結論寫在前面：2026 年 9 月 11 日凌晨往前算大約三到四個月左右，這個 blog 可能會不定時封鎖某些浮動 IP 的訪客，然後可能又會忽然恢復。原因：我的防火牆設定寫錯了……
不小心被封的人應該會看到，我這個 blog 有安裝 Wordfence 這個外掛來幫我做一些基本的攻擊防護；用的是免費版，所以一些功能相對陽春，但防那些想要亂試的登入者應該是綽綽有餘了：我這個 blog 只有一個發文帳號，帳號名也不是顯示在上面作者欄的那個名字，而且我還開了 Wordfence 提供的 2FA 驗證，就算猜中帳號也不會有 2FA 驗證碼可以打。
由於 Wordfence 對於一些攻擊會將其 IP 封鎖一段時間，我時不時會上來巡一下看最近有沒有擋到誰，看到有點過份的我會整理一下之後永封。就是這個整理動作出了問題：前一次整理 (大約是五、六月左右的事) 有把一些 IP 相近的攻擊者寫成 CIDR mask 的範圍 (畢竟這看起來要嘛是 botnet 感染了一票附近的電腦，要嘛是攻擊者本身是浮動 IP，那擋掉一小塊應該沒差)，但我記錯斜線後面的數字是數哪邊了：如果我要封 10.10.10.0 到 10.10.10.255 這個範圍的話，我應該要寫成 10.10.10.0/24，表示前面這個 IP 從左邊數過來 24 個 bit 要對，但是我寫成 10.10.10.0/8，以為是指定從右邊數過來 8 個 bit 可以任意；後一種的封鎖實際上封掉了 10.0.0.0 到 10.255.255.255 這一大塊區域，也就是誤封到了許多沒有要封的人。
然後就是在今天 (9 月 11 日) 我要上來看個東西時突然跳了封鎖頁面出來，嚇了一跳的我趕快進後台看有沒有什麼事發生 (這個 blog 是放在 google 雲上面，我可以直接登入機器看狀況)，但在資料庫裡翻了半天也沒有什麼特別的發現；回頭重新整理時可能是碰到正好跳到沒封的 IP 了所以讓我登了進來 (我還怕說是不是有什麼別的地方把我這個網址隨便導向，就藉著我在後台機器上弄了個簡單的小測試證明了這個網域沒被導走)，然後在看防火牆永封設定的時候才突然驚覺：欸這個 CIDR mask 好像怪怪的，仔細看了看才發現我寫錯邊……而且果不其然，有在這個時間附近觸發的規則都是原本該寫 /24 但被我寫成 /8 導致誤封一大票的項目。嘛，本來這個整理只是我不想在 log 裡看到一大票同樣的東西而已，所以就把那一波整理的名單裡 mask 寫錯邊的項目通通刪掉了。
不知道是幸運還是不幸，今年因為各種原因沒在這裡發文章，在這之前唯一發文日期是今年的是六月底左右時我把我的 GNOSIA 心得文翻譯成英文發在這裡 (那篇從動畫在播時就開始翻，林林總總大概有半年左右的零碎時間吧)，所以其他文章的觸及可能沒有太多影響，但那篇英文心得文可能今天開始才能開始累積觸及……我後面其實還積了兩篇心得文要發，但目前都才寫了個三成左右 (因為各種原因……) 所以這個問題一直到今天撞到了才發現。唉～
喔對了，因為那篇翻譯的心得文的關係，這篇會有英文版放在下面。
[English Version] False Alarm…
Let me get straight to the point: In a period of time about 3 to 4 months until September 10th, 2026, this blog may randomly block visitors that are otherwise legit. The reason: I made a mistake in setting up the firewall block rule.
As those who got blocked may observe, this blog uses Wordfence plugin to do some basic attack mitigation. I’m using the free version, so there are some functions lacking, but for protecting random attacks it should suffice: there is only one post account in this WordPress installation, which is not the name shown above; and I also uses the 2FA TOTP authentication provided by Wordfence, so even if someone accidentally “guessed” the account they still don’t have the 2FA code.
Since Wordfence automatically block some attack sources for some amount of time, I would occasionally login to review the block list, and made some blocks permanent if the attack crossed some line. This is where things went wrong: the last time I review the list around May or June, there are some blocks that target some similar IPs (which, I think, were either botnets from neighboring computers, or a “floating” IP that get reallocated however often), so I collected them, rewrote them into CIDR mask form, and made it permanent. But I misremembered the meaning of the number after the slash: if I want to block 10.10.10.0 to 10.10.10.255, I should write 10.10.10.0/24 indicating there are 24 bits from the left should match, but I wrote 10.10.10.0/8 thinking the 8 bits from the right could be anything. This latter rule actually blocked 10.0.0.0 through 10.255.255.255, meaning I blocked way more IPs then I intended.
Then today (September 10th) I want to login to do something, but faced with the block screen of Wordfence. Since this blog is hosted on Google Cloud, I can access the machine from there, so I logged in, rummaging through the database, but found nothing that may be the reason. When I went back to the browser, it randomly unblocked me so I logged in WordPress from the browser (after confirming that no one is redirecting the domain name to somewhere else, with a little check that I can do when I already logged into the back end machine). I then looked at the firewall block rules, and finally realized that my CIDR mask was written wrong. Adding support to this theory, the rules having last trigger time around this time are those masks that should be /24 but I wrote /8, which means the reason I got blocked is probably somehow my “floating” IP hit those too large of a range. Since the reason I rewrote the rule is simply that I don’t want those similar IPs show up, and now I cannot even know whether these bad actors are still there, I simply removed those wrong IP ranges.
Fortunately (or maybe unfortunately), because of various reasons, there is only one post in 2026 before this post: my English translation of GNOSIA review previously written in Traditional Chinese, which I’ve been worked on when the anime is still airing, working in my free time in the span of about half of a year. I think the reachability of my old posts are not that affected, but this English translation probably suffered a lot; it probably only really “shown to the public” starting today. And I have two reviews queued up that I have only written about 30% of them (which is part of the reason I found this out today). Welp.