1762650 - Unable to access donate.mozilla.org page on Mozilla VPN

Status: RESOLVED FIXED

(Infrastructure & Operations :: SRE, defect)

Description

[Chris Hayes]

Attachment: Screenshot

User Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.60 Safari/537.36

Steps to reproduce:

Navigate to https://donate.mozilla.org/

Actual results:

I see:

403 ERROR
The request could not be satisfied.
Request blocked. We can't connect to the server for this app or website at this time. There might be too much traffic or a configuration error. Try again later, or contact the app or website owner.
If you provide content to customers through CloudFront, you can find steps to troubleshoot and help prevent this error by reviewing the CloudFront documentation.
Generated by cloudfront (CloudFront)
Request ID: jmIZK8dN_EUTxS-l9BP2y0vVCAPHEV5IuV-yw8slx7N9zF0ABU9zwg==

Expected results:

I should see the donate.mozilla.org website.

Comment 1

[Chris Hayes]

Additional Info:
Mozilla VPN: 2.7.0 (2.202201250329)
Server: New York City
Browser: Chrome v100
Device: Macbook Pro running MacOS Monterey v12.2.1
DNS: 1.1.1.1 (CloudFlare)

Comment 2

[phtown]

I also have this problem.

OS: Fedora Kinoite 36.20220810.0
Mozilla VPN: 2.8.4~rc95
Server: Ashburn -> Atlanta
Browser: Firefox 103.0.1
Request ID: 1G6aCTqAqBjA_Wv9SFopZovaXvbjroM1xq453ydIHas6Bf6XbytGsQ==

Comment 3

[Santiago]

Thank you for reporting this. It's reproducible on my end as well, with the Mozilla VPN as well as Outline, so I believe it's an origin problem rather than a specific VPN issue. Baku, do you think we could reassign to the Mozilla folks in charge of web servers?

Comment 4

[Andrea Marchesini [:baku]]

Jbuck, do you think SRE is the right component for a CloudFront issue?

Comment 5

[Jon Buckley [:jbuck]]

I suspect that Cloud Armor is blocking known VPN server IP's. ni? :jenc for more info

Comment 6

[JenC]

Yes, this is Cloudfront WAF blocking known VPN servers. We are aware of the issue with the donate WAF and working on a fix that will more gracefully handle VPN traffic than just sending back a 403 Forbidden.
[e-mail] - I can provide more detail to Mozilla employees through internal channels.

Comment 7

[JenC]

This issue is now fixed.