1 Background

In fact, in previous articles, I have provided relatively formulaic website building suggestions, as follows:

If you want to publish to the public network, you need to choose the most suitable publishing method based on your actual environment and the reverse proxy you use. You can refer to several of my previous articles:
1、Docker Series: Building Your Own Reverse Proxy Based on NPM Using Docker
2、Linux Panel Series: Configuring Reverse Proxy and Publishing Using Non-443 Ports
3、Home Data Center Series: Getting Cloudflare for Free via Domestic ICP-Filed Cloud Hosts to Achieve Fast Access to Domestic Sites from Abroad
4、Home Data Center Series: Getting Cloudflare for Free via Home Broadband Without Public IP to Achieve Fast Website Building (Universal)

Among them, the 1st and 2nd methods are suitable for environments with a public IP but without a legal 443 port (home broadband, non-filed cloud hosts), where non-standard ports need to be added after the URL (if using Cloudflare to build a website, no port needs to be added, but you need to customize the origin server port, which you can refer to:Home Data Center Series: Solving the Problem of Having a Public IP but No Legal 80 or 443 Ports for Website Building via Cloudflare's Origin Rules). The 3rd method is suitable for cloud hosts with ICP filing, and the 4th method is suitable for all environments (including environments without a public IP), which is also my recommended method (regardless of whether your environment has a public IP, because this method does not require running HTTPS traffic directly on the public network).

From a purely technical perspective, the above description is absolutely fine. But why am I writing another separate article to talk about the precautions for building websites using home broadband with a public IP? The reason is that I encountered a bizarre incident yesterday. However, before getting to the main point, I must first mention my past heroic deeds of being issued a notice letter by China Telecom. The content of the letter is as follows:

The reason for receiving this letter should be that I was running PT, which generated dozens of TBs of upload traffic every month. I estimate one person's traffic was equivalent to an entire residential community... This led to strong suspicions of illegal CDN operations. The person who came to deliver the letter to my door even deliberately rushed into the house and wandered around each room, probably looking for servers... But don't worry, everyone, I have now turned over a new leaf and limited my upload speed, after all, I have graduated from all the major sites... With this criminal record as a foundation, I still have some self-awareness about my background. After all, I am someone with a dark history, which in the past would be equivalent to having been in a ”cowshed” (re-education camp), with a bad background.

Yesterday afternoon, I suddenly received a call from a China Telecom operations and maintenance staff member. He asked me very directly whether I had published a website and told me to close it quickly, otherwise my IP would be blocked... Holy crap, I have published tons of websites, after all, I claim to have a home data center... But why did they suddenly call me? According to my previous understanding, home broadband public IPs don't have ports 80 and 443 anyway, so publishing services externally using other ports shouldn't be a big deal. Besides, my entire site is HTTPS, so they can't see my actual content. On what grounds are they asking me to shut down my website?

But after all, I am someone with a dark history, so my attitude was very good. I asked the telecom O&M staff member which specific website it was, thinking that if it was an unimportant site, I would just cooperate and close it. Then the O&M staff member asked me to add him on WeChat and sent me a screenshot of his chat history:

I took a look, and that domain name, URL, residential address, and contact information had absolutely nothing to do with me. I was dumbfounded at the time and told the O&M staff member directly that they had the wrong person. They checked and confirmed that they indeed had the wrong person. This matter should have ended there, but looking back, it didn't feel right. Why did they call me? I had to find the specific reason. Could it be because I am a prime suspect, so they look for me first for everything??
So I called the O&M staff member again and asked why they got the wrong person, demanding an explanation. Then they sent me the previous chat history again. It turned out that the domain name in the previously sent incorrect message was indeed my non-filed domain. It was probably copied and pasted incorrectly from a list of monitored non-filed domain access information, and mine got pasted in. So, the reason was found.

Looking at the chat history above, there are two characteristics: first, the domain name is not filed; second, it uses HTTP plaintext access. Actually, in the past, China Telecom turned a blind eye to this kind of access traffic. Now, this is probably because the network regulatory policies from above are getting stricter and stricter. After all, the overall environment is not great, and they are terrified of people doing bad things...

2 Consequences

Based on the above facts and the network regulatory policies that will only get stricter in the future, I have made the following adjustments to my recommendations for building websites using home broadband with a public IP:

It is still recommended to perform ICP filing for domains mainly used in China

In my previous articles, I only said that if you want to use a domestic CDN, the domain name must have an ICP filing, which is mandatory. However, if you use Cloudflare with a public IP as the origin server to build a website, ICP filing is not a must-have option. But the premise of this statement was that China Telecom turned a blind eye to inbound HTTP and HTTPS access traffic. Now it seems, however, that China Telecom has already started to take action against inbound HTTP traffic of non-filed domains, and taking action against inbound HTTPS traffic is probably just a matter of time. After all, if they can't see what you are doing, you are highly likely doing something bad. So in the future, for domains mainly used in China, you'd better honestly get an ICP filing to get a "good citizen certificate" for self-defense.

HTTPS becomes a must-have option

When using an ICP-filed domain with a domestic CDN as the origin domain, although HTTP and HTTPS are both optional, looking at the current situation, HTTPS has become a must-have option. An ICP-filed domain + HTTPS will guarantee security for some time to come. Otherwise, even if the domain is filed, but you run plaintext HTTP, it would be effortless for others to find fault with you if they want to investigate. If it is encrypted HTTPS traffic, others might not bother to make the effort.

When using Cloudflare to build a website, it is only recommended to use the Tunnel method

Although when home broadband has a public IP, using Cloudflare can directly use the public IP as the origin server address (see:Home Data Center Series: Solving the Problem of Having a Public IP but No Legal 80 or 443 Ports for Website Building via Cloudflare's Origin Rules), in the future, regardless of whether the home broadband has a public IP, I will prioritize recommending the Tunnel method. After all, the traffic of this method will not be exposed as inbound HTTPS traffic. Safety first.

If you are unwilling to get an ICP filing, you can only use Cloudflare and optimize the access speed

For personal blogs, if WordPress is used, Cloudflare's Worker optimization solution is still quite competitive (you can refer to this blog'shttps://blog.tangwudi.comaccess speed). Coupled with the highly cost-effective traffic scrubbing and security protection functions provided by the Free plan, it is still a very good choice for friends who are unwilling to get an ICP filing. In the future, I will write a Cloudflare tutorial series. The schedule for this series has been planned for a long time, but whenever I think about having to write so much, I get lazy... I'll procrastinate as long as I can...