{"id":35939,"date":"2019-10-31T22:07:41","date_gmt":"2019-10-31T19:07:41","guid":{"rendered":"https:\/\/prohoster.info\/blog\/kak-my-probivali-velikij-kitajskij-faervol-ch-1\/"},"modified":"2019-10-31T22:07:41","modified_gmt":"2019-10-31T19:07:41","slug":"kak-my-probivali-velikij-kitajskij-faervol-ch-1","status":"publish","type":"post","link":"https:\/\/prohoster.info\/et\/blog\/administrirovanie\/kak-my-probivali-velikij-kitajskij-faervol-ch-1","title":{"rendered":"Kuidas me murdsime Suure Hiina Tulle (osa 1)","gt_translate_keys":[{"key":"rendered","format":"text"}]},"content":{"rendered":"<p>Tere k\u00f5igile!<\/p>\n<p><\/p>\n<p>Tere, mina olen Nikita - s\u00fcsteemiinsener ettev\u00f5ttest <strong>SEMrush<\/strong>. T\u00e4na r\u00e4\u00e4gin teile, kuidas seisis meie ees \u00fclesanne tagada meie teenuse semrush.com stabiilne t\u00f6\u00f6 Hiinas ja milliseid probleeme me selle t\u00e4itmise k\u00e4igus kohtasime (arvestades meie andmekeskuse asukohta Ameerika \u00dchendriikide idaosas).<\/p>\n<p><\/p>\n<p>See saab olema suur lugu, jagatud mitmeks artikliks. R\u00e4\u00e4gin, kuidas meil k\u00f5igil see oli: t\u00e4iesti mittetoimiv teenus Hiinas, kuni teenuse t\u00f6\u00f6 n\u00e4itajate tasemeni, mis vastab Ameerika versioonile Ameerika kasutajatele. Luban, et see on huvitav ja kasulik. Nii et l\u00e4heme.<\/p>\n<p><\/p>\n<h2 id=\"problemy-kitayskogo-interneta\">Hiina interneti probleemid<\/h2>\n<p><\/p>\n<p>Isegi k\u00f5ige kauge eemal olev inimene v\u00f5rguadministratsiooni spetsiifikast on v\u00e4hemalt korra kuulnud <strong>Suurest Hiina tulem\u00fc\u00fcrist<\/strong>. Ooh, k\u00f5lab lahedalt, eks? Aga mis see on, kuidas see tegelikult t\u00f6\u00f6tab - see on \u00fcsna keeruline k\u00fcsimus. Internetis leiab palju artikleid, mis on sellele p\u00fchendatud, kuid tehnilisest vaatenurgast pole selle tulem\u00fc\u00fcri \u00fclesehitust kusagil detailselt kirjeldatud. Mis pole \u00fcllatav. Pean tunnistama, et p\u00e4rast aasta t\u00f6\u00f6d ma ei suuda t\u00e4pselt \u00f6elda, kuidas see t\u00f6\u00f6tab, aga saan r\u00e4\u00e4kida oma t\u00e4helepanekutest ja praktilistest j\u00e4reldustest. Ja alustame kuulujuttudest selle tulem\u00fc\u00fcri kohta.<\/p>\n<p><noindex><a rel=\"nofollow\" name=\"habracut\"><\/a><\/noindex><\/p>\n<p>Selle tulem\u00fc\u00fcri kohta on palju kuulujutte. Kogume m\u00f5ned peamised ja huvitavamad neist \u00fchte nimekirja:<\/p>\n<p><\/p>\n<ul>\n<li>Google, Facebook, Twitter ja muud sarnased teenused on blokeeritud ja ei t\u00f6\u00f6ta Hiinas.<\/li>\n<li>Iga liiklus, mis liigub Hiina piiridest V\u00c4LJA ja SISEPOOLE, anal\u00fc\u00fcsitakse ja piiratakse masin\u00f5ppe abil (kahtlase liikluse korral), mis aeglustab seda tugevalt (liiklus), mis \u00fcletab piiri.<\/li>\n<li>Hiina eriteenistused v\u00f5ivad h\u00e4kkida iga kr\u00fcpteeritud liiklust, mis l\u00e4bib nende tulem\u00fc\u00fcri.<\/li>\n<li>VPN-tunnelid, IPSEC-tunnelid on ebastabiilsed, kukuvad alla ja blokeeritakse pidevalt.<\/li>\n<li>Mida lihtsam on kr\u00fcptimine, seda lihtsam on passifrase, mida kasutatakse liikluse autentimiseks\/kr\u00fcptimiseks, seda kiiremini see Hiina tulem\u00fc\u00fcri kaudu l\u00e4bib.<\/li>\n<\/ul>\n<p><\/p>\n<p>Siin on, mida me nende kuulujuttude kohta teada saime:<\/p>\n<p><\/p>\n<ul>\n<li>Google, Facebook, Twitter ja muud sarnased teenused on t\u00f5epoolest blokeeritud (teie KO), kuid paljud tehnilised domeenid Google'ilt, n\u00e4iteks, ei ole blokeeritud ja t\u00f6\u00f6tavad (sama gstatic.com). Seega j\u00e4reldus: ei tasu m\u00f5tlematult k\u00f5rvaldada k\u00f5iki Google'i ja teisi, tundlikena n\u00e4ivate blokeeritud ressursse.<\/li>\n<li>Iga liiklus, mis \u00fcletab piiri, t\u00f5esti lisab oma ajale m\u00e4rkimisv\u00e4\u00e4rse viivituse. Vaadake kahte tulemust. \u00dcks sait, \u00fcks leht, lihtne GET <em>curl<\/em>\u2019om. Esimene m\u00f5\u00f5tmine otse Hiinast (ilus linn Shenzhen). Teine m\u00f5\u00f5tmine v\u00e4ljastpoolt Hongkongist (millel on suver\u00e4\u00e4nsus ja millel ei ole tulem\u00fc\u00fcri maailma suunas). Linnadevaheline kaugus on sirgjoones umbes 30-40 km.<\/li>\n<\/ul>\n<p><\/p>\n<pre><code class=\"bash\">nikita@china-shenzhen:~# curl -o \/dev\/null -w@curl_time \"https:\/\/www.semrush.com\/info\/ebay.com\"\n  % Total    % Received % Xferd  Average Speed   Time    Time     Time  Current\n                                 Dload  Upload   Total   Spent    Left  Speed\n100  381k    0  381k    0     0  71824      0 --:--:--  0:00:05 --:--:-- 82832\ntime_namelookup:  0.004500\ntime_connect:  0.169342\ntime_appconnect:  0.723189\ntime_pretransfer:  0.723499\ntime_redirect:  0.000000\ntime_starttransfer:  1.532912\n----------\ntime_total:  5.443407\n----------\nsize_download:  390968 Bytes\nspeed_download:  71824.000B\/s\n\nnikita@china-hongkong:~# curl -o \/dev\/null -w@curl_time \"https:\/\/www.semrush.com\/info\/ebay.com\"\n  % Total    % Received % Xferd  Average Speed   Time    Time     Time  Current\n                                 Dload  Upload   Total   Spent    Left  Speed\n100  319k    0  319k    0     0  2555k      0 --:--:-- --:--:-- --:--:-- 2573k\ntime_namelookup:  0.029366\ntime_connect:  0.030742\ntime_appconnect:  0.047310\ntime_pretransfer:  0.047388\ntime_redirect:  0.000000\ntime_starttransfer:  0.120793\n----------\ntime_total:  0.124871\n----------\nsize_download:  326755 Bytes\nspeed_download:  2616740.000B\/s<\/code><\/pre>\n<p><\/p>\n<p>Pange t\u00e4hele <strong>time_connect<\/strong>. Ja kokkuv\u00f5ttes n\u00e4ete tulemust: tulem\u00fc\u00fcr lisab 4 t\u00e4iendavat sekundit, mis on kohutavalt pikk aeg.<\/p>\n<p><\/p>\n<ul>\n<li>VPN ja IPSEC tunneli\u00fchendused t\u00f5esti tihti katkevad. Sellest r\u00e4\u00e4gin veidi hiljem ja p\u00f5hjalikumalt. VPN-serverid, mida kasutajad kasutavad, blokeeritakse aja jooksul (tavaliselt \u00fche p\u00e4eva jooksul p\u00e4rast kasutamist). <\/li>\n<li>On arvamus, mis on saadud Hiinas elavatelt inimestelt, et mida lihtsam on liikluse kr\u00fcptimine, seda kiiremini see piiri \u00fcletab, kuna on lihtne m\u00f5ista, et selles pole midagi ebaseaduslikku. Samuti \u201epuhtam\u201c liiklus saab rohkem ribalaiust ja kiiruset v\u00f5rreldes \u201emustaga\u201c liiklusega, mille sisu on raskesti m\u00f5istetav, mis omakorda venitab l\u00e4bip\u00e4\u00e4su. N\u00e4iteks toon curl-i <em>ifconfig.co<\/em> protokollide HTTPS ja HTTP kaudu. <\/li>\n<\/ul>\n<p><\/p>\n<pre><code class=\"bash\">curl -o \/dev\/null -w@curl_time \"https:\/\/ifconfig.co\/\"\n  % Total    % Received % Xferd  Average Speed   Time    Time     Time  Current\n                                 Dload  Upload   Total   Spent    Left  Speed\n100    13  100    13    0     0      2      0  0:00:06  0:00:05  0:00:01     3\ntime_namelookup:  0.004305\ntime_connect:  0.397465\ntime_appconnect:  5.149305\ntime_pretransfer:  5.149393\ntime_redirect:  0.000000\ntime_starttransfer:  5.568847\n----------\ntime_total:  5.568893\n----------\nsize_download:  13 Bytes\nspeed_download:  2.000B\/s\n\ncurl -o \/dev\/null -w@curl_time \"http:\/\/ifconfig.co\/\"\n  % Total    % Received % Xferd  Average Speed   Time    Time     Time  Current\n                                 Dload  Upload   Total   Spent    Left  Speed\n100    13  100    13    0     0     28      0 --:--:-- --:--:-- --:--:--    28\ntime_namelookup:  0.004282\ntime_connect:  0.212457\ntime_appconnect:  0.000000\ntime_pretransfer:  0.212484\ntime_redirect:  0.000000\ntime_starttransfer:  0.450565\n----------\ntime_total:  0.450620\n----------\nsize_download:  13 Bytes\nspeed_download:  28.000B\/s<\/code><\/pre>\n<p><\/p>\n<p>13 baiti allalaadimise \u00fcldine aja erinevus on 5 sekundit. Korduvalt selliseid teste tehes v\u00f5ib m\u00e4rkida, et GET HTTP kaudu l\u00f5peb enamasti sama aja jooksul, samas kui HTTPS kaudu vastab sait m\u00f5nikord 3, 5, 10 ja isegi 17 sekundi p\u00e4rast. M\u00f5nikord esinevad SSL-i vead:<\/p>\n<p><\/p>\n<p><code>Tundmatu SSL-protokolli viga \u00fchenduses ifconfig.co:443.<\/code><\/p>\n<p><\/p>\n<p>Nii, mida me siis omame:<\/p>\n<p><\/p>\n<ul>\n<li>Eelnevalt kirjeldatud probleemid, mida tekitab Hiina tulem\u00fc\u00fcr.<\/li>\n<li>Pingid v\u00e4listele ressurssidele ja tunnelites kaovad perioodiliselt.<\/li>\n<li>Latency kahe punkti vahel muutub pidevalt ja sageli on see t\u00e4iesti ettearvamatu. Erinevate linnade\/regioonide \u00fchendamisel ootad, et geograafilise asukoha p\u00f5hjal on latentsus v\u00e4iksem, kuid saad t\u00e4pselt vastupidise tulemuse. <\/li>\n<li>Internet ja sidekanalid t\u00f6\u00f6tavad kas kiiresti v\u00f5i aeglaselt. Siin on v\u00e4ike s\u00f5ltuvus kellaajast ja n\u00e4dalap\u00e4evast, kuid mitte alati.<\/li>\n<li>DNS-p\u00e4ringud Hiinast v\u00e4lismaailma \u00fcletavad m\u00f5nikord lubatud aegumist\u00e4htaega.<\/li>\n<\/ul>\n<p><\/p>\n<p>Pilt kujuneb v\u00e4lja lihtsalt \"suurep\u00e4rane\". <\/p>\n<p><\/p>\n<p>Kuna meie andmekeskus asub USA idaosas ja kogu SEMrush koosneb k\u00fcmnetest omavahel seotud toodetest, taustadest, p\u00e4ringutest, andmebaasidest, ja k\u00f5ik see asub andmekeskustes ja pilvess\u00e4. Meie, s\u00fcsteemiadministraatorid, seadsime endale \u00fclesande miinimumvaevaga kiiresti Hiinas t\u00f6\u00f6le hakata.<\/p>\n<p><\/p>\n<p>Meil oli vaja vastata olulisele k\u00fcsimusele: kas on v\u00f5imalik v\u00e4heste j\u00f5upingutustega lahendada k\u00f5ik probleemid, mis on seotud Hiina interneti ja tulem\u00fc\u00fcriga, v\u00f5rgu\/pilvede\/serverite tasemel?<\/p>\n<p><\/p>\n<p>Alustasime <noindex><a rel=\"nofollow\" href=\"https:\/\/ru.wikipedia.org\/wiki\/%D0%9B%D0%B8%D1%86%D0%B5%D0%BD%D0%B7%D0%B8%D1%8F_ICP\"><strong>ICP<\/strong>-litsentsi<\/a><\/noindex>.<\/p>\n<p><\/p>\n<h2 id=\"icp-licenziya\">ICP-litsents<\/h2>\n<p><\/p>\n<p>Hiina (Mandri-Hiina) piirides oma teenuse majutamiseks ja testide l\u00e4biviimiseks tuleb esmalt saada ICP-litsents domeeni jaoks.<\/p>\n<p><\/p>\n<p>Kui teie saidi kasutajate liiklus l\u00f5peb Mandri-Hiinas ja teie domeenil pole ICP-litsentsi, blokeerib teie liikluse pakkuja\/hostimine. Huvitav on see, et ICP-litsentsi lisatakse konkreetne pakkuja, olenemata sellest, kas see on Cloudflare v\u00f5i Alibaba Cloud. Seet\u00f5ttu, kui olete saanud ICP-litsentsi Cloudflare'i jaoks ja majutanud oma saiti nende juures, ei saa te hiljem \"sujuvalt\" \u00fcle kolida Alibaba Cloudi. Peate lisama veel \u00fche hostimise sellele litsentsile.<\/p>\n<p><\/p>\n<p>Saades oma domeenile ICP-litsentsi, suutsime v\u00e4lja m\u00f5elda ja ellu viia konkreetsed tehnilised ideed ja lahendused.<\/p>\n<p><\/p>\n<h2 id=\"testirovanie-resheniy\">Lahenduste testimine<\/h2>\n<p><\/p>\n<p>Kuid enne, kui hakkame otse loomulikult looma stendiversioone, reguleerima seadistusi, optimeerima saidi t\u00f6\u00f6d ja kiirus, peame valima t\u00f6\u00f6riista selle testimiseks, et n\u00e4ha, millised meie tegevused parandavad v\u00f5i vastupidi halvendavad saidi t\u00f6\u00f6d.<\/p>\n<p><\/p>\n<p>Meie testimisriist peab vastama kahtele peamisele n\u00f5udele:<\/p>\n<p><\/p>\n<ul>\n<li>see peab olema v\u00f5imeline testima Hiinast,<\/li>\n<li>see peab olema brauseritestide v\u00f5imalus.<\/li>\n<\/ul>\n<p><\/p>\n<p>Nii leidsime <noindex><a rel=\"nofollow\" href=\"https:\/\/www.catchpoint.com\/\">Catchpoint<\/a><\/noindex>! Neil on suurep\u00e4rane testimispunktide katvus kogu maailmas. Hiinas saab seda t\u00f6\u00f6riista kasutades teste l\u00e4bi viia ka 100500 provintsist. Iga\u00fches on mitu erinevat pakkujat + v\u00f5imalus teha <strong>Backbone<\/strong>-teste (midagi sarnast virtuaalmasinale andmekeskuses) ja <strong>Lastmile<\/strong>-teste (maksimaalselt l\u00e4hedased kasutajatingimustele, aka t\u00f6\u00f6jaam). Viimane testit\u00fc\u00fcp on kallim.<\/p>\n<p><\/p>\n<p>Aasta lepingu s\u00f5lmimisega (odavamalt ei saa) alustasime t\u00f6\u00f6riista uurimist. Peame tunnistama, et olime meeldivalt \u00fcllatunud selle funktsionaalsusest. Saab k\u00e4ivitada:<\/p>\n<p><\/p>\n<ul>\n<li>DNS-testid,<\/li>\n<li>Veebitestid (brauseri, lihtne GET\/POST, mobiilse kliendi emulatsioon jne),<\/li>\n<li>Tehingu kontrollid (n\u00e4iteks sisselogimine),<\/li>\n<li>API-testid,<\/li>\n<li>Ping, traceroute, NTP jne.<\/li>\n<\/ul>\n<p><\/p>\n<p>Kokku on palju rohkem. Ja mis k\u00f5ige t\u00e4htsam, iga testi saab \u00fcsna h\u00e4sti kohandada, lisades hulga p\u00e4iseid ja muid parameetreid. Tulemuseks on tohutu hulk teavet, mis t\u00e4ielikult kirjeldab teie testi. Kui r\u00e4\u00e4kida k\u00f5ige huvitavamast meie jaoks (brauseritestid), siis tulemus sisaldab:<\/p>\n<p><\/p>\n<ul>\n<li>Connect, Wait, Load, SSL, DNS aeg,<\/li>\n<li>TTFB, TTLB, Dokument valmis, Renderdamise aeg, DOM-i laadimine,<\/li>\n<li>Response (midagi, mis sarnaneb Time To First Byte'ile), Veebilehe vastus (midagi, mis sarnaneb Time To Last Byte'ile),<\/li>\n<li>Igasse protsenti, Keskmine, Mediaan aeg<\/li>\n<li>jne.<\/li>\n<\/ul>\n<p><\/p>\n<p>Seega, k\u00f5ik need m\u00f5\u00f5dikud aitavad suurep\u00e4raselt j\u00e4lgida muutusi ja m\u00f5ista, kas olukord on paranenud. Me keskendusime peamiselt sellele, <strong>Response, Veebilehe reaktsioon, Mediaan, 75 ja 95 protsentiil<\/strong>. <\/p>\n<p><\/p>\n<p>Oluline k\u00fcsimus, mis on olnud \u00f5hus alates algusest: <strong>kas Catchpoint'i usaldada<\/strong>? \u041e\u0442\u0440\u0430\u0436\u0430\u0435\u0442 \u043b\u0438 \u044d\u0442\u043e\u0442 \u0438\u043d\u0441\u0442\u0440\u0443\u043c\u0435\u043d\u0442 \u0440\u0435\u0430\u043b\u044c\u043d\u0443\u044e \u0441\u043a\u043e\u0440\u043e\u0441\u0442\u044c \u0437\u0430\u0433\u0440\u0443\u0437\u043a\u0438 \u0441\u0430\u0439\u0442\u0430 \u0432 \u041a\u0438\u0442\u0430\u0435 \u0438\u0437 \u0440\u0430\u0437\u043d\u044b\u0445 \u0433\u043e\u0440\u043e\u0434\u043e\u0432 \u0438\u043b\u0438 \u0436\u0435 \u044d\u0442\u043e \u043f\u0440\u043e\u0441\u0442\u043e \u043a\u0430\u043a\u043e\u0439-\u0442\u043e \u0442\u0435\u0441\u0442 \u0432 \u0432\u0430\u043a\u0443\u0443\u043c\u0435, \u043d\u0435 \u0438\u043c\u0435\u044e\u0449\u0438\u0439 \u043d\u0438\u0447\u0435\u0433\u043e \u043e\u0431\u0449\u0435\u0433\u043e \u0441 real user experience?<br \/>\nSee on suur probleem, kuna Venemaal on praktiliselt v\u00f5imatu usaldusv\u00e4\u00e4rselt teada, kuidas veebisait Hiinast t\u00f6\u00f6tab. SOCKS-proxy kasutamine virtuaalmasinas viib selleni, et veebisaidi laadimine kestab paar minutit, mis pole testide jaoks vastuv\u00f5etav, seet\u00f5ttu j\u00e4\u00e4b ainsaks k\u00e4sitsi testimise v\u00f5imaluseks curl ja lihtsad GET-k\u00e4sklused terminalist ajam\u00f5\u00f5tmisega. See on kasulik, sest antud test peegeldab h\u00e4sti v\u00f5rgulahenduse t\u00f6\u00f6kiirus, ja kui on veel ka brauseritestid, on k\u00f5ik veelgi parem.<\/p>\n<p><\/p>\n<p>Hiljem k\u00e4isime hiinas ja veendusime, et <strong>Catchpoint'ile v\u00f5ib usaldada, see peegeldab \u00fcsna t\u00e4pselt reaalseid t\u00f6\u00f6kiirusn\u00e4itajaid.<\/strong><\/p>\n<p><\/p>\n<h2 id=\"cloudflare-china-network\">Cloudflare Hiina v\u00f5rk<\/h2>\n<p><\/p>\n<p>Kuna peamise domeeni semrush.com puhul kasutame Cloudflare'i edukalt, siis otsustasime kohe proovida nende funktsiooni nimega <noindex><a rel=\"nofollow\" href=\"https:\/\/www.cloudflare.com\/network\/china\/\">Hiina v\u00f5rk<\/a><\/noindex>. See valik aktiveeritakse ainult Enterprise-veebisaitide jaoks eraldi taotluse alusel ja eritasu eest. Samuti on see saadaval ainult veebisaitidele, millel on vastav ICP-luba, kus teenusepakkujana on m\u00e4rgitud Cloudflare. P\u00e4rast aktivatsiooni on saidile saadaval Cloudflare'i \"Hiina CDN\" \u2014 Hiina piirkondadest tulev liiklus suunatakse l\u00e4himasse CF PoP (Presence Point) ja sealt edasi edastatakse see tema v\u00f5rkude v\u00f5i teenusepakkujate\/partnerite kaudu alguspunkti. <\/p>\n<p><\/p>\n<p>Antud testseina skeem on esitatud allpool.<\/p>\n<p><\/p>\n<p>Meie jaoks on see suurep\u00e4rane variant. Tundub, et teine domeen l\u00e4heb samuti CF alla, mis ei suurenda ettev\u00f5ttes kasutatavate lahenduste arvu ja praktiliselt ei komplitseeri infrastruktuuri.<\/p>\n<p><\/p>\n<p>K\u00e4ivitame brauseritestid ja siin on tulemused:<\/p>\n<p><\/p>\n<p>Punased rombid on testide eba\u00f5nnestumised. Alumise punase rombi eba\u00f5nnestumised on DNS-i vead (resolve timeout). \u00dclemise punase rombi eba\u00f5nnestumised on ajastamise \u00fcletamised.<\/p>\n<p><\/p>\n<p><em>Ajaline t\u00f6\u00f6: 86.6<br \/>\nMediaan: 18s<br \/>\n75. protsentiil: 29.3s<br \/>\n95. protsentiil: 60s<\/em><\/p>\n<p><\/p>\n<p>Mediaan, p\u00e4rast seda kui eemaldati laadimine <em>reCaptcha<\/em> (Google'i teenus, mis on Hiinas blokeeritud), langes 28 sekundi pealt 18 sekundi peale. Aga need on siiski kohutavad n\u00e4itajad, kui arvestada, et sama test semrush.com-ile (USA-st) n\u00e4itas alla 10 sekundi 95% kasutajatele (USA-st) samal lehel (staatika + d\u00fcnaamiline).<\/p>\n<p><\/p>\n<p>Iga testisse saab sisse logida ja n\u00e4ha <em>Waterfall<\/em> ja teised \u00fcksikasjalikumad parameetrid. Me alustasime vigade p\u00f5hjuste uurimist ja kui ajav\u00f5tud on enam-v\u00e4hem arusaadavad: internet Hiinas \"siis tuleb, siis l\u00e4heb\". Seet\u00f5ttu on \u00fchenduse kiirus ja v\u00e4lisressursside laadimise kiirus ebastabiilsed ja varieeruvad, siis DNS-vigade t\u00f5ttu olime v\u00e4ga \u00fcllatunud. Me avastasime, et <em>PoP<\/em> Cloudflare'i serverid asuvad t\u00f5epoolest Hiinas, saidi aadress lahendatakse \u00fchele anycast IP-le, kuid kasutatakse Ameerika DNS-servereid, mist\u00f5ttu peavad DNS-p\u00e4ringud l\u00e4bima piiri, seet\u00f5ttu need aeg-ajalt eba\u00f5nnestuvad.<\/p>\n<p><\/p>\n<p>Selle k\u00fcsimuse t\u00e4psustamisel CF-ilt selgus, et <strong>neil ei ole oma DNS-servereid Hiinas,<\/strong>aga kuna need tulevad, pole hetkel teada.<\/p>\n<p><\/p>\n<p>Seet\u00f5ttu otsustasime testida ainult Cloudflare'i DNS-i ja muutsime Cloudflare'i t\u00f6\u00f6 mehhanismi meie saidil re\u017eiimiks \"<strong>Ainult DNS<\/strong>\". See on selline re\u017eiim, kus Cloudflare ei edasta liiklust l\u00e4bi enda, mis t\u00e4hendab, et nad ei paku DDoS-kaitset, CDN-i ja muid funktsioone ning t\u00f6\u00f6tavad tavalise DNS-serverina. <\/p>\n<p><\/p>\n<p>Antud skeem on visuaalselt esitatud j\u00e4rgmises joonises. Joonisel on arvesse v\u00f5etud teadmised, et Cloudflare DNS-serverid asuvad tulem\u00fc\u00fcri taga.<\/p>\n<p><\/p>\n<p>Catchpointis k\u00e4ivitasime lihtsad GET-testid (mitte brauserip\u00f5hised), mis n\u00e4itasid v\u00e4ga palju eba\u00f5nnestumisi. Nende p\u00f5hjuseks olid k\u00f5ik samad DNS vead.<\/p>\n<p><\/p>\n<p>Alustasime nende vigade t\u00f5rkeotsingut <em>dig<\/em> ja avastasime, et esimesel p\u00e4ringul m\u00e4\u00e4ratakse aadress \u00f5igesti, kuid korduvatel p\u00e4ringutel saame iga kord <em>SERVFAIL<\/em> ja <em>not found<\/em>. Miks see nii on?<\/p>\n<p><\/p>\n<pre><code class=\"bash\">root@iZwz97n2wgbp61qucbfrjsZ:~# host semrushchina.cn\nsemrushchina.cn has address 220.170.186.192\nHost semrushchina.cn not found: 2(SERVFAIL)\nroot@iZwz97n2wgbp61qucbfrjsZ:~# host semrushchina.cn\nsemrushchina.cn has address 220.170.186.192\nHost semrushchina.cn not found: 2(SERVFAIL)\nroot@iZwz97n2wgbp61qucbfrjsZ:~# host semrushchina.cn\nsemrushchina.cn has address 220.170.186.192\nHost semrushchina.cn not found: 2(SERVFAIL)\nroot@iZwz97n2wgbp61qucbfrjsZ:~# host semrushchina.cn\nsemrushchina.cn has address 220.170.186.192\nHost semrushchina.cn not found: 2(SERVFAIL)<\/code><\/pre>\n<p><\/p>\n<p>Kui p\u00e4rida Cloudflare'i NS-serverit otse, siis selliseid vigu ei esine:<\/p>\n<p><\/p>\n<pre><code class=\"bash\">root@iZwz97n2wgbp61qucbfrjsZ:~# for i in `seq 1 2`; do host semrushchina.cn ray.ns.cloudflare.com.; done\nUsing domain server:\nName: ray.ns.cloudflare.com.\nAddress: 173.245.59.138#53\nAliases: \n\nsemrushchina.cn has address 220.170.186.192\nsemrushchina.cn has address 220.170.186.192\nUsing domain server:\nName: ray.ns.cloudflare.com.\nAddress: 173.245.59.138#53\nAliases: \n\nsemrushchina.cn has address 220.170.186.192\nsemrushchina.cn has address 220.170.186.192<\/code><\/pre>\n<p><\/p>\n<p>See t\u00e4hendab, et probleem on \"kohaliku\" DNS-serveri v\u00f5i teenusepakkuja serveri poolel.<br \/>\nEdasiuurimine n\u00e4itas, et <em>SERVFAIL<\/em> me saame resolveerimisel <em>AAAA<\/em>-kirjed. <\/p>\n<p><\/p>\n<p>Selgus, et Cloudflare'i p\u00e4ringul <em>AAAA<\/em>-kirje, mida domeenis ei ole, Cloudflare vastas <em>A<\/em>-kirjega, mis on viga ja ei vasta RFC-le. Seet\u00f5ttu ei meeldinud see kohalikule resolverile (<em>x.x.x.x<\/em>) ja ta vastas <em>SERVFAIL<\/em>. Allolevas logis on see k\u00e4itumine selgelt n\u00e4htav:<\/p>\n<p><\/p>\n<pre><code class=\"bash\">root@iZwz97n2wgbp61qucbfrjsZ:~# dig -t AAAA semrushchina.cn @x.x.x.x\n\n; &lt;&gt; DiG 9.10.3-P4-Ubuntu &lt;&gt; -t AAAA semrushchina.cn @x.x.x.x\n;; globaalne valik: +cmd\n;; Sai vastuse:\n;; -&gt;&gt;HEADER&lt;&lt;- opcode: QUERY, status: SERVFAIL, id: 55467\n;; lipud: qr rd ra; UURING: 1, VASTUS: 0, AUTORITEET: 0, LISATAV: 1\n\n;; OPT PSEUDOSECTION:\n; EDNS: versioon: 0, lipud:; udp: 4096\n;; K\u00dcSIMISE OSAS:\n;semrushchina.cn.               IN      AAAA\n\n;; K\u00dcSIMISE AEG: 334 msec\n;; SERVER: x.x.x.x#53(x.x.x.x)\n;; AEG: Tue Aug 14 23:38:50 CST 2018\n;; MSG SUURUS  rcvd: 44\n\nroot@iZwz97n2wgbp61qucbfrjsZ:~# dig -t AAAA semrushchina.cn @dana.ns.cloudflare.com.\n\n; &lt;&gt; DiG 9.10.3-P4-Ubuntu &lt;&gt; -t AAAA semrushchina.cn @dana.ns.cloudflare.com.\n;; globaalne valik: +cmd\n;; Sai vastuse:\n;; -&gt;&gt;HEADER&lt;&lt;- opcode: QUERY, status: NOERROR, id: 63944\n;; lipud: qr aa rd; UURING: 1, VASTUS: 1, AUTORITEET: 0, LISATAV: 1\n;; HOIATUS: rekurssiooni k\u00fcsiti, kuid see ei ole saadaval\n\n;; OPT PSEUDOSECTION:\n; EDNS: versioon: 0, lipud:; udp: 512\n;; K\u00dcSIMISE OSAS:\n;semrushchina.cn.               IN      AAAA\n\n;; VASTUSE OSAS:\nsemrushchina.cn.        300     IN      A       220.170.186.192\n\n;; K\u00dcSIMISE AEG: 185 msec\n;; SERVER: 173.245.58.105#53(173.245.58.105)\n;; AEG: Tue Aug 14 23:43:03 CST 2018\n;; MSG SUURUS  rcvd: 60\n<\/code><\/pre>\n<p><\/p>\n<p>Saime Cloudflare'ile bug-aruande edasi ja nad parandasid selle m\u00f5ne aja p\u00e4rast. Okei, et hetkel ei ole Hiinas ikka veel IPv6 tuge, seega ei suutnud Cloudflare seal oma IPv6-aadressi p\u00e4ringule vastata <em>AAAA<\/em>-kirjed. L\u00f5puks lahendati asi nii, et Cloudflare hakkas Hiinas vastama <em>NODATA<\/em> sellistele p\u00e4ringutele.<\/p>\n<p><\/p>\n<p>Seega v\u00e4hendati Catchpointi testides DNS-vigu j\u00e4rsult, kuid mitte t\u00e4ielikult. Aegumise probleeme ei olnud ka kuhugi kadunud:<\/p>\n<p><\/p>\n<p>Ja me hakkasime otsima muud lahendust. <\/p>\n<p><\/p>\n<p>J\u00e4rgmises osas r\u00e4\u00e4gin, kuidas me testisime Hiina pilve <strong>Alibaba Cloud<\/strong>, \u043a\u0430\u043a \u0441 \u043f\u043e\u043c\u043e\u0449\u044c\u044e \u043d\u0435\u0431\u043e\u043b\u044c\u0448\u043e\u0439 &#171;\u043c\u0430\u0433\u0438\u0438&#187; Nginx \u043c\u044b \u0441\u043c\u043e\u0433\u043b\u0438 \u0431\u044b\u0441\u0442\u0440\u043e \u0441\u043e\u0437\u0434\u0430\u0432\u0430\u0442\u044c PoC (Proof of Concept) \u0440\u0435\u0448\u0435\u043d\u0438\u0439, \u043a\u0430\u043a \u043c\u044b \u0441\u043e\u0437\u0434\u0430\u0432\u0430\u043b\u0438 Multi-Cloud \u0440\u0435\u0448\u0435\u043d\u0438\u044f, \u043e\u0434\u043d\u043e \u0438\u0437 \u043a\u043e\u0442\u043e\u0440\u044b\u0445 \u0432 \u0438\u0442\u043e\u0433\u0435 \u043e\u0447\u0435\u043d\u044c \u0441\u0438\u043b\u044c\u043d\u043e \u043f\u043e\u043c\u043e\u0433\u043b\u043e \u0443\u0441\u043a\u043e\u0440\u0438\u0442\u044c \u0440\u0430\u0431\u043e\u0442\u0443 \u0441\u0435\u0440\u0432\u0438\u0441\u0430 \u0438\u0437 \u041a\u0438\u0442\u0430\u044f.<\/p>\n<p><\/p>\n<p><strong>J\u00e4lgige meid!<\/strong><\/p>\n<p><\/p>\n<h3 id=\"sleduyuschie-chasti\">J\u00e4rgmised osad<\/h3>\n<p><\/p>\n<p><noindex><a rel=\"nofollow\" href=\"https:\/\/habr.com\/ru\/company\/semrush\/blog\/458840\/\">Osa 2<\/a><\/noindex><\/p>\n<p>Allikas: <a content=\"nofollow\" rel=\"nofollow\" href=\"https:\/\/habr.com\/ru\/company\/semrush\/blog\/458602\/\">habr.com<\/a><\/p>","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"excerpt":{"rendered":"<p>\u0412\u0441\u0435\u043c \u043f\u0440\u0438\u0432\u0435\u0442! \u041d\u0430 \u0441\u0432\u044f\u0437\u0438 \u041d\u0438\u043a\u0438\u0442\u0430 \u2014 \u0441\u0438\u0441\u0442\u0435\u043c\u043d\u044b\u0439 \u0438\u043d\u0436\u0435\u043d\u0435\u0440 \u0438\u0437 \u043a\u043e\u043c\u043f\u0430\u043d\u0438\u0438 S\u0415Mrush. \u0421\u0435\u0433\u043e\u0434\u043d\u044f \u044f \u0440\u0430\u0441\u0441\u043a\u0430\u0436\u0443 \u0432\u0430\u043c \u043e \u0442\u043e\u043c, \u043a\u0430\u043a \u043f\u0435\u0440\u0435\u0434 \u043d\u0430\u043c\u0438 \u0432\u0441\u0442\u0430\u043b\u0430 \u0437\u0430\u0434\u0430\u0447\u0430 \u043e\u0431\u0435\u0441\u043f\u0435\u0447\u0438\u0442\u044c \u0441\u0442\u0430\u0431\u0438\u043b\u044c\u043d\u043e\u0441\u0442\u044c \u0440\u0430\u0431\u043e\u0442\u044b \u043d\u0430\u0448\u0435\u0433\u043e \u0441\u0435\u0440\u0432\u0438\u0441\u0430 semrush.com \u0432 \u041a\u0438\u0442\u0430\u0435, \u0438 \u0441 \u043a\u0430\u043a\u0438\u043c\u0438 \u043f\u0440\u043e\u0431\u043b\u0435\u043c\u0430\u043c\u0438 \u043c\u044b \u0441\u0442\u043e\u043b\u043a\u043d\u0443\u043b\u0438\u0441\u044c \u0432 \u0445\u043e\u0434\u0435 \u0435\u0435 \u0432\u044b\u043f\u043e\u043b\u043d\u0435\u043d\u0438\u044f (\u0443\u0447\u0438\u0442\u044b\u0432\u0430\u044f \u043c\u0435\u0441\u0442\u043e\u043d\u0430\u0445\u043e\u0436\u0434\u0435\u043d\u0438\u0435 \u043d\u0430\u0448\u0435\u0433\u043e \u0434\u0430\u0442\u0430-\u0446\u0435\u043d\u0442\u0440\u0430 \u043d\u0430 \u0432\u043e\u0441\u0442\u043e\u0447\u043d\u043e\u043c \u043f\u043e\u0431\u0435\u0440\u0435\u0436\u044c\u0435 \u0421\u0428\u0410). \u042d\u0442\u043e \u0431\u0443\u0434\u0435\u0442 \u0431\u043e\u043b\u044c\u0448\u0430\u044f \u0438\u0441\u0442\u043e\u0440\u0438\u044f, \u0440\u0430\u0437\u0431\u0438\u0442\u0430\u044f \u043d\u0430 \u043d\u0435\u0441\u043a\u043e\u043b\u044c\u043a\u043e [&hellip;]<\/p>\n","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"author":1,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[688],"tags":[],"class_list":["post-35939","post","type-post","status-publish","format-standard","hentry","category-administrirovanie"],"aioseo_notices":[],"aioseo_head":"\n\t\t<!-- All in One SEO 5.0.1.1 - aioseo.com -->\n\t<meta name=\"description\" content=\"\u0412\u0441\u0435\u043c \u043f\u0440\u0438\u0432\u0435\u0442! \u041d\u0430 \u0441\u0432\u044f\u0437\u0438 \u041d\u0438\u043a\u0438\u0442\u0430 \u2014 \u0441\u0438\u0441\u0442\u0435\u043c\u043d\u044b\u0439 \u0438\u043d\u0436\u0435\u043d\u0435\u0440 \u0438\u0437 \u043a\u043e\u043c\u043f\u0430\u043d\u0438\u0438 S\u0415Mrush.\" \/>\n\t<meta name=\"robots\" content=\"max-image-preview:large\" \/>\n\t<meta name=\"author\" content=\"Yuri Gagarin\"\/>\n\t<link rel=\"canonical\" href=\"https:\/\/prohoster.info\/et\/blog\/administrirovanie\/kak-my-probivali-velikij-kitajskij-faervol-ch-1\" \/>\n\t<meta name=\"generator\" content=\"All in One SEO (AIOSEO) 5.0.1.1\" \/>\n\t\t<meta property=\"og:locale\" content=\"et_EE\" \/>\n\t\t<meta property=\"og:site_name\" content=\"ProHoster | \u041a\u0443\u043f\u0438\u0442\u044c \u043d\u0430\u0434\u0435\u0436\u043d\u044b\u0439 \u0445\u043e\u0441\u0442\u0438\u043d\u0433 \u0434\u043b\u044f \u0441\u0430\u0439\u0442\u043e\u0432 \u0441 \u0437\u0430\u0449\u0438\u0442\u043e\u0439 \u043e\u0442 DDoS, VPS VDS \u0441\u0435\u0440\u0432\u0435\u0440\u044b\" \/>\n\t\t<meta property=\"og:type\" content=\"article\" \/>\n\t\t<meta property=\"og:title\" content=\"\ud83e\udd47\u041a\u0430\u043a \u043c\u044b \u043f\u0440\u043e\u0431\u0438\u0432\u0430\u043b\u0438 \u0412\u0435\u043b\u0438\u043a\u0438\u0439 \u041a\u0438\u0442\u0430\u0439\u0441\u043a\u0438\u0439 \u0424\u0430\u0435\u0440\u0432\u043e\u043b (\u0447.1) | ProHoster\" \/>\n\t\t<meta property=\"og:description\" content=\"\u0412\u0441\u0435\u043c \u043f\u0440\u0438\u0432\u0435\u0442! \u041d\u0430 \u0441\u0432\u044f\u0437\u0438 \u041d\u0438\u043a\u0438\u0442\u0430 \u2014 \u0441\u0438\u0441\u0442\u0435\u043c\u043d\u044b\u0439 \u0438\u043d\u0436\u0435\u043d\u0435\u0440 \u0438\u0437 \u043a\u043e\u043c\u043f\u0430\u043d\u0438\u0438 S\u0415Mrush.\" \/>\n\t\t<meta property=\"og:url\" content=\"https:\/\/prohoster.info\/et\/blog\/administrirovanie\/kak-my-probivali-velikij-kitajskij-faervol-ch-1\" \/>\n\t\t<meta property=\"og:image\" content=\"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg\" \/>\n\t\t<meta property=\"og:image:secure_url\" content=\"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg\" \/>\n\t\t<meta property=\"og:image:width\" content=\"350\" \/>\n\t\t<meta property=\"og:image:height\" content=\"350\" \/>\n\t\t<meta property=\"article:published_time\" content=\"2019-10-31T19:07:41+00:00\" \/>\n\t\t<meta property=\"article:modified_time\" content=\"2019-10-31T19:07:41+00:00\" \/>\n\t\t<meta property=\"article:publisher\" content=\"https:\/\/www.facebook.com\/prohoster\" \/>\n\t\t<meta property=\"article:author\" content=\"https:\/\/www.facebook.com\/prohoster\" \/>\n\t\t<!-- All in One SEO -->\n\n","aioseo_head_json":{"title":"\ud83e\udd47Kuidas me murdsime Suure Hiina tulem\u00fc\u00fcri (osa 1) | ProHoster","description":"Tere k\u00f5ik! Siin on Nikita \u2014 s\u00fcsteeminsener SEMrushist.","canonical_url":"https:\/\/prohoster.info\/et\/blog\/administrirovanie\/kak-my-probivali-velikij-kitajskij-faervol-ch-1","robots":"max-image-preview:large","keywords":"","webmasterTools":{"miscellaneous":""},"schema":null,"og:locale":"et_EE","og:site_name":"ProHoster | \u041a\u0443\u043f\u0438\u0442\u044c \u043d\u0430\u0434\u0435\u0436\u043d\u044b\u0439 \u0445\u043e\u0441\u0442\u0438\u043d\u0433 \u0434\u043b\u044f \u0441\u0430\u0439\u0442\u043e\u0432 \u0441 \u0437\u0430\u0449\u0438\u0442\u043e\u0439 \u043e\u0442 DDoS, VPS VDS \u0441\u0435\u0440\u0432\u0435\u0440\u044b","og:type":"article","og:title":"\ud83e\udd47\u041a\u0430\u043a \u043c\u044b \u043f\u0440\u043e\u0431\u0438\u0432\u0430\u043b\u0438 \u0412\u0435\u043b\u0438\u043a\u0438\u0439 \u041a\u0438\u0442\u0430\u0439\u0441\u043a\u0438\u0439 \u0424\u0430\u0435\u0440\u0432\u043e\u043b (\u0447.1) | ProHoster","og:description":"\u0412\u0441\u0435\u043c \u043f\u0440\u0438\u0432\u0435\u0442! \u041d\u0430 \u0441\u0432\u044f\u0437\u0438 \u041d\u0438\u043a\u0438\u0442\u0430 \u2014 \u0441\u0438\u0441\u0442\u0435\u043c\u043d\u044b\u0439 \u0438\u043d\u0436\u0435\u043d\u0435\u0440 \u0438\u0437 \u043a\u043e\u043c\u043f\u0430\u043d\u0438\u0438 S\u0415Mrush.","og:url":"https:\/\/prohoster.info\/et\/blog\/administrirovanie\/kak-my-probivali-velikij-kitajskij-faervol-ch-1","og:image":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:secure_url":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:width":350,"og:image:height":350,"article:published_time":"2019-10-31T19:07:41+00:00","article:modified_time":"2019-10-31T19:07:41+00:00","article:publisher":"https:\/\/www.facebook.com\/prohoster","article:author":"https:\/\/www.facebook.com\/prohoster"},"aioseo_meta_data":{"post_id":"35939","title":null,"description":null,"keywords":null,"keyphrases":null,"primary_term":null,"canonical_url":null,"og_title":null,"og_description":null,"og_object_type":"default","og_image_type":"default","og_image_url":null,"og_image_width":null,"og_image_height":null,"og_image_custom_url":null,"og_image_custom_fields":null,"og_video":null,"og_custom_url":null,"og_article_section":null,"og_article_tags":null,"twitter_use_og":false,"twitter_card":"default","twitter_image_type":"default","twitter_image_url":null,"twitter_image_custom_url":null,"twitter_image_custom_fields":null,"twitter_title":null,"twitter_description":null,"schema":{"blockGraphs":[],"customGraphs":[],"default":{"data":{"Article":[],"Course":[],"Dataset":[],"FAQPage":[],"Movie":[],"Person":[],"Product":[],"ProductReview":[],"Car":[],"Recipe":[],"Service":[],"SoftwareApplication":[],"WebPage":[]},"graphName":"","isEnabled":true},"graphs":[]},"schema_type":null,"schema_type_options":null,"pillar_content":false,"robots_default":true,"robots_noindex":false,"robots_noarchive":false,"robots_nosnippet":false,"robots_nofollow":false,"robots_noimageindex":false,"robots_noodp":false,"robots_notranslate":false,"robots_max_snippet":null,"robots_max_videopreview":null,"robots_max_imagepreview":"large","priority":null,"frequency":null,"local_seo":null,"seo_analyzer_scan_date":"2026-01-22 01:21:19","breadcrumb_settings":null,"limit_modified_date":false,"reviewed_by":null,"ai":null,"created":"2021-03-01 01:53:31","updated":"2026-01-22 01:21:19","focus_keyword":null,"additional_keywords":null,"truseo_locale":null},"gt_translate_keys":[{"key":"link","format":"url"}],"_links":{"self":[{"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/posts\/35939","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/comments?post=35939"}],"version-history":[{"count":0,"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/posts\/35939\/revisions"}],"wp:attachment":[{"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/media?parent=35939"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/categories?post=35939"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/tags?post=35939"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}