rules: Auto Minify: Off, Browser Integrity Check: Off, Disable Apps, Disable Zaraz, Hotlink protection: Off, Mirage: Off, Opportunistic Encryption: Off, Polish: Off, Rocket Loader: Off, Security Level: Essentially Off, Server Side Excludes: Off

Browser response:

Please advise me on what can be wrong, if any data are needed, i can provide.

Did you use the FAQ section?

• Yes, I have read the FAQ and I found no solution/answer there.

What you did?

1. Open PrivateBin page, it loaded
2. Send a paste, error is returned

Server OS

Windows 2012

Webserver

ISS

PrivateBin version

1.7.1

Browser and version

Brave: 121.0.6167.184 64 bit

Local operating system and version

Windows 11

Issue reproducibility

No, I cannot reproduce it on https://privatebin.net.

[elrido]

Similar to other such questions, when only the paste creation fails, check the webserver's and/or php services' error logs. The logged error should indicate the source of the error, like a permission problem or if the error comes from some other source.

Alternatively, if you want to rule out that it's cloudflare's fault, bypass them and access the instance directly and see if the problem persists or not.

[AdamB2023]

The webserver configuration didn't change; there were no PHP error logs; it happened after Cloudflare enforced rules migration.
However, as posted above, I've enabled all bypassing I could find, but it still seems that something is routing through it.
If anyone else experienced this issue with what you changed in CF so that it went through, as I managed it last time, but this one can't make it in any way.

[AdamB2023]

We can't consider dropping CF as it prevents exposing internal infrastructure IPs, which are handling way more services. Eventually, there must be a way to bypass what's being blocked. The last way will be moving to another dedicated machine, but i still believe there must be a way to set the right rule somewhere, and would appreciate anyone giving an advice on what he did. There must be some CF user yet, with privatebin deployed with CF, and it's even mentioned in the guide itself.

[elrido]

You... You don't use a router in front of your services? 🫢 Oh, well...

[AdamB2023]

It's a company infrastructure in a dedicated datacenter, with hardware firewalls, and few thousand of customers. Nowadays you can't live without a cloud based front-end service, not matter what if you're scaling constantly.
PrivateBin we're just using as an addition to our set of privacy rules. We do prefer own local and open source solutions rather than cloud based, but still CF is really decent service, not only with on the fly threats filtering, CDN, smart routing, but also capable to handle almost any kind of traffic. I hope it clears a bit.

[rugk]

That's your opinion, note that as for PrivateBin many instances run without any CDN in front. Anyway, you have / should have a reverse proxy in front of PrivateBin/or use apache.

As always for Cloudflare, make sure you have configured it correctly as per our FAQ: https://github.com/PrivateBin/PrivateBin/wiki/FAQ#user-content-how-to-make-privatebin-work-when-using-cloudflare-for-ddos-protection

[AdamB2023]

We figured it out; it was the OWSAP rules after migration in the WAF section.