NekoNeko666

一般这种会写 IP Routing Table ，来决定系统网络去向。你运行下 netstat -rn 看下不同的 tun interface 接口写了那些 CIDR 。系统是看哪一条 CIDR 范围最小哪一条有优先级。实在不行我觉得你可以写入哪些哪些 IP 用哪个 tun （启动两个 tun 然后看看接口的名称，然后自己添加到 routing table 里

最新的 cf ip
https://www.cloudflare.com/ips/

CloudFlare tunnel 然后拒绝任何 http ，https 端口访问，tunnel 直接和 CF 链接

或者，用 ufw ，允许 ssh ，只允许 CF ip 段的 http 和 https

sudo ufw allow ssh

# Allow HTTP (port 80) for Cloudflare IPv4 ranges
sudo ufw allow from 173.245.48.0/20 to any port 80
sudo ufw allow from 103.21.244.0/22 to any port 80
sudo ufw allow from 103.22.200.0/22 to any port 80
sudo ufw allow from 103.31.4.0/22 to any port 80
sudo ufw allow from 141.101.64.0/18 to any port 80
sudo ufw allow from 108.162.192.0/18 to any port 80
sudo ufw allow from 190.93.240.0/20 to any port 80
sudo ufw allow from 188.114.96.0/20 to any port 80
sudo ufw allow from 197.234.240.0/22 to any port 80
sudo ufw allow from 198.41.128.0/17 to any port 80
sudo ufw allow from 162.158.0.0/15 to any port 80
sudo ufw allow from 104.16.0.0/12 to any port 80
sudo ufw allow from 172.64.0.0/13 to any port 80
sudo ufw allow from 131.0.72.0/22 to any port 80

# Allow HTTPS (port 443) for Cloudflare IPv4 ranges
sudo ufw allow from 173.245.48.0/20 to any port 443
sudo ufw allow from 103.21.244.0/22 to any port 443
sudo ufw allow from 103.22.200.0/22 to any port 443
sudo ufw allow from 103.31.4.0/22 to any port 443
sudo ufw allow from 141.101.64.0/18 to any port 443
sudo ufw allow from 108.162.192.0/18 to any port 443
sudo ufw allow from 190.93.240.0/20 to any port 443
sudo ufw allow from 188.114.96.0/20 to any port 443
sudo ufw allow from 197.234.240.0/22 to any port 443
sudo ufw allow from 198.41.128.0/17 to any port 443
sudo ufw allow from 162.158.0.0/15 to any port 443
sudo ufw allow from 104.16.0.0/12 to any port 443
sudo ufw allow from 172.64.0.0/13 to any port 443
sudo ufw allow from 131.0.72.0/22 to any port 443

# Allow HTTP (port 80) for Cloudflare IPv6 ranges
sudo ufw allow from 2400:cb00::/32 to any port 80
sudo ufw allow from 2606:4700::/32 to any port 80
sudo ufw allow from 2803:f800::/32 to any port 80
sudo ufw allow from 2405:b500::/32 to any port 80
sudo ufw allow from 2405:8100::/32 to any port 80
sudo ufw allow from 2a06:98c0::/29 to any port 80
sudo ufw allow from 2c0f:f248::/32 to any port 80

# Allow HTTPS (port 443) for Cloudflare IPv6 ranges
sudo ufw allow from 2400:cb00::/32 to any port 443
sudo ufw allow from 2606:4700::/32 to any port 443
sudo ufw allow from 2803:f800::/32 to any port 443
sudo ufw allow from 2405:b500::/32 to any port 443
sudo ufw allow from 2405:8100::/32 to any port 443
sudo ufw allow from 2a06:98c0::/29 to any port 443
sudo ufw allow from 2c0f:f248::/32 to any port 443

sudo ufw deny 80
sudo ufw deny 443

sudo ufw enable

或者 iptables

或者，用你云服务商的防火墙设置，允许 cf 的 ip 段

好像是 bug ，只能等更新

https://v2ex.com/t/1091806

一点细节

风控是基于验证等等的 Risk Matrix
https://developer.apple.com/documentation/devicecheck/assessing-fraud-risk

Specifically, you can get an approximate count of unique attestations for your app on a particular device.

可以获得在一台设备上的验证或注册次数

如果主力机已经是 iPhone ，但是账号区域有问题，可以 Apple Store 买个新的 iPhone SE 等注册。

应该是 Mac 失败后，联系客服解释理由，客服会消除掉现有设备 DeviceCheck API 生成的 ID ，然后指导你去手机操作。更换设备，设备 ID 不一致是系统自动 ban ，客服确实没有选项恢复。注册成功后会设置 DeviceCheck 的 2 个 binary 中的一个，标记设备已经用于 developer 注册，所以必须新设备。

邮箱端口一般 587 ，465 ，还有 25 。这个 SSL 报错说明走的 STARTTLS 协议可以设置下 587 和 465 端口不走公司网络

估计是 MITM 公司用自己的证书解密邮件分析内容。邮箱的话 SMTP 端口 587 ，可以看看日志是否请求被增强模式处理。