A brief account of my first internet disconnection and account lockout

This story starts with my internet being cut off by Telecom for 2 days last month... Around 10 PM on a certain evening in mid-May, my home broadband suddenly disconnected. I thought it was just a normal broadband failure, so I didn't pay much attention to it, and simply reported the fault to 10000 before going to sleep.

Early the next morning, a telecom maintenance engineer came to my home. After some testing, he found that my broadband account was locked (the optical modem showed LOT authentication failed, ITMS successful, which is the opposite of the usual LOT successful, ITMS failed after replacing the optical modem yourself). After communicating with the backend support department, he told me that the account was directly locked by the Communications Administration, and Telecom itself didn't even know about it...

This left me speechless. The key point was asking for the reason, which Telecom didn't know either, only saying that this matter was no longer under their control. I was absolutely confident that I hadn't left any vulnerabilities to be caught, because in my previous article (Home Data Center Series: Home Data Center IPv4/IPv6 Dual-Stack Network Architecture and Application Access Flow Optimization), I mentioned that by early March, I had completed the network upgrade and renovation. All domain names for inbound access requests had been changed to ICP-filed domains, and even all Emby access traffic had been upgraded to HTTPS. I believed I had no weaknesses. The only exception was "wow.tangwudi.com", which is the access domain for my TrinityCore 3.3.5 World of Warcraft server. However, that access was purely IP-based; the domain was only used to resolve the IP, and it was TCP-only, not HTTP, so I didn't bother with it.

When the internet disconnection exceeded 40 hours and Telecom still hadn't provided any feedback (presumably they hadn't received feedback from the Communications Administration either), after filing a complaint with the 10000 hotline and getting a complaint number, I submitted a complaint to the Ministry of Industry and Information Technology (MIIT) (complaining that Telecom cut off my internet without contacting me and still hadn't given me a reason after 40 hours). I also regularly called 10000 to inquire about the progress according to the normal procedure (to keep a record of the phone recordings). After 60 hours of disconnection, I finally received informal feedback from Telecom (the reason it's called an informal notification is that it was just sent to me by a Telecom maintenance staff member via their personal WeChat, not an official announcement):

This reason made me absolutely furious: wow.tangwudi.com is the address of the WoW server, and 8443 is the default remote management port of the iKuai router. I hadn't used this domain for any HTTP(S) access in nearly a year, nor had I accessed iKuai's remote management port from the WAN, let alone used "wow.tangwudi.com" to access iKuai's port 8443. The most likely reason is that Telecom (or some department) was sniffing DNS packets, detected my "wow.tangwudi.com" domain (iKuai's DDNS feature periodically sends update packets mapping the WAN IP to "wow.tangwudi.com"), then performed a port scan targeting "wow.tangwudi.com", found port 8443, and blocked me... So this could entirely be entrapment! In a fit of anger, I filed another complaint against Telecom on the internet complaint platform!

There wasn't much to say after that. Before 72 hours had passed, Telecom contacted me, restored my internet, and offered to compensate me with one month's internet fee. Originally, I wanted to take this opportunity to request an upgrade to 2000M while keeping my public IPv4 address (nowadays, if you upgrade to 2000M, if you originally had a public IPv4 address, there is a high probability you will lose it after the upgrade, and even Telecom's district-level leaders do not have the authority to change this). After asking around, I found out it was indeed highly unlikely, so in the end, I let it go, accepted the one-month internet fee compensation, and withdrew the complaint.

Currently, only old Telecom plans can still retain public IPv4 addresses. For new plans, if you want a public IPv4 address, you have to pay for it, requiring a minimum of a 399 plan + 100 service fee. Therefore, my 199 plan (1000M downlink, 50M uplink) is already a discontinued plan and must not be changed; once changed, the public IPv4 address will be gone.

To sum up, as long as you first ensure you haven't made any mistakes, you can confidently file a complaint with the MIIT (Ministry of Industry and Information Technology) when encountering this situation. However, you must choose the focus of your complaint carefully (for example, I complained that Telecom cut off the network without prior notice; the scope of the complaint must be well-controlled). Currently, although MIIT complaints are not as effective as before, they are still somewhat useful. This complaint accelerated the recovery of my network; otherwise, I might have had to wait another 1-2 days to receive the rectification notice, and then another 1-2 days before the network could be restored.

Looking back now, the suspension of multi-dialing on April 17, leaving only single-dialing, might have signaled the start of this crackdown, and the restoration of multi-dialing around May 20 might mean the crackdown has ended. During this month, who knows how many users with public IPs had their networks disconnected for rectification because of router remote management ports and NAS remote access ports. At least, according to what I heard from the operations engineer, "many" accounts were temporarily suspended.

From February to now, it feels like the inspection of inbound HTTP(S) requests for home broadband with public IP addresses has become increasingly strict. If the domain name is not registered (ICP filing), such as some free domain names, it is recommended not to use them. Otherwise, having your network cut off for 3-5 days is unbearably frustrating (this time it even forced me to temporarily buy a 4G CPE router for emergency use).

However, this network disconnection incident also had its benefits, as it allowed me to completely confirm Telecom's current method of detecting unregistered domain names. I estimate other operators are similar, and it is quite low-end—likely just sampling inbound HTTP(S) traffic: for plaintext HTTP, they look directly at the domain name and compare it with the registered domain database; for HTTPS, they extract the domain name using the SNI obtained during the SSL handshake and compare it with the registered domain database. Because it is sampling, inbound access to unregistered domains with low traffic might not be detected. That's why domain names and ports like mine, which I had forgotten about myself, were only discovered in May (possibly scanned, otherwise they might not have been found at all). Therefore, the article I wrote in February (Home Data Center Series: Precautions for Building a Website with Home Broadband Having a Public IP) is fully applicable to friends who want to use home broadband to build websites in the future (regardless of whether they have a public IPv4 address).

Attached are the complaint addresses for the MIIT and the Internet Information Service Complaint Platform. Note that you must first file a complaint with the operator to obtain a complaint number before complaining to the MIIT.

MIIT Complaint Address:https://yhssglxt.miit.gov.cn/web/userAppeal/
Internet Information Service Complaint Platform Address:https://hlwtsxt.miit.gov.cn/#/complaint/default

The necessity of domain name ICP filing: now, today, and right at this moment

For friends who have home broadband with a public IP address (IPv4 or IPv6) and want to use it to build a website targeting domestic users, ICP filing is probably truly unavoidable now. Especially for websites mainly targeting domestic users, because using domestic CDNs already makes ICP filing an unavoidable step, and with operators checking strictly now, the public back-to-source traffic from the CDN to the origin server inside the home network must use a registered domain name. Even if you are just accessing your home router, NAS, or other devices via a public IP, you still have to use a registered domain name. This is the current reality.

Fortunately, personal ICP filing is not too troublesome. I have already discussed the precautions in the article:Clever Tricks Series: Analyzing the Implementation Principles of the MIIT ICP Filing System from a Technical Perspective(I have hidden some sensitive parts, but I have released all the precautions related to ICP filing). You can take a look if needed. In short, if a domain name can be registered, it is better to go ahead and register it. A registered domain name is equivalent to a whitelist in China, which is actually very useful. However, not just any domain name can be registered. First, there are requirements for the domain registrar. Second, an ICP filing authorization code is required. For individuals, the easiest way to obtain this code is to purchase a cloud server from a cloud provider, which will then come with this code. You can search online for the specific method, as it cannot be explained clearly in just a few words.

Choosing blog-building methods primarily targeting domestic users

Why talk about this? Because I still often see people asking this question on Zhihu, followed by a bunch of recommendations for various dynamic and static framework solutions, selling cloud hosts, selling virtual hosts... Actually, although there are indeed many technical choices for building a blog, in China today, there is actually no choice left.

Generally, we say blogs are divided into dynamic and static (for specific differences, please refer to the article:Home Data Center Series: Building a Static Blog with Hexo and Deploying It to Cloudflare Pages, so I won't say more here), the representative of dynamic blogs is WordPress. Generally, beginners who don't understand code are also recommended to use this, because WordPress supports full-text search and comments by default, which is very friendly for blogs, and it is also very convenient to expand functions through various plugins. However, the Communications Administration requires that personal blogs cannot have comment functions, saying that this is a forum function~~ and individuals cannot set up forums. May I ask, if you don't want the comment function, is a full-text search function alone worth the effort of learning and using WordPress? Therefore, if you are using an ICP-filed domain to build a personal blog for domestic visitors, it is recommended not to use WordPress. It can be said that in China, WordPress-based personal blogs are dead.

So, if you don't use the dynamic blog method, you can only choose the static blog method. There are actually quite a few options for this, among which Hexo is the most used. However, although static blogs do not need to use a database, they need to deploy the required environment in the hosting provider's space. Currently, I searched around and couldn't find any good and free domestic solutions. Gitee's current censorship is so abnormal; I have seen too many personal blog owners reporting that their articles were censored or failed to pass review. Tencent's CloudBase seems to work, but it charges fees, so I couldn't try it. I think domestic cloud providers should have corresponding solutions, but they probably all charge fees, so I didn't bother to research them. Anyway, it is definitely possible, but it costs money, and you also have to face increasingly strict censorship in the future.

Changing the mindset, if you have already purchased a cloud host because you need an ICP filing, then make full use of this cloud host, directly build the Hexo environment on it, and then accelerate it through domestic CDN providers. This solution is feasible. The only downside is that the CDN method cannot prevent many attacks. It can prevent HTTP flood attacks, but this is achieved by consuming normal CDN traffic. You know, one day I was attacked for a few hours and it consumed 2T of traffic~~~ (For details, you can refer to my articles about being DDoS attacked. Of course, you can set a CDN traffic limit, but when the CDN reaches the threshold and stops, external access to the website is also cut off). This method of directly using domestic CDN + domestic cloud host to build a website is very fragile when encountering various attacks. Of course, if the cloud host performance is strong enough, you can also filter some attacks by deploying a WAF solution, but the price is not cheap.

There is another method, which is the "True Home Data Center" solution I advocate (this method of cooperating with domestic CDNs requires home broadband to have a public IP). To put it bluntly, it means finding any existing device at home to utilize, including NAS that supports Docker. As long as it can support a Docker deployment environment, you can do anything. If the device performance is sufficient, you can deploy a free web application firewall, free load balancing equipment, etc., in front of the blog through containers. Combined with the acceleration of domestic CDN providers, it is still viable. Of course, wealthy users can also directly buy security services from cloud providers, such as WAF, DDoS protection, etc., which is also possible. The only drawback is that it is very expensive. Currently, Tencent's newly launched EdgeOne also seems to work (similar to Cloudflare's edge network-based integrated solution), but one hostname costs 9 yuan a month. It's not too expensive, but not cheap either. You can give it a try.

Note: Why didn't I mention Cloudflare above? Because for websites mainly targeting domestic users, using Cloudflare is actually not very suitable. Besides, Cloudflare still has a certain learning curve. Although you can also point the third-level domain of an ICP-filed domain to Cloudflare through a custom hostname for traffic scrubbing, if you want to get a better access experience (such as optimized IPs), you have to spend money. In that case, it's better to honestly use domestic CDNs, after all, domestic CDN traffic is cheap.

Choosing blog-building methods with a global focus

If the visiting users are not limited to domestic ones but are global, then you can adopt Cloudflare's solution.

Using this method, you do not need domain ICP filing, nor do you have to buy a cloud server (if you don't want to deploy it at home, you will need to buy a cloud server, after all, software always needs a place to be installed), and home broadband does not need to have a public IP address (tunnel method). Whether the blog is dynamic or static (here it is mainly dynamic blogs, because static ones do not need to be deployed locally and can be deployed directly on the cloud; there are simply too many choices of hosting providers abroad that support static blog frameworks for free), either is fine. Average users do not need to pay (because there is a free plan), you only need to have a device at home that can deploy a Docker environment. The cost is less than 1 kWh of electricity per day (provided you have a device at home that can be turned on 24 hours a day; of course, if you don't need the website to provide services 24 hours a day, turning it off and on at any time is also fine~).

Note: If you choose this solution, for beginners who do not understand code, it is very suitable to use the WordPress dynamic blog solution (for the building method, you can refer to this article:Docker Series: Using Docker to Set Up a Blog Slave Site Based on WordPress and Implement Regular Backups of Master-Slave Site Configurations)：supports comments, supports full-text search, supports expanding functions through rich plugins, etc. There are tons of tutorials online... Even the official website of the US White House uses WordPress~).

Naturally, this method also has disadvantages: by default, access for domestic users will be relatively slow (needs optimization, which is another round of learning and tossing); although Cloudflare is simple (as I see it now), it still requires a certain learning curve for beginners: you need to learn many basic concepts, which is especially annoying for some friends who get a headache when seeing professional concepts; you need at least one device at home that can support a Docker deployment environment (although any idle laptop or NAS that supports Docker will do, not every family has an idle laptop and a NAS that supports Docker).

But overall, the advantages of this method outweigh the disadvantages, especially under the current severe network situation. How much messy trouble can you save by spending a little money (the electricity bill for 1 kWh of electricity per month)? Therefore, I believe more and more friends will choose this method in the future. My home data center solution is based on this judgment. In the future, I will also write a series of Cloudflare tutorials (I wanted to write it a long time ago, but I always feel that my understanding is not deep enough, and after a while, a new requirement pops up, and I have to relearn, so I haven't started writing it yet).

Is it still necessary to build a personal blog?

Currently, if it is only from the perspective of attracting traffic for monetization, the personal blog method does not need to be considered at all. It is far better to directly use platforms with large user bases such as WeChat Official Accounts, Zhihu, CSDN, and CNBlogs. After all, the SEO of these sites is very well done, and the articles you write can easily be searched by search engines. If it is a self-built blog, even if you write your articles well, if the SEO is not done well, it will be difficult to be indexed by search engines. For those who are still persisting in writing personal blogs now, the main goal is definitely not for money, and they even have to spend money~.

So is there still a need to establish a personal blog now? On the contrary, I feel it is necessary, especially independent personal blogs that do not rely on the domestic environment. Here, you can be free from the influence of those messy rules, you can speak freely (within a certain range), you don't have to worry about your posts being deleted at will, it can serve as your spiritual sustenance, and you can leave your unique mark on the Internet. However, these benefits have nothing to do with money; they are all spiritual gains (you can refer to my other article:Viewing the Significance of the Existence of Current Personal Blogs from the Beginning and End of My Blog)。

However, establishing a personal blog is really not suitable for everyone, because it requires long-term persistence. Persistence itself is very difficult, like losing weight (I haven't done well myself~~), not to mention that it often requires generating electricity for love (doing it out of passion). Many friends start making personal blogs because they see other people's cool personal blog websites and want to have one of their own. Then they research various blog frameworks and technologies, constantly switching from this framework to that framework, static for a while, dynamic for a while, and finally, the blog content is all about teaching how to build a blog. Such blogs are everywhere. It's not to say it's bad, but it always feels a bit like putting the cart before the horse.

A personal blog itself is just a carrier. It carries your beliefs, your life, and the records of your learning and growth. Therefore, content and persistence should be its essence, and the carrier itself is actually not that important. No matter which carrier is used, how many blogs will still be updated 5 or 10 years from now?

Ramblings

Actually, I only started learning how to build a personal blog in August last year (and I am still learning and exploring now), so how am I qualified to preach... It's just that I have now felt the various benefits (spiritual) of having an independent personal blog, and I also understand the feelings of those bloggers who have been persisting for many years. At the same time, I hope to have more fellow travelers, which is why I want to use this article to tell those friends who still want to build a personal blog now what kind of solutions they should choose under the current actual environment, different needs, and scenarios, and I also hope these friends can avoid some detours.