{"id":52639,"date":"2019-11-13T00:00:00","date_gmt":"2019-11-12T21:00:00","guid":{"rendered":"https:\/\/prohoster.info\/blog\/blog_prohoster\/domen-fronting-na-baze-tls-1-3"},"modified":"2026-05-20T19:54:20","modified_gmt":"2026-05-20T17:54:20","slug":"domen-fronting-na-baze-tls-1-3","status":"publish","type":"post","link":"https:\/\/prohoster.info\/cs\/blog\/administrirovanie\/domen-fronting-na-baze-tls-1-3","title":{"rendered":"Domenov\u00e9 frontov\u00e1n\u00ed na b\u00e1zi TLS 1.3","gt_translate_keys":[{"key":"rendered","format":"text"}]},"content":{"rendered":"

\u00davod<\/h3>\n

\"Domenov\u00e9
\nModern\u00ed korpor\u00e1tn\u00ed syst\u00e9my filtrace obsahu, od zn\u00e1m\u00fdch v\u00fdrobc\u016f jako Cisco, BlueCoat, FireEye, maj\u00ed mnoho spole\u010dn\u00e9ho s jejich v\u00fdkonn\u011bj\u0161\u00edmi prot\u011bj\u0161ky \u2014 DPI syst\u00e9my, kter\u00e9 jsou aktivn\u011b zav\u00e1d\u011bny na n\u00e1rodn\u00ed \u00farovni. Podstatou pr\u00e1ce obou syst\u00e9m\u016f je prov\u00e1d\u011bt inspekci p\u0159\u00edchoz\u00edho a odchoz\u00edho internetov\u00e9ho provozu a na z\u00e1klad\u011b \u010dern\u00fdch\/b\u00edl\u00fdch seznam\u016f rozhodovat o zablokov\u00e1n\u00ed internetov\u00e9ho spojen\u00ed. A proto\u017ee oba syst\u00e9my vych\u00e1zej\u00ed ze stejn\u00fdch princip\u016f, budou m\u00edt i zp\u016fsoby jejich obch\u00e1zen\u00ed mnoho spole\u010dn\u00e9ho.<\/p>\n

Jednou z technologi\u00ed, kter\u00e1 umo\u017e\u0148uje efektivn\u011b obch\u00e1zet jak DPI, tak korpor\u00e1tn\u00ed syst\u00e9my, je technologie dom\u00e9nov\u00e9ho frontingu. Jej\u00edm z\u00e1kladem je, \u017ee se dost\u00e1v\u00e1me na zablokovan\u00fd zdroj, p\u0159i\u010dem\u017e se skr\u00fdv\u00e1me za jinou ve\u0159ejnou dom\u00e9nou s dobrou pov\u011bst\u00ed, kter\u00e1 nebude zablokov\u00e1na \u017e\u00e1dn\u00fdm syst\u00e9mem, nap\u0159\u00edklad google.com.<\/p>\n

O t\u00e9to technologii bylo naps\u00e1no ji\u017e dostatek \u010dl\u00e1nk\u016f a uvedeno mnoho p\u0159\u00edklad\u016f. Nicm\u00e9n\u011b popul\u00e1rn\u00ed a ned\u00e1vno diskutovan\u00e9 technologie DNS-over-HTTPS a encrypted-SNI, stejn\u011b jako nov\u00e1 verze protokolu TLS 1.3, umo\u017e\u0148uj\u00ed prozkoumat je\u0161t\u011b jeden variant dom\u00e9nov\u00e9ho frontingu.
\n<\/a><\/p>\n

Poj\u010fme se pod\u00edvat na technologii<\/h3>\n

Nejprve si stru\u010dn\u011b objasn\u00edme z\u00e1kladn\u00ed pojmy, aby v\u0161ichni rozum\u011bli, kdo je kdo a k \u010demu je to v\u0161echno pot\u0159eba. Zm\u00ednili jsme mechanismus eSNI, jeho\u017e fungov\u00e1n\u00ed bude podrobn\u011bji probr\u00e1no. Mechanismus eSNI (encrypted Server Name Indication) \u2013 zabezpe\u010den\u00e1 varianta SNI, dostupn\u00e1 pouze pro protokol TLS 1.3. Hlavn\u00ed podstatou je \u0161ifrov\u00e1n\u00ed tak\u00e9 informac\u00ed o tom, na jakou dom\u00e9nu je zasl\u00e1n po\u017eadavek.<\/p>\n

A nyn\u00ed se pod\u00edv\u00e1me na praktickou funkci mechanismu eSNI.<\/p>\n

P\u0159edstavme si, \u017ee m\u00e1me internetov\u00fd zdroj, kter\u00fd je blokov\u00e1n modern\u00edm DPI \u0159e\u0161en\u00edm (vezm\u011bme si nap\u0159\u00edklad slavn\u00fd torrent tracker \u2014 rutracker.nl). P\u0159i pokusu o n\u00e1v\u0161t\u011bvu webu torrent trackeru vid\u00edme standardn\u00ed vzkaz od poskytovatele, \u017ee je zdroj blokov\u00e1n:<\/p>\n

\"Domenov\u00e9<\/p>\n

Na webu RKN je tato dom\u00e9na skute\u010dn\u011b uvedena na blacklistu:<\/p>\n

\"Domenov\u00e9<\/p>\n

P\u0159i dotazu whois je vid\u011bt, \u017ee samotn\u00e1 dom\u00e9na je \"schov\u00e1na\" za cloudov\u00fdm poskytovatelem Cloudflare.<\/p>\n

\"Domenov\u00e9<\/p>\n

Ale na rozd\u00edl od \u201especialist\u016f\u201c z RKN, technicky zdatn\u011bj\u0161\u00ed pracovn\u00edci z Beeline (nebo pou\u010deni ho\u0159kou zku\u0161enost\u00ed na\u0161eho slavn\u00e9ho regul\u00e1tora) se nerozhodli prost\u011b blokovat web podle IP adresy, ale za\u0159adili do \u010dern\u00e9 listiny pr\u00e1v\u011b dom\u00e9nov\u00e9 jm\u00e9no<\/a>. To lze snadno ov\u011b\u0159it, pokud se pod\u00edv\u00e1te, jak\u00e9 dal\u0161\u00ed dom\u00e9ny se skr\u00fdvaj\u00ed za t\u00edmto IP adresou<\/a>, nav\u0161t\u00edv\u00edte jednu z nich a uvid\u00edte, \u017ee p\u0159\u00edstup nen\u00ed zablokov\u00e1n:<\/p>\n

\"Domenov\u00e9<\/p>\n

Jak to tedy funguje? Jak\u00fdm zp\u016fsobem provider DPI zjist\u00ed, na kterou z dom\u00e9n m\u016fj prohl\u00ed\u017ee\u010d sm\u011b\u0159uje, kdy\u017e v\u0161echny komunikace prob\u00edhaj\u00ed podle protokolu https, a zat\u00edm jsme si nev\u0161imli \u017e\u00e1dn\u00e9 podvodn\u00e9 certifikace https od Beeline? Nen\u00ed snad vid\u00edc\u00ed, nebo za mnou prob\u00edh\u00e1 sledov\u00e1n\u00ed?<\/p>\n

Zkus\u00edme odpov\u011bd\u011bt na tuto ot\u00e1zku pohledem na provoz p\u0159es Wireshark<\/p>\n

\"Domenov\u00e9<\/p>\n

Na screenshotu je vid\u011bt, \u017ee nejprve prohl\u00ed\u017ee\u010d z\u00edsk\u00e1v\u00e1 IP adresu serveru p\u0159es DNS, potom prob\u00edh\u00e1 standardn\u00ed TCP handshake se c\u00edlov\u00fdm serverem, a pot\u00e9 se prohl\u00ed\u017ee\u010d pokou\u0161\u00ed nav\u00e1zat ssl spojen\u00ed se serverem. K tomu p\u0159en\u00e1\u0161\u00ed paket SSL<\/a> Client Hello, jeho\u017e sou\u010d\u00e1st\u00ed je n\u00e1zev zdrojov\u00e9 dom\u00e9ny v otev\u0159en\u00e9 podob\u011b. Toto pole je nezbytn\u00e9 pro front-end server Cloudflare, aby spr\u00e1vn\u011b sm\u011broval spojen\u00ed. Pr\u00e1v\u011b zde n\u00e1s chyt\u00ed poskytovatel DPI, p\u0159eru\u0161\u00ed na\u0161e spojen\u00ed. P\u0159itom nedost\u00e1v\u00e1me \u017e\u00e1dnou z\u00e1stupnou str\u00e1nku od poskytovatele, a vid\u00edme standardn\u00ed chybu prohl\u00ed\u017ee\u010de, jako by byl web vypnut\u00fd nebo prost\u011b nefungoval:<\/p>\n

\"Domenov\u00e9<\/p>\n

Te\u010f zapneme mechanismus eSNI v prohl\u00ed\u017ee\u010di, jak je uvedeno v n\u00e1vodu pro Firefox <\/a>:
\nK tomu otev\u0159eme str\u00e1nku nastaven\u00ed Firefoxu about:config<\/b> a aktivujeme n\u00e1sleduj\u00edc\u00ed nastaven\u00ed:<\/p>\n

network.trr.mode = 2;\nnetwork.trr.uri = https:\/\/mozilla.cloudflare-dns.com\/dns-query\nnetwork.security.esni.enabled = true\n<\/code><\/pre>\n
Pot\u00e9 zkontrolujeme spr\u00e1vnost nastaven\u00ed na webu Cloudflare podle odkazu<\/a> a zkus\u00edme trik s na\u0161\u00edm torrent trackerem je\u0161t\u011b jednou.<\/p>\n
\"Domenov\u00e9<\/p>\n
Voila. N\u00e1\u0161 obl\u00edben\u00fd tracker se otev\u0159el, bez jak\u00fdchkoliv VPN a proxy server\u016f. Te\u010f se pod\u00edvejme na dump provozu ve Wiresharku, co se vlastn\u011b stalo.<\/p>\n
\"Domenov\u00e9<\/p>\n
Tentokr\u00e1t paket ssl client hello neobsahuje jasn\u011b uvedenou dom\u00e9nu ur\u010den\u00ed, m\u00edsto toho se v r\u00e1mci paketu objevilo nov\u00e9 pole \u2014 encrypted_server_name \u2014 pr\u00e1v\u011b tam je obsa\u017eena hodnota rutracker.nl a de\u0161ifrovat toto pole m\u016f\u017ee pouze front-end server Cloudflare. A jeliko\u017e je tomu tak, poskytovateli DPI nez\u016fst\u00e1v\u00e1 nic jin\u00e9ho, ne\u017e si um\u00fdt ruce a povolit takov\u00fd provoz. A jin\u00e1 \u0159e\u0161en\u00ed s \u0161ifrov\u00e1n\u00edm nejsou.<\/p>\n
Tak\u017ee, jak technologie funguje v prohl\u00ed\u017ee\u010di \u2014 to jsme prozkoumali. Nyn\u00ed se pokus\u00edme pou\u017e\u00edt ji pro specifick\u00e9 a zaj\u00edmav\u011bj\u0161\u00ed v\u011bci. A jako prvn\u00ed nau\u010d\u00edme stejn\u00fd curl pou\u017e\u00edvat eSNI pro pr\u00e1ci s TLS 1.3, a z\u00e1rove\u0148 se pod\u00edv\u00e1me, jak funguje samotn\u00e9 domain fronting na z\u00e1klad\u011b eSNI.<\/p>\n
Domain fronting s eSNI<\/h3>\n
Vzhledem k tomu, \u017ee curl pro p\u0159ipojen\u00ed protokolem https pou\u017e\u00edv\u00e1 standardn\u00ed knihovnu openssl, mus\u00edme nejprve zajistit podporu eSNI pr\u00e1v\u011b tam. V master v\u011btv\u00edch openssl podpora eSNI zat\u00edm nen\u00ed, tak\u017ee si mus\u00edme st\u00e1hnout speci\u00e1ln\u00ed v\u011btev openssl, zkompilovat ji a nainstalovat.<\/p>\n
Klonujeme repozit\u00e1\u0159 z githubu a kompilujeme jako obvykle:<\/p>\n
$ git clone https:\/\/github.com\/sftcd\/openssl\n$ cd openssl\n$ .\/config\n\n$ make\n$ cd esnistuff\n$ make\n<\/code><\/pre>\n
D\u00e1le \u2013 klonujeme repozit\u00e1\u0159 s curl a konfigurujeme jeho kompilaci s pou\u017eit\u00edm na\u0161\u00ed zkompilovan\u00e9 openssl knihovny:<\/p>\n
$ cd $HOME\/code\n$ git clone https:\/\/github.com\/niallor\/curl.git curl-esni\n$ cd curl-esni\n\n$ export LD_LIBRARY_PATH=\/opt\/openssl\n$ .\/buildconf\n$ LDFLAGS=\"-L\/opt\/openssl\" .\/configure --with-ssl=\/opt\/openssl --enable-esni --enable-debug\n<\/code><\/pre>\n
Tady je d\u016fle\u017eit\u00e9 spr\u00e1vn\u011b uv\u00e9st v\u0161echny adres\u00e1\u0159e, kde se nach\u00e1z\u00ed openssl (v na\u0161em p\u0159\u00edpad\u011b je to \/opt\/openssl\/) a zajistit, aby proces konfigurace prob\u011bhl bez chyb.<\/p>\n
V p\u0159\u00edpad\u011b \u00fasp\u011b\u0161n\u00e9 konfigurace uvid\u00edme \u0159\u00e1dek:<\/p>\n
WARNING: esni ESNI enabled but marked EXPERIMENTAL. Use with caution!<\/b><\/p>\n
$ make<\/code><\/pre>\n
Po \u00fasp\u011b\u0161n\u00e9m sestaven\u00ed bal\u00ed\u010dku pou\u017eijeme speci\u00e1ln\u00ed bash soubor z bal\u00edku openssl pro nastaven\u00ed a spu\u0161t\u011bn\u00ed curl. Zkop\u00edrujeme jej do adres\u00e1\u0159e s curl pro pohodl\u00ed:<\/p>\n
cp \/opt\/openssl\/esnistuff\/curl-esni <\/code><\/pre>\n
a provedeme testovac\u00ed https po\u017eadavek na server cloudflare, z\u00e1rove\u0148 zaznamen\u00e1me DNS a TLS pakety ve Wireshark.<\/p>\n
$ ESNI_COVER=\"www.hello-rkn.ru\" .\/curl-esni https:\/\/cloudflare.com\/<\/code><\/pre>\n
Ve odpov\u011bdi serveru krom\u011b spousty lad\u00edc\u00edch informac\u00ed od openssl a curl obdr\u017e\u00edme HTTP odpov\u011b\u010f s k\u00f3dem 301 od cloudflare.<\/p>\n
HTTP\/1.1 301 Moved Permanently\n< Date: Sun, 03 Nov 2019 13:12:55 GMT\n< Transfer-Encoding: chunked\n< Connection: keep-alive\n< Cache-Control: max-age=3600\n< Expires: Sun, 03 Nov 2019 14:12:55 GMT\n< Location: https:\/\/www.cloudflare.com\/\n<\/code><\/pre>\n
co\u017e sv\u011bd\u010d\u00ed o tom, \u017ee n\u00e1\u0161 po\u017eadavek byl \u00fasp\u011b\u0161n\u011b doru\u010den na c\u00edlov\u00fd server, sly\u0161en a zpracov\u00e1n.<\/p>\n
Nyn\u00ed se pod\u00edv\u00e1me na dump provozu ve Wiresharku, tj. co v tomto p\u0159\u00edpad\u011b vid\u011bl poskytovatel DPI.<\/p>\n
\"Domenov\u00e9<\/p>\n
Je jasn\u00e9, \u017ee se curl nejprve obr\u00e1til na DNS server pro ve\u0159ejn\u00e9 eSNI kl\u00ed\u010de pro server cloudflare \u2013 TXT DNS dotaz na _esni.cloudflare.com (paket \u010d. 13). Pot\u00e9, s vyu\u017eit\u00edm knihovny openssl, curl odeslal TLS 1.3 dotaz na server cloudflare, ve kter\u00e9m bylo pole SNI za\u0161ifrov\u00e1no ve\u0159ejn\u00fdm kl\u00ed\u010dem z\u00edskan\u00fdm v p\u0159edchoz\u00edm kroku (paket \u010d. 22). Ale krom\u011b pole eSNI byl do SSL-hello paketu vlo\u017een tak\u00e9 obvykl\u00fd \u2013 otev\u0159en\u00fd SNI, kter\u00fd m\u016f\u017eeme uv\u00e9st v libovoln\u00e9m po\u0159ad\u00ed (v tomto p\u0159\u00edpad\u011b \u2013 www.hello-rkn.ru<\/a>). <\/b><\/p>\n
Toto pole otev\u0159en\u00e9ho SNI nebylo p\u0159i zpracov\u00e1n\u00ed servery cloudflare nijak zohledn\u011bno a slou\u017eilo pouze jako maskovac\u00ed prvek pro poskytovatelsk\u00e9 DPI. Server cloudflare p\u0159ijal n\u00e1\u0161 ssl-hello paket, de\u0161ifroval eSNI, extrahoval z n\u011bj p\u016fvodn\u00ed SNI a zpracoval ho, jako by se nic nestalo (ud\u011blal to p\u0159esn\u011b tak, jak bylo pl\u00e1nov\u00e1no p\u0159i v\u00fdvoji eSNI).<\/p>\n
Jedin\u00e9, \u010deho se v tomto p\u0159\u00edpad\u011b m\u016f\u017ee DPI chytit, je prim\u00e1rn\u00ed DNS dotaz na _esni.cloudflare.com. Ale my jsme ud\u011blali DNS dotaz otev\u0159en\u00fdm pouze proto, abychom uk\u00e1zali, jak tento mechanismus funguje z vnit\u0159n\u00ed perspektivy.<\/p>\n
Abychom definitivn\u011b podkopali p\u016fdu pod nohama DPI, pou\u017e\u00edv\u00e1me ji\u017e zm\u00edn\u011bn\u00fd mechanismus DNS-over-HTTPS. Kr\u00e1tk\u00e9 vysv\u011btlen\u00ed \u2013 DOH \u2013 protokol, kter\u00fd umo\u017e\u0148uje chr\u00e1nit se p\u0159ed \u00fatoky \u201e\u010dlov\u011bk uprost\u0159ed\u201c d\u00edky zas\u00edl\u00e1n\u00ed DNS dotaz\u016f prost\u0159ednictv\u00edm protokolu HTTPS.<\/p>\n
Dotaz provedeme znovu, ale tentokr\u00e1t ve\u0159ejn\u00e9 eSNI kl\u00ed\u010de z\u00edsk\u00e1me prost\u0159ednictv\u00edm protokolu https, nikoli DNS:<\/p>\n
ESNI_COVER=\"www.hello-rkn.ru\" DOH_URL=https:\/\/mozilla.cloudflare-dns.com\/dns-query .\/curl-esni https:\/\/cloudflare.com\/<\/code><\/pre>\n
Dump provozu dotazu je uveden na screenshotu n\u00ed\u017ee:<\/p>\n
\"Domenov\u00e9<\/p>\n
Jak je vid\u011bt, nejprve se curl obrac\u00ed na server mozilla.cloudflare-dns.com prost\u0159ednictv\u00edm protokolu DoH (https spojen\u00ed na server 104.16.249.249), aby od nich z\u00edskal hodnoty ve\u0159ejn\u00fdch kl\u00ed\u010d\u016f pro \u0161ifrov\u00e1n\u00ed SNI, a teprve pot\u00e9 se obr\u00e1til na c\u00edlov\u00fd server, p\u0159i\u010dem\u017e se skr\u00fdval za dom\u00e9nou. www.hello-rkn.ru<\/a>.<\/p>\n
Krom\u011b v\u00fd\u0161e uveden\u00e9ho DoH resolveru mozilla.cloudflare-dns.com m\u016f\u017eeme vyu\u017e\u00edt i dal\u0161\u00ed popul\u00e1rn\u00ed slu\u017eby DoH, nap\u0159\u00edklad od slavn\u00e9 \u201ezl\u00e9\u201c korporace.
\nProvedeme takov\u00fd dotaz:<\/p>\n
ESNI_COVER=\"www.kremlin.ru\" DOH_URL=https:\/\/dns.google\/dns-query .\/curl-esni https:\/\/rutracker.nl\/<\/code><\/pre>\n
A dostaneme odpov\u011b\u010f:<\/p>\n
< HTTP\/1.1 301 Moved Permanently\n<Date: Sun, 03 Nov 2019 14:10:22 GMT\n<Content-Type: text\/html\n<Transfer-Encoding: chunked\n<Connection: keep-alive\n<Set-Cookie: __cfduid=da0144d982437e77b0b37af7d00438b1a1572790222; expires=Mon, 02-Nov-20 14:10:22 GMT; path=\/; domain=.rutracker.nl; HttpOnly; Secure\n<Location: https:\/\/rutracker.nl\/forum\/index.php\n<CF-Cache-Status: DYNAMIC\n<Expect-CT: max-age=604800, report-uri="https:\/\/report-uri.cloudflare.com\/cdn-cgi\/beacon\/expect-ct"\n<Server: cloudflare\n<CF-RAY: 52feee696f42d891-CPH\n<\/code><\/pre>\n
\"Domenov\u00e9<\/p>\n
V tomto p\u0159\u00edpad\u011b jsme se obr\u00e1tili na zablokovan\u00fd server rutracker.nl, p\u0159i\u010dem\u017e jsme pou\u017eili DoH resolver dns.google (nen\u00ed zde chyba, nyn\u00ed m\u00e1 slavn\u00e1 korporace svou dom\u00e9nu nejvy\u0161\u0161\u00ed \u00farovn\u011b) a schovali se za jinou dom\u00e9nou, jej\u00ed\u017e blokace je v\u0161emi DPI striktn\u011b zak\u00e1z\u00e1na pod hrozbou p\u0159\u00edsn\u00fdch trest\u016f. Z obdr\u017een\u00e9 odpov\u011bdi lze pochopit, \u017ee n\u00e1\u0161 po\u017eadavek byl \u00fasp\u011b\u0161n\u011b zpracov\u00e1n.<\/p>\n
Jako dodate\u010dnou kontrolu toho, \u017ee providern\u00ed DPI reaguje na otev\u0159en\u00fd SNI, kter\u00fd poskytujeme jako kryt\u00ed \u2014 m\u016f\u017eeme prov\u00e9st po\u017eadavek na rutracker.nl tak, \u017ee se schov\u00e1me za n\u011bjak\u00fd jin\u00fd zak\u00e1zan\u00fd zdroj, nap\u0159\u00edklad dal\u0161\u00ed 'dobr\u00fd' torrent tracker:<\/p>\n
$ ESNI_COVER=\"rutor.info\" DOH_URL=https:\/\/dns.google\/dns-query .\/curl-esni https:\/\/rutracker.nl\/<\/code><\/pre>\n
Odpov\u011b\u010f od serveru nedostaneme, proto\u017ee n\u00e1\u0161 po\u017eadavek bude zablokov\u00e1n syst\u00e9mem DPI.<\/p>\n
Mal\u00e9 z\u00e1v\u011bre\u010dn\u00e9 slovo k prvn\u00ed \u010d\u00e1sti<\/h3>\n
Tak\u017ee se n\u00e1m poda\u0159ilo uk\u00e1zat funk\u010dnost eSNI pomoc\u00ed openssl a curl a ov\u011b\u0159it funkci dom\u00e9nov\u00e9ho frontingu zalo\u017een\u00e9ho na eSNI. Stejn\u00fdm zp\u016fsobem m\u016f\u017eeme p\u0159izp\u016fsobit na\u0161e obl\u00edben\u00e9 n\u00e1stroje vyu\u017e\u00edvaj\u00edc\u00ed knihovnu openssl pro pr\u00e1ci 'pod kryt\u00edm' jin\u00fdch dom\u00e9n. V\u00edce o tom v na\u0161ich dal\u0161\u00edch \u010dl\u00e1nc\u00edch.<\/p>\n
Zdroj: habr.com<\/a><\/p>","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"excerpt":{"rendered":"
\u0412\u0432\u0435\u0434\u0435\u043d\u0438\u0435 \u0421\u043e\u0432\u0440\u0435\u043c\u0435\u043d\u043d\u044b\u0435 \u043a\u043e\u0440\u043f\u043e\u0440\u0430\u0442\u0438\u0432\u043d\u044b\u0435 \u0441\u0438\u0441\u0442\u0435\u043c\u044b \u0444\u0438\u043b\u044c\u0442\u0440\u0430\u0446\u0438\u0438 \u043a\u043e\u043d\u0442\u0435\u043d\u0442\u0430, \u043e\u0442 \u0442\u0430\u043a\u0438\u0445 \u0438\u043c\u0435\u043d\u0438\u0442\u044b\u0445 \u043f\u0440\u043e\u0438\u0437\u0432\u043e\u0434\u0438\u0442\u0435\u043b\u0435\u0439 \u043a\u0430\u043a Cisco, BlueCoat, FireEye \u0438\u043c\u0435\u044e\u0442 \u0434\u043e\u0432\u043e\u043b\u044c\u043d\u043e \u043c\u043d\u043e\u0433\u043e \u043e\u0431\u0449\u0435\u0433\u043e \u0441 \u0431\u043e\u043b\u0435\u0435 \u043c\u043e\u0449\u043d\u044b\u043c\u0438 \u0438\u0445 \u0441\u043e\u0431\u0440\u0430\u0442\u044c\u044f\u043c\u0438 \u2014 DPI \u0441\u0438\u0441\u0442\u0435\u043c\u0430\u043c\u0438, \u043a\u043e\u0442\u043e\u0440\u044b\u0435 \u0443\u0441\u0438\u043b\u0435\u043d\u043d\u043e \u0432\u043d\u0435\u0434\u0440\u044f\u044e\u0442\u0441\u044f \u043d\u0430 \u043d\u0430\u0446\u0438\u043e\u043d\u0430\u043b\u044c\u043d\u043e\u043c \u0443\u0440\u043e\u0432\u043d\u0435. \u0421\u0443\u0442\u044c \u0440\u0430\u0431\u043e\u0442\u044b \u0438 \u0442\u0435\u0445 \u0438 \u0434\u0440\u0443\u0433\u0438\u0445 \u0432 \u0442\u043e\u043c, \u0447\u0442\u043e\u0431\u044b \u043f\u0440\u043e\u0438\u0437\u0432\u043e\u0434\u0438\u0442\u044c \u0434\u043e\u0441\u043c\u043e\u0442\u0440 \u0432\u0445\u043e\u0434\u044f\u0449\u0435\u0433\u043e \u0438 \u0438\u0441\u0445\u043e\u0434\u044f\u0449\u0435\u0433\u043e \u0438\u043d\u0442\u0435\u0440\u043d\u0435\u0442 \u0442\u0440\u0430\u0444\u0438\u043a\u0430 \u0438, \u043d\u0430 \u043e\u0441\u043d\u043e\u0432\u0430\u043d\u0438\u0438 \u0447\u0435\u0440\u043d\u044b\u0445\/\u0431\u0435\u043b\u044b\u0445 \u0441\u043f\u0438\u0441\u043a\u043e\u0432, \u043f\u0440\u0438\u043d\u0438\u043c\u0430\u0442\u044c \u0440\u0435\u0448\u0435\u043d\u0438\u0435 […]<\/p>\n","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"author":1,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[688],"tags":[],"class_list":["post-52639","post","type-post","status-publish","format-standard","hentry","category-administrirovanie"],"aioseo_notices":[],"aioseo_head":"\n\t\t\n\t\n\t\n\t\n\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\n","aioseo_head_json":{"title":"\ud83e\udd47Dom\u00e9nov\u00fd fronting zalo\u017een\u00fd na TLS 1.3 | ProHoster","description":"\u00davod Modern\u00ed korpor\u00e1tn\u00ed filtra\u010dn\u00ed syst\u00e9my.","canonical_url":"https:\/\/prohoster.info\/cs\/blog\/administrirovanie\/domen-fronting-na-baze-tls-1-3","robots":"max-image-preview:large","keywords":"","webmasterTools":{"miscellaneous":""},"schema":null,"og:locale":"cs_CZ","og:site_name":"ProHoster | \u041a\u0443\u043f\u0438\u0442\u044c \u043d\u0430\u0434\u0435\u0436\u043d\u044b\u0439 \u0445\u043e\u0441\u0442\u0438\u043d\u0433 \u0434\u043b\u044f \u0441\u0430\u0439\u0442\u043e\u0432 \u0441 \u0437\u0430\u0449\u0438\u0442\u043e\u0439 \u043e\u0442 DDoS, VPS VDS \u0441\u0435\u0440\u0432\u0435\u0440\u044b","og:type":"article","og:title":"\ud83e\udd47\u0414\u043e\u043c\u0435\u043d-\u0444\u0440\u043e\u043d\u0442\u0438\u043d\u0433 \u043d\u0430 \u0431\u0430\u0437\u0435 TLS 1.3 | ProHoster","og:description":"\u0412\u0432\u0435\u0434\u0435\u043d\u0438\u0435 \u0421\u043e\u0432\u0440\u0435\u043c\u0435\u043d\u043d\u044b\u0435 \u043a\u043e\u0440\u043f\u043e\u0440\u0430\u0442\u0438\u0432\u043d\u044b\u0435 \u0441\u0438\u0441\u0442\u0435\u043c\u044b \u0444\u0438\u043b\u044c\u0442\u0440\u0430\u0446\u0438\u0438.","og:url":"https:\/\/prohoster.info\/cs\/blog\/administrirovanie\/domen-fronting-na-baze-tls-1-3","og:image":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:secure_url":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:width":350,"og:image:height":350,"article:published_time":"2019-11-12T21:00:00+00:00","article:modified_time":"2026-05-20T17:54:20+00:00","article:publisher":"https:\/\/www.facebook.com\/prohoster","article:author":"https:\/\/www.facebook.com\/prohoster"},"aioseo_meta_data":{"post_id":"52639","title":null,"description":null,"keywords":null,"keyphrases":null,"primary_term":null,"canonical_url":null,"og_title":null,"og_description":null,"og_object_type":"default","og_image_type":"default","og_image_url":null,"og_image_width":null,"og_image_height":null,"og_image_custom_url":null,"og_image_custom_fields":null,"og_video":null,"og_custom_url":null,"og_article_section":null,"og_article_tags":null,"twitter_use_og":false,"twitter_card":"default","twitter_image_type":"default","twitter_image_url":null,"twitter_image_custom_url":null,"twitter_image_custom_fields":null,"twitter_title":null,"twitter_description":null,"schema":{"blockGraphs":[],"customGraphs":[],"default":{"data":{"Article":[],"Course":[],"Dataset":[],"FAQPage":[],"Movie":[],"Person":[],"Product":[],"ProductReview":[],"Car":[],"Recipe":[],"Service":[],"SoftwareApplication":[],"WebPage":[]},"graphName":"","isEnabled":true},"graphs":[]},"schema_type":null,"schema_type_options":null,"pillar_content":false,"robots_default":true,"robots_noindex":false,"robots_noarchive":false,"robots_nosnippet":false,"robots_nofollow":false,"robots_noimageindex":false,"robots_noodp":false,"robots_notranslate":false,"robots_max_snippet":null,"robots_max_videopreview":null,"robots_max_imagepreview":"large","priority":null,"frequency":null,"local_seo":null,"seo_analyzer_scan_date":"2026-01-24 04:19:19","breadcrumb_settings":null,"limit_modified_date":false,"reviewed_by":null,"ai":null,"created":"2021-02-28 20:39:27","updated":"2026-01-24 04:19:19","focus_keyword":null,"additional_keywords":null,"truseo_locale":null},"gt_translate_keys":[{"key":"link","format":"url"}],"_links":{"self":[{"href":"https:\/\/prohoster.info\/cs\/wp-json\/wp\/v2\/posts\/52639","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/prohoster.info\/cs\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/prohoster.info\/cs\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/prohoster.info\/cs\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/prohoster.info\/cs\/wp-json\/wp\/v2\/comments?post=52639"}],"version-history":[{"count":3,"href":"https:\/\/prohoster.info\/cs\/wp-json\/wp\/v2\/posts\/52639\/revisions"}],"predecessor-version":[{"id":173323,"href":"https:\/\/prohoster.info\/cs\/wp-json\/wp\/v2\/posts\/52639\/revisions\/173323"}],"wp:attachment":[{"href":"https:\/\/prohoster.info\/cs\/wp-json\/wp\/v2\/media?parent=52639"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/prohoster.info\/cs\/wp-json\/wp\/v2\/categories?post=52639"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/prohoster.info\/cs\/wp-json\/wp\/v2\/tags?post=52639"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}