{"id":35939,"date":"2019-10-31T22:07:41","date_gmt":"2019-10-31T19:07:41","guid":{"rendered":"https:\/\/prohoster.info\/blog\/kak-my-probivali-velikij-kitajskij-faervol-ch-1\/"},"modified":"2019-10-31T22:07:41","modified_gmt":"2019-10-31T19:07:41","slug":"kak-my-probivali-velikij-kitajskij-faervol-ch-1","status":"publish","type":"post","link":"https:\/\/prohoster.info\/hr\/blog\/administrirovanie\/kak-my-probivali-velikij-kitajskij-faervol-ch-1","title":{"rendered":"Kako smo probijali Veliki Kineski Vatrozid (\u010d.1)","gt_translate_keys":[{"key":"rendered","format":"text"}]},"content":{"rendered":"<p>Pozdrav svima!<\/p>\n<p><\/p>\n<p>Na vezi je Nikita \u2014 sustavni in\u017eenjer iz tvrtke <strong>SEMrush<\/strong>. Danas \u0107u vam pri\u010dati o tome kako smo se suo\u010dili s izazovom osiguravanja stabilnosti rada na\u0161e usluge semrush.com u Kini, te s kakvim smo se problemima susreli tijekom tog procesa (uzimaju\u0107i u obzir lokaciju na\u0161eg podatkovnog centra na isto\u010dnoj obali SAD-a).<\/p>\n<p><\/p>\n<p>Ovo \u0107e biti velika pri\u010da podijeljena na nekoliko \u010dlanaka. Ispri\u010dat \u0107u vam kako je sve bilo kod nas: od potpuno nefunkcionalne usluge iz Kine, do performansi usluge na razini ameri\u010dke verzije za Amerikance. Obavje\u0161tavam vas, bit \u0107e zanimljivo i korisno. Idemo.<\/p>\n<p><\/p>\n<h2 id=\"problemy-kitayskogo-interneta\">Problemi kineskog interneta<\/h2>\n<p><\/p>\n<p>\u010cak je i netko tko nije upoznat sa specifi\u010dnostima mre\u017enog upravljanja barem jednom \u010duo za <strong>Veliki kineski vatrozid<\/strong>. Uuuu, zvu\u010di kul, zar ne? No, \u0161to je to, kako zapravo funkcionira \u2014 pitanje je prili\u010dno slo\u017eeno. Na internetu mo\u017eete prona\u0107i mnogo \u010dlanaka koji se bave tim, ali s tehni\u010dke strane, struktura ovog vatrozida nigdje nije opisana. \u0160to, usput budi re\u010deno, nije iznena\u0111uju\u0107e. Iskreno, nakon godine dana rada ne\u0107u mo\u0107i to\u010dno re\u0107i kako on funkcionira, no mogu podijeliti svoja zapa\u017eanja i prakti\u010dne zaklju\u010dke. I zapo\u010det \u0107emo s glasinama o tom vatrozidu.<\/p>\n<p><noindex><a rel=\"nofollow\" name=\"habracut\"><\/a><\/noindex><\/p>\n<p>Postoji mnogo glasina o tom vatrozidu. Hajde da skupimo glavne i najzanimljivije od njih na jedan popis:<\/p>\n<p><\/p>\n<ul>\n<li>Google, Facebook, Twitter i drugi sli\u010dni servisi su blokirani i ne rade u Kini.<\/li>\n<li>Svaki promet koji ide IZ Kine i U Kinu, analiziraju se i ograni\u010davaju pomo\u0107u strojnog u\u010denja (u slu\u010daju sumnjivog prometa), \u0161to zna\u010dajno usporava taj promet koji prolazi granicu.<\/li>\n<li>Kineske obavje\u0161tajne slu\u017ebe mogu hakirati svaki \u0161ifrirani promet koji prolazi kroz njihov vatrozid.<\/li>\n<li>VPN tuneli, IPSEC tuneli su nestabilni, \u010desto padaju i neprestano se blokiraju.<\/li>\n<li>\u0160to je jednostavnije \u0161ifriranje, to je jednostavnija pass fraza kori\u0161tena za autentifikaciju\/\u0161ifru prometa, br\u017ee prolazi kroz kineski vatrozid.<\/li>\n<\/ul>\n<p><\/p>\n<p>Evo \u0161to smo uspjeli saznati o tim glasinama:<\/p>\n<p><\/p>\n<ul>\n<li>Google, Facebook, Twitter i drugi sli\u010dni servisi su zaista blokirani (va\u0161 KO), no mnoge tehni\u010dke domene Googlea, primjerice, nisu blokirane i funkcioni\u0161u (isti gstatic.com). Iz toga slijedi zaklju\u010dak: ne treba bezumno uklanjati sve Googleove i druge, naizgled blokirane, resurse.<\/li>\n<li>Svaki promet koji prolazi granicu zaista pove\u0107ava vrijeme ka\u0161njenja. Pogledajte dvije rezultate. Jedna web stranica, jedna stranica, jednostavan GET <em>curl<\/em>\u2019om. Prvo mjerenje iz Kine (predivan grad Shenzhen). Drugo mjerenje izvana iz Hong Konga (ima suverenitet, i izme\u0111u njega i svijeta nema vatrozida). Udaljenost izme\u0111u gradova u pravoj liniji je otprilike 30-40 km.<\/li>\n<\/ul>\n<p><\/p>\n<pre><code class=\"bash\">nikita@china-shenzhen:~# curl -o \/dev\/null -w@curl_time \"https:\/\/www.semrush.com\/info\/ebay.com\"\n  % Total    % Received % Xferd  Average Speed   Time    Time     Time  Current\n                                 Dload  Upload   Total   Spent    Left  Speed\n100  381k    0  381k    0     0  71824      0 --:--:--  0:00:05 --:--:-- 82832\ntime_namelookup:  0.004500\ntime_connect:  0.169342\ntime_appconnect:  0.723189\ntime_pretransfer:  0.723499\ntime_redirect:  0.000000\ntime_starttransfer:  1.532912\n----------\ntime_total:  5.443407\n----------\nsize_download:  390968 Bytes\nspeed_download:  71824.000B\/s\n\nnikita@china-hongkong:~# curl -o \/dev\/null -w@curl_time \"https:\/\/www.semrush.com\/info\/ebay.com\"\n  % Total    % Received % Xferd  Average Speed   Time    Time     Time  Current\n                                 Dload  Upload   Total   Spent    Left  Speed\n100  319k    0  319k    0     0  2555k      0 --:--:-- --:--:-- --:--:-- 2573k\ntime_namelookup:  0.029366\ntime_connect:  0.030742\ntime_appconnect:  0.047310\ntime_pretransfer:  0.047388\ntime_redirect:  0.000000\ntime_starttransfer:  0.120793\n----------\ntime_total:  0.124871\n----------\nsize_download:  326755 Bytes\nspeed_download:  2616740.000B\/s<\/code><\/pre>\n<p><\/p>\n<p>Obratite pa\u017enju na <strong>time_connect<\/strong>. I op\u0107enito, vidite rezultat: vatrozid dodaje 4 dodatne sekunde, \u0161to je katastrofalno sporo.<\/p>\n<p><\/p>\n<ul>\n<li>VPN i IPSEC tuneli \u010desto ispadaju. O tome \u0107u pri\u010dati malo kasnije i detaljnije. VPN serveri koje koriste korisnici, s vremenom se blokiraju (obi\u010dno unutar jednog dana nakon po\u010detka kori\u0161tenja). <\/li>\n<li>Postoji mi\u0161ljenje, koje dolazi od ljudi koji \u017eive u Kini, da \u0161to je enkripcija prometa jednostavnija, to br\u017ee prolazi kroz granicu, jer je lako shvatiti da u njemu nema ni\u0161ta protuzakonito. I isto tako '\u010disti' promet dobiva vi\u0161e propusnosti i brzine prolaza, dok 'prljavi' promet, u kojem ni\u0161ta nije prepoznatljivo, dobiva suprotno sporiji prolaz. Kao primjer, spomenut \u0107u curl do <em>ifconfig.co<\/em> putem HTTPS i HTTP protokola. <\/li>\n<\/ul>\n<p><\/p>\n<pre><code class=\"bash\">curl -o \/dev\/null -w@curl_time \"https:\/\/ifconfig.co\/\"\n  % Total    % Received % Xferd  Average Speed   Time    Time     Time  Current\n                                 Dload  Upload   Total   Spent    Left  Speed\n100    13  100    13    0     0      2      0  0:00:06  0:00:05  0:00:01     3\ntime_namelookup:  0.004305\ntime_connect:  0.397465\ntime_appconnect:  5.149305\ntime_pretransfer:  5.149393\ntime_redirect:  0.000000\ntime_starttransfer:  5.568847\n----------\ntime_total:  5.568893\n----------\nsize_download:  13 Bytes\nspeed_download:  2.000B\/s\n\ncurl -o \/dev\/null -w@curl_time \"http:\/\/ifconfig.co\/\"\n  % Total    % Received % Xferd  Average Speed   Time    Time     Time  Current\n                                 Dload  Upload   Total   Spent    Left  Speed\n100    13  100    13    0     0     28      0 --:--:-- --:--:-- --:--:--    28\ntime_namelookup:  0.004282\ntime_connect:  0.212457\ntime_appconnect:  0.000000\ntime_pretransfer:  0.212484\ntime_redirect:  0.000000\ntime_starttransfer:  0.450565\n----------\ntime_total:  0.450620\n----------\nsize_download:  13 Bytes\nspeed_download:  28.000B\/s<\/code><\/pre>\n<p><\/p>\n<p>Razlika od 5 sekundi u ukupnom vremenu u\u010ditavanja 13 bajtova. \u010cine\u0107i ovaj test nekoliko puta, mo\u017ee se primijetiti da GET na HTTP obi\u010dno traje otprilike isto vrijeme svaki puta, dok na HTTPS stranica ponekad odgovara za 3, 5, 10, pa \u010dak i 17 sekundi. Ponekad se javljaju SSL gre\u0161ke:<\/p>\n<p><\/p>\n<p><code>Nepoznata SSL protokol gre\u0161ka u vezi s ifconfig.co:443.<\/code><\/p>\n<p><\/p>\n<p>Dakle, \u0161ta imamo:<\/p>\n<p><\/p>\n<ul>\n<li>Problemi uzrokovani kineskim vatrozidom, opisani iznad.<\/li>\n<li>Pingovi do vanjskih resursa i unutar tunela ponekad nestaju.<\/li>\n<li>Latencija izme\u0111u dvije ta\u010dke stalno se mijenja, a \u010desto je jednostavno nepredvidiva. Povezuju\u0107i razli\u010dite gradove\/regije, o\u010dekuje\u0161 da \u0107e, obzirom na geografski polo\u017eaj regiona, ka\u0161njenje biti manje, a zapravo dobije\u0161 potpuno suprotnu situaciju. <\/li>\n<li>Internet i komunikacijski kanali rade ponekad brzo, ponekad sporo. Tu postoji mala zavisnost od doba dana i dana u tjednu, ali ne uvijek.<\/li>\n<li>DNS upiti prema vanjskom svijetu iz Kine nekad prelaze dopu\u0161teno vreme.<\/li>\n<\/ul>\n<p><\/p>\n<p>Slika se \u010dini \u201eizvrsnom\u201d. <\/p>\n<p><\/p>\n<p>Data centar, kao \u0161to sam ve\u0107 rekao, nalazi se na istoku SAD-a, a cijeli SEMrush se sastoji od desetaka me\u0111usobno povezanih proizvoda, backend-a, frontend-a, baza podataka, i sve to u DC-u i obla\u010dnim sistemima. Pred nama, kao timu sistemskih administratora, postavljen je zadatak da brzo po\u010dnemo raditi u Kini s minimalnim naporima.<\/p>\n<p><\/p>\n<p>Morali smo odgovoriti na va\u017eno pitanje: mo\u017eemo li pro\u0107i s malim naporima i rije\u0161iti sve probleme povezane s kineskim internetom i vatrozidom na razini mre\u017ee\/oblaka\/servera?<\/p>\n<p><\/p>\n<p>Zapo\u010deli smo s dobivanjem <noindex><a rel=\"nofollow\" href=\"https:\/\/ru.wikipedia.org\/wiki\/%D0%9B%D0%B8%D1%86%D0%B5%D0%BD%D0%B7%D0%B8%D1%8F_ICP\"><strong>ICP<\/strong>- dozvole<\/a><\/noindex>.<\/p>\n<p><\/p>\n<h2 id=\"icp-licenziya\">ICP dozvola<\/h2>\n<p><\/p>\n<p>Da bismo imali mogu\u0107nost postavljanja svoje usluge unutar Kine (mainland China) i provo\u0111enja testova, prvo je potrebno dobiti ICP dozvolu za domenu.<\/p>\n<p><\/p>\n<p>Ako je korisni\u010dki promet va\u0161e web stranice preusmjeren unutar Kine, a va\u0161 domen nema ICP licencu, va\u0161 promet \u0107e biti blokiran od strane davatelja usluga\/hosting provajdera. Zanimljivo je da u ICP licencu ulazi odre\u0111eni davatelj, bilo da je to Cloudflare ili Alibaba Cloud. Stoga, ako ste dobili ICP licencu za Cloudflare i hostali svoju web stranicu kod njih, kasnije se ne\u0107ete mo\u0107i \"besprijekorno\" preseliti na Alibaba Cloud. Bit \u0107ete primorani dodati jo\u0161 jednog hosting pru\u017eatelja u tu licencu.<\/p>\n<p><\/p>\n<p>Nakon \u0161to smo dobili ICP licencu za domen, mogli smo smi\u0161ljati i provoditi konkretne tehni\u010dke ideje i rje\u0161enja.<\/p>\n<p><\/p>\n<h2 id=\"testirovanie-resheniy\">Testiranje rje\u0161enja<\/h2>\n<p><\/p>\n<p>No, prije nego \u0161to zapo\u010dnemo s izradom varijanti za staging, pode\u0161avanjem, optimizacijom rada i brzine web stranice, potrebno je odabrati alat za testiranje kako bismo vidjeli koje na\u0161e akcije pobolj\u0161avaju ili, naprotiv, pogor\u0161avaju rad web stranice.<\/p>\n<p><\/p>\n<p>Na\u0161 alat za testiranje morao je ispunjavati dva glavna zahtjeva:<\/p>\n<p><\/p>\n<ul>\n<li>mora imati mogu\u0107nost pokretanja testova iz Kine,<\/li>\n<li>mora imati testove preglednika.<\/li>\n<\/ul>\n<p><\/p>\n<p>Tako smo prona\u0161li <noindex><a rel=\"nofollow\" href=\"https:\/\/www.catchpoint.com\/\">Catchpoint<\/a><\/noindex>! Imaju izvrsno pokri\u0107e to\u010dkama testiranja \u0161irom svijeta. U Kini putem ovog alata tako\u0111er mo\u017eete pokretati testove iz 100500 provincija. U svakoj nekoliko razli\u010ditih davatelja + mogu\u0107nost izvo\u0111enja <strong>Backbone<\/strong>-testova (ne\u0161to poput virtualke u data centru) i <strong>Lastmile<\/strong>-testova (maksimalno pribli\u017eeni korisni\u010dkim uvjetima, aka radna stanica). Posljednja vrsta testova je skuplja.<\/p>\n<p><\/p>\n<p>Potpisav\u0161i godi\u0161nji ugovor (manje se ne mo\u017ee), zapo\u010deli smo s prou\u010davanjem alata. Moram priznati da smo bili ugodno iznena\u0111eni njegovim funkcionalnostima. Mo\u017eete pokretati:<\/p>\n<p><\/p>\n<ul>\n<li>DNS testove,<\/li>\n<li>Web testove (pretra\u017eiva\u010dke, jednostavni GET\/POST, emulacija mobilnog klijenta itd.),<\/li>\n<li>Transakcijske provjere (npr. prijava),<\/li>\n<li>API testove,<\/li>\n<li>Ping, traceroute, NTP itd.<\/li>\n<\/ul>\n<p><\/p>\n<p>Sve to nije mogu\u0107e pobrojati. I \u0161to je najva\u017enije, svaki test se mo\u017ee dobro prilagoditi, dodaju\u0107i paket zaglavlja i drugih parametara. Na izlazu se dobiva ogromna koli\u010dina informacija koja potpuno opisuje va\u0161 test. Kada govorimo o najzanimljivijem za nas (testovi preglednika), rezultati uklju\u010duju:<\/p>\n<p><\/p>\n<ul>\n<li>Connect, Wait, Load, SSL, DNS vrijeme,<\/li>\n<li>TTFB, TTLB, Dokument zavr\u0161eno, Vrijeme renderiranja, DOM u\u010ditavanje,<\/li>\n<li>Odgovor (ne\u0161to sli\u010dno vremenu do prvog bajta), Odgovor web stranice (ne\u0161to sli\u010dno vremenu do posljednjeg bajta),<\/li>\n<li>Bilo koji percentil, Prosjek, Medijan vremena<\/li>\n<li>I sli\u010dno.<\/li>\n<\/ul>\n<p><\/p>\n<p>Stoga, sve te metrike poma\u017eu u pra\u0107enju promjena i razumijevanju je li situacija pobolj\u0161ana. Mi smo se uglavnom fokusirali na <strong>Response, Webpage Response, Median, 75 i 95 Percentiles<\/strong>. <\/p>\n<p><\/p>\n<p>Va\u017eno pitanje koje se postavljalo od samog po\u010detka: <strong>mo\u017ee li se vjerovati Catchpointu?<\/strong>? \u041e\u0442\u0440\u0430\u0436\u0430\u0435\u0442 \u043b\u0438 \u044d\u0442\u043e\u0442 \u0438\u043d\u0441\u0442\u0440\u0443\u043c\u0435\u043d\u0442 \u0440\u0435\u0430\u043b\u044c\u043d\u0443\u044e \u0441\u043a\u043e\u0440\u043e\u0441\u0442\u044c \u0437\u0430\u0433\u0440\u0443\u0437\u043a\u0438 \u0441\u0430\u0439\u0442\u0430 \u0432 \u041a\u0438\u0442\u0430\u0435 \u0438\u0437 \u0440\u0430\u0437\u043d\u044b\u0445 \u0433\u043e\u0440\u043e\u0434\u043e\u0432 \u0438\u043b\u0438 \u0436\u0435 \u044d\u0442\u043e \u043f\u0440\u043e\u0441\u0442\u043e \u043a\u0430\u043a\u043e\u0439-\u0442\u043e \u0442\u0435\u0441\u0442 \u0432 \u0432\u0430\u043a\u0443\u0443\u043c\u0435, \u043d\u0435 \u0438\u043c\u0435\u044e\u0449\u0438\u0439 \u043d\u0438\u0447\u0435\u0433\u043e \u043e\u0431\u0449\u0435\u0433\u043e \u0441 real user experience?<br \/>\nTo je veliki problem jer je gotovo nemogu\u0107e pouzdano utvrditi kako web stranica iz Kine radi dok ste u Rusiji. Kada radite socks-proxy kroz virtualnu ma\u0161inu, na izlazu dobijete u\u010ditavanje stranice koje traje nekoliko minuta, \u0161to je jednostavno neprihvatljivo za testove, stoga jedina opcija za ru\u010dno testiranje ostaje curl i jednostavni GET iz konzole uz mjerenje vremena. To poma\u017ee, jer ovaj test dobro odra\u017eava brzinu mre\u017enog rje\u0161enja, a ako imate i testove u pregledniku, to je jo\u0161 bolje.<\/p>\n<p><\/p>\n<p>Kasnije smo sami oti\u0161li u Kinu i uvjerili se da <strong>Catchpointu se mo\u017ee vjerovati, pouzdano odra\u017eava stvarne brzinske pokazatelje.<\/strong><\/p>\n<p><\/p>\n<h2 id=\"cloudflare-china-network\">Cloudflare China Network<\/h2>\n<p><\/p>\n<p>Po\u0161to za glavni domen semrush.com uspje\u0161no koristimo Cloudflare, odlu\u010dili smo odmah isprobati njihovu opciju pod nazivom <noindex><a rel=\"nofollow\" href=\"https:\/\/www.cloudflare.com\/network\/china\/\">China Network<\/a><\/noindex>. Ova opcija se aktivira samo za Enterprise sajtove na poseban zahtjev i uz dodatnu naknadu. Tako\u0111er, dostupna je samo za sajtove koji imaju odgovaraju\u0107u ICP licencu, u kojoj je Cloudflare naveden kao pru\u017eatelj usluga. Nakon njenog uklju\u010divanja, za sajt postaje dostupan \u201ckineski CDN\u201d od Cloudflare \u2014 promet iz kineskih regija slije\u0107e u najbli\u017ee PoP (Points of Presence) CF, a zatim se ve\u0107 preko njihovih mre\u017ea ili mre\u017ea partnera isporu\u010duje do origina. <\/p>\n<p><\/p>\n<p>Shema ovog testnog okru\u017eenja prikazana je u nastavku.<\/p>\n<p><\/p>\n<p>Za nas je to izvrsna opcija. O\u010digledno, drugi domen \u0107e tako\u0111er biti iza CF, \u0161to ne pove\u0107ava broj rje\u0161enja koja se koriste u kompaniji, a tako\u0111er gotovo ne komplicira infrastrukturu.<\/p>\n<p><\/p>\n<p>Pokrenuli smo testove u pregledniku i evo \u0161to smo dobili:<\/p>\n<p><\/p>\n<p>Crveni rombovi \u2014 to su neuspjesi testova. Neuspjesi dolje \u2014 DNS gre\u0161ke (resolve timeout). Neuspjesi gore \u2014 vremenska ograni\u010denja.<\/p>\n<p><\/p>\n<p><em>Uptime: 86.6<br \/>\nMedian: 18s<br \/>\n75 Percentile: 29.3s<br \/>\n95 Percentile: 60s<\/em><\/p>\n<p><\/p>\n<p>Medijan, nakon \u0161to je uklonjena u\u010ditavanje <em>reCaptcha<\/em> (usluga Googlea, blokirana u Kini), smanjila se s 28 na 18 sekundi. Ipak, to su stra\u0161ni pokazatelji, ako se uzme u obzir da je isti test za semrush.com (iz SAD-a) davao manje od 10 sekundi za 95% korisnika (iz SAD-a) na istoj stranici (statika + dinamika).<\/p>\n<p><\/p>\n<p>U svakom testu mo\u017eete u\u0107i i pogledati <em>Waterfall<\/em> i drugi detaljniji parametri. Po\u010deli smo istra\u017eivati uzroke gre\u0161aka, a dok su za timeoutove sve vi\u0161e-manje jasne: internet u Kini \u201codjednom radi, odjednom ne radi\u201d, zbog \u010dega je brzina povezivanja i u\u010ditavanja resursa iz inostranstva nestabilna i neujedna\u010dena, DNS gre\u0161ke su nas jako iznenadile. Otkrili smo da <em>PoP<\/em> usluge Cloudflare zaista se nalaze u Kini, adresa web stranice razdvaja se na jedan anycast IP, ali se koriste ameri\u010dki DNS serveri, zbog \u010dega DNS upiti moraju prolaziti kroz granicu, pa zato ponekad ne uspevaju.<\/p>\n<p><\/p>\n<p>Razjasniv\u0161i ovo pitanje s CF, saznali smo da <strong>nemaju svoje DNS servere u Kini<\/strong>, a kada \u0107e ih biti \u2014 za sada nije poznato.<\/p>\n<p><\/p>\n<p>Zbog toga smo odlu\u010dili testirati samo DNS Cloudflare i promenili mehanizam rada Cloudflare za na\u0161u web stranicu na re\u017eim \u201c<strong>Samo DNS<\/strong>\u201d. To je re\u017eim kada Cloudflare ne proksira saobra\u0107aj kroz sebe, \u0161to zna\u010di da ne pru\u017ea DDoS za\u0161titu, CDN i druge funkcije, i radi u re\u017eimu obi\u010dnog DNS servera. <\/p>\n<p><\/p>\n<p>Ova postavka je shematski predstavljena na slede\u0107em crte\u017eu. Na crte\u017eu su uzeta u obzir nova saznanja o tome da su DNS serveri Cloudflare iza firewall-a.<\/p>\n<p><\/p>\n<p>U Catchpointu smo pokrenuli jednostavne GET testove (ne brauzerske), koji su pokazali mnogo gre\u0161aka. Uzrok im je bila ista ona DNS gre\u0161ka.<\/p>\n<p><\/p>\n<p>Po\u010deli smo debagirati te gre\u0161ke uz pomo\u0107 <em>dig<\/em> i otkrili da se prilikom prvog upita adresa ispravno odre\u0111uje, dok prilikom ponovnog upita svaki put dobijamo <em>SERVFAIL<\/em> i <em>not found<\/em>. Odakle to odjednom?<\/p>\n<p><\/p>\n<pre><code class=\"bash\">root@iZwz97n2wgbp61qucbfrjsZ:~# host semrushchina.cn\nsemrushchina.cn ima adresu 220.170.186.192\nHost semrushchina.cn nije prona\u0111en: 2(SERVFAIL)\nroot@iZwz97n2wgbp61qucbfrjsZ:~# host semrushchina.cn\nsemrushchina.cn ima adresu 220.170.186.192\nHost semrushchina.cn nije prona\u0111en: 2(SERVFAIL)\nroot@iZwz97n2wgbp61qucbfrjsZ:~# host semrushchina.cn\nsemrushchina.cn ima adresu 220.170.186.192\nHost semrushchina.cn nije prona\u0111en: 2(SERVFAIL)\nroot@iZwz97n2wgbp61qucbfrjsZ:~# host semrushchina.cn\nsemrushchina.cn ima adresu 220.170.186.192\nHost semrushchina.cn nije prona\u0111en: 2(SERVFAIL)<\/code><\/pre>\n<p><\/p>\n<p>Prilikom upita NS servera Cloudflare direktno takvih gre\u0161aka nema:<\/p>\n<p><\/p>\n<pre><code class=\"bash\">root@iZwz97n2wgbp61qucbfrjsZ:~# for i in `seq 1 2`; do host semrushchina.cn ray.ns.cloudflare.com.; done\nKori\u0161\u0107enje servera domene:\nIme: ray.ns.cloudflare.com.\nAdresa: 173.245.59.138#53\nAlias:\n\nsemrushchina.cn ima adresu 220.170.186.192\nsemrushchina.cn ima adresu 220.170.186.192\nKori\u0161\u0107enje servera domene:\nIme: ray.ns.cloudflare.com.\nAdresa: 173.245.59.138#53\nAlias:\n\nsemrushchina.cn ima adresu 220.170.186.192\nsemrushchina.cn ima adresu 220.170.186.192<\/code><\/pre>\n<p><\/p>\n<p>Zna\u010di, problem je na strani \u201clokalnog\u201d DNS servera ili servera provajdera.<br \/>\nDalje istra\u017eivanje pokazalo je da <em>SERVFAIL<\/em> dobijamo na razre\u0161avanju <em>AAAA<\/em>-zapisa. <\/p>\n<p><\/p>\n<p>Ispostavilo se da prilikom upita kod Cloudflare <em>AAAAA<\/em>-zapisi koja ne postoji u domeni, Cloudflare je odgovarao <em>A<\/em>-zapisanjem, \u0161to predstavlja gre\u0161ku i nesklad s RFC-om. Zbog toga lokalnom rezolveru (<em>x.x.x.x<\/em>) to se nije svidjelo, pa je odgovarao <em>SERVFAIL<\/em>. U donjem logu ovo pona\u0161anje je jasno vidljivo:<\/p>\n<p><\/p>\n<pre><code class=\"bash\">root@iZwz97n2wgbp61qucbfrjsZ:~# dig -t AAAA semrushchina.cn @x.x.x.x\n\n; &lt;&gt; DiG 9.10.3-P4-Ubuntu &lt;&gt; -t AAAA semrushchina.cn @x.x.x.x\n;; global options: +cmd\n;; Got answer:\n;; -&gt;&gt;HEADER&lt;&lt;- opcode: QUERY, status: SERVFAIL, id: 55467\n;; flags: qr rd ra; QUERY: 1, ANSWER: 0, AUTHORITY: 0, ADDITIONAL: 1\n\n;; OPT PSEUDOSECTION:\n; EDNS: version: 0, flags:; udp: 4096\n;; QUESTION SECTION:\n;semrushchina.cn.               IN      AAAA\n\n;; Query time: 334 msec\n;; SERVER: x.x.x.x#53(x.x.x.x)\n;; WHEN: Tue Aug 14 23:38:50 CST 2018\n;; MSG SIZE  rcvd: 44\n\nroot@iZwz97n2wgbp61qucbfrjsZ:~# dig -t AAAA semrushchina.cn @dana.ns.cloudflare.com.\n\n; &lt;&gt; DiG 9.10.3-P4-Ubuntu &lt;&gt; -t AAAA semrushchina.cn @dana.ns.cloudflare.com.\n;; global options: +cmd\n;; Got answer:\n;; -&gt;&gt;HEADER&lt;&lt;- opcode: QUERY, status: NOERROR, id: 63944\n;; flags: qr aa rd; QUERY: 1, ANSWER: 1, AUTHORITY: 0, ADDITIONAL: 1\n;; WARNING: recursion requested but not available\n\n;; OPT PSEUDOSECTION:\n; EDNS: version: 0, flags:; udp: 512\n;; QUESTION SECTION:\n;semrushchina.cn.               IN      AAAA\n\n;; ANSWER SECTION:\nsemrushchina.cn.        300     IN      A       220.170.186.192\n\n;; Query time: 185 msec\n;; SERVER: 173.245.58.105#53(173.245.58.105)\n;; WHEN: Tue Aug 14 23:43:03 CST 2018\n;; MSG SIZE  rcvd: 60\n<\/code><\/pre>\n<p><\/p>\n<p>Poslali smo bug-izvje\u0161taj Cloudflareu, i oni su to ispravili nakon nekog vremena. Ispalo je zanimljivo: trenutno u Kini jo\u0161 uvijek nema podr\u0161ke za IPv6, pa Cloudflare nije mogao pru\u017eiti svoj IPv6 adresu u odgovoru na zahtjev <em>AAAAA<\/em>-zapise. Na kraju je sve rije\u0161eno tako da je Cloudflare za Kinu po\u010deo odgovarati <em>NODATA<\/em> na takve zahtjeve.<\/p>\n<p><\/p>\n<p>Tako su DNS gre\u0161ke u Catchpoint testovima drasti\u010dno smanjene, ali ne do kraja. Tajmeri tako\u0111er nisu nestali:<\/p>\n<p><\/p>\n<p>I po\u010deli smo tra\u017eiti drugo rje\u0161enje. <\/p>\n<p><\/p>\n<p>U sljede\u0107em dijelu \u0107u govoriti o tome kako smo testirali kineski Cloud <strong>Alibaba Cloud<\/strong>, kako smo uz pomo\u0107 male &#171;magije&#187; Nginx-a mogli brzo stvarati PoC (dokaz koncepta) rje\u0161enja, kao \u0161to smo razvijali Multi-Cloud rje\u0161enja, od kojih je jedno na kraju zna\u010dajno unaprijedilo rad servisa iz Kine.<\/p>\n<p><\/p>\n<p><strong>Ostanite s nama!<\/strong><\/p>\n<p><\/p>\n<h3 id=\"sleduyuschie-chasti\">Sljede\u0107i dijelovi<\/h3>\n<p><\/p>\n<p><noindex><a rel=\"nofollow\" href=\"https:\/\/habr.com\/ru\/company\/semrush\/blog\/458840\/\">Dio 2<\/a><\/noindex><\/p>\n<p>Izvor: <a content=\"nofollow\" rel=\"nofollow\" href=\"https:\/\/habr.com\/ru\/company\/semrush\/blog\/458602\/\">habr.com<\/a><\/p>","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"excerpt":{"rendered":"<p>\u0412\u0441\u0435\u043c \u043f\u0440\u0438\u0432\u0435\u0442! \u041d\u0430 \u0441\u0432\u044f\u0437\u0438 \u041d\u0438\u043a\u0438\u0442\u0430 \u2014 \u0441\u0438\u0441\u0442\u0435\u043c\u043d\u044b\u0439 \u0438\u043d\u0436\u0435\u043d\u0435\u0440 \u0438\u0437 \u043a\u043e\u043c\u043f\u0430\u043d\u0438\u0438 S\u0415Mrush. \u0421\u0435\u0433\u043e\u0434\u043d\u044f \u044f \u0440\u0430\u0441\u0441\u043a\u0430\u0436\u0443 \u0432\u0430\u043c \u043e \u0442\u043e\u043c, \u043a\u0430\u043a \u043f\u0435\u0440\u0435\u0434 \u043d\u0430\u043c\u0438 \u0432\u0441\u0442\u0430\u043b\u0430 \u0437\u0430\u0434\u0430\u0447\u0430 \u043e\u0431\u0435\u0441\u043f\u0435\u0447\u0438\u0442\u044c \u0441\u0442\u0430\u0431\u0438\u043b\u044c\u043d\u043e\u0441\u0442\u044c \u0440\u0430\u0431\u043e\u0442\u044b \u043d\u0430\u0448\u0435\u0433\u043e \u0441\u0435\u0440\u0432\u0438\u0441\u0430 semrush.com \u0432 \u041a\u0438\u0442\u0430\u0435, \u0438 \u0441 \u043a\u0430\u043a\u0438\u043c\u0438 \u043f\u0440\u043e\u0431\u043b\u0435\u043c\u0430\u043c\u0438 \u043c\u044b \u0441\u0442\u043e\u043b\u043a\u043d\u0443\u043b\u0438\u0441\u044c \u0432 \u0445\u043e\u0434\u0435 \u0435\u0435 \u0432\u044b\u043f\u043e\u043b\u043d\u0435\u043d\u0438\u044f (\u0443\u0447\u0438\u0442\u044b\u0432\u0430\u044f \u043c\u0435\u0441\u0442\u043e\u043d\u0430\u0445\u043e\u0436\u0434\u0435\u043d\u0438\u0435 \u043d\u0430\u0448\u0435\u0433\u043e \u0434\u0430\u0442\u0430-\u0446\u0435\u043d\u0442\u0440\u0430 \u043d\u0430 \u0432\u043e\u0441\u0442\u043e\u0447\u043d\u043e\u043c \u043f\u043e\u0431\u0435\u0440\u0435\u0436\u044c\u0435 \u0421\u0428\u0410). \u042d\u0442\u043e \u0431\u0443\u0434\u0435\u0442 \u0431\u043e\u043b\u044c\u0448\u0430\u044f \u0438\u0441\u0442\u043e\u0440\u0438\u044f, \u0440\u0430\u0437\u0431\u0438\u0442\u0430\u044f \u043d\u0430 \u043d\u0435\u0441\u043a\u043e\u043b\u044c\u043a\u043e [&hellip;]<\/p>\n","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"author":1,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[688],"tags":[],"class_list":["post-35939","post","type-post","status-publish","format-standard","hentry","category-administrirovanie"],"aioseo_notices":[],"aioseo_head":"\n\t\t<!-- All in One SEO 5.0.4 - aioseo.com -->\n\t<meta name=\"description\" content=\"\u0412\u0441\u0435\u043c \u043f\u0440\u0438\u0432\u0435\u0442! \u041d\u0430 \u0441\u0432\u044f\u0437\u0438 \u041d\u0438\u043a\u0438\u0442\u0430 \u2014 \u0441\u0438\u0441\u0442\u0435\u043c\u043d\u044b\u0439 \u0438\u043d\u0436\u0435\u043d\u0435\u0440 \u0438\u0437 \u043a\u043e\u043c\u043f\u0430\u043d\u0438\u0438 S\u0415Mrush.\" \/>\n\t<meta name=\"robots\" content=\"max-image-preview:large\" \/>\n\t<meta name=\"author\" content=\"Yuri Gagarin\"\/>\n\t<link rel=\"canonical\" href=\"https:\/\/prohoster.info\/hr\/blog\/administrirovanie\/kak-my-probivali-velikij-kitajskij-faervol-ch-1\" \/>\n\t\t<meta name=\"generator\" content=\"All in One SEO (AIOSEO) 5.0.4\" \/>\n\t\t<meta property=\"og:locale\" content=\"hr_HR\" \/>\n\t\t<meta property=\"og:site_name\" content=\"ProHoster | \u041a\u0443\u043f\u0438\u0442\u044c \u043d\u0430\u0434\u0435\u0436\u043d\u044b\u0439 \u0445\u043e\u0441\u0442\u0438\u043d\u0433 \u0434\u043b\u044f \u0441\u0430\u0439\u0442\u043e\u0432 \u0441 \u0437\u0430\u0449\u0438\u0442\u043e\u0439 \u043e\u0442 DDoS, VPS VDS \u0441\u0435\u0440\u0432\u0435\u0440\u044b\" \/>\n\t\t<meta property=\"og:type\" content=\"article\" \/>\n\t\t<meta property=\"og:title\" content=\"\ud83e\udd47\u041a\u0430\u043a \u043c\u044b \u043f\u0440\u043e\u0431\u0438\u0432\u0430\u043b\u0438 \u0412\u0435\u043b\u0438\u043a\u0438\u0439 \u041a\u0438\u0442\u0430\u0439\u0441\u043a\u0438\u0439 \u0424\u0430\u0435\u0440\u0432\u043e\u043b (\u0447.1) | ProHoster\" \/>\n\t\t<meta property=\"og:description\" content=\"\u0412\u0441\u0435\u043c \u043f\u0440\u0438\u0432\u0435\u0442! \u041d\u0430 \u0441\u0432\u044f\u0437\u0438 \u041d\u0438\u043a\u0438\u0442\u0430 \u2014 \u0441\u0438\u0441\u0442\u0435\u043c\u043d\u044b\u0439 \u0438\u043d\u0436\u0435\u043d\u0435\u0440 \u0438\u0437 \u043a\u043e\u043c\u043f\u0430\u043d\u0438\u0438 S\u0415Mrush.\" \/>\n\t\t<meta property=\"og:url\" content=\"https:\/\/prohoster.info\/hr\/blog\/administrirovanie\/kak-my-probivali-velikij-kitajskij-faervol-ch-1\" \/>\n\t\t<meta property=\"og:image\" content=\"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg\" \/>\n\t\t<meta property=\"og:image:secure_url\" content=\"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg\" \/>\n\t\t<meta property=\"og:image:width\" content=\"350\" \/>\n\t\t<meta property=\"og:image:height\" content=\"350\" \/>\n\t\t<meta property=\"article:published_time\" content=\"2019-10-31T19:07:41+00:00\" \/>\n\t\t<meta property=\"article:modified_time\" content=\"2019-10-31T19:07:41+00:00\" \/>\n\t\t<meta property=\"article:publisher\" content=\"https:\/\/www.facebook.com\/prohoster\" \/>\n\t\t<meta property=\"article:author\" content=\"https:\/\/www.facebook.com\/prohoster\" \/>\n\t\t<!-- All in One SEO -->\n\n","aioseo_head_json":{"title":"\ud83e\udd47Kako smo probijali Veliki Kineski Vatrozid (\u010d.1) | ProHoster","description":"Pozdrav svima! Ovde je Nikita \u2014 sistemski in\u017eenjer iz kompanije SEMrush.","canonical_url":"https:\/\/prohoster.info\/hr\/blog\/administrirovanie\/kak-my-probivali-velikij-kitajskij-faervol-ch-1","robots":"max-image-preview:large","keywords":"","webmasterTools":{"miscellaneous":""},"schema":null,"og:locale":"hr_HR","og:site_name":"ProHoster | \u041a\u0443\u043f\u0438\u0442\u044c \u043d\u0430\u0434\u0435\u0436\u043d\u044b\u0439 \u0445\u043e\u0441\u0442\u0438\u043d\u0433 \u0434\u043b\u044f \u0441\u0430\u0439\u0442\u043e\u0432 \u0441 \u0437\u0430\u0449\u0438\u0442\u043e\u0439 \u043e\u0442 DDoS, VPS VDS \u0441\u0435\u0440\u0432\u0435\u0440\u044b","og:type":"article","og:title":"\ud83e\udd47\u041a\u0430\u043a \u043c\u044b \u043f\u0440\u043e\u0431\u0438\u0432\u0430\u043b\u0438 \u0412\u0435\u043b\u0438\u043a\u0438\u0439 \u041a\u0438\u0442\u0430\u0439\u0441\u043a\u0438\u0439 \u0424\u0430\u0435\u0440\u0432\u043e\u043b (\u0447.1) | ProHoster","og:description":"\u0412\u0441\u0435\u043c \u043f\u0440\u0438\u0432\u0435\u0442! \u041d\u0430 \u0441\u0432\u044f\u0437\u0438 \u041d\u0438\u043a\u0438\u0442\u0430 \u2014 \u0441\u0438\u0441\u0442\u0435\u043c\u043d\u044b\u0439 \u0438\u043d\u0436\u0435\u043d\u0435\u0440 \u0438\u0437 \u043a\u043e\u043c\u043f\u0430\u043d\u0438\u0438 S\u0415Mrush.","og:url":"https:\/\/prohoster.info\/hr\/blog\/administrirovanie\/kak-my-probivali-velikij-kitajskij-faervol-ch-1","og:image":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:secure_url":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:width":350,"og:image:height":350,"article:published_time":"2019-10-31T19:07:41+00:00","article:modified_time":"2019-10-31T19:07:41+00:00","article:publisher":"https:\/\/www.facebook.com\/prohoster","article:author":"https:\/\/www.facebook.com\/prohoster"},"aioseo_meta_data":{"post_id":"35939","title":null,"description":null,"keywords":null,"keyphrases":null,"primary_term":null,"canonical_url":null,"og_title":null,"og_description":null,"og_object_type":"default","og_image_type":"default","og_image_url":null,"og_image_width":null,"og_image_height":null,"og_image_custom_url":null,"og_image_custom_fields":null,"og_video":null,"og_custom_url":null,"og_article_section":null,"og_article_tags":null,"twitter_use_og":false,"twitter_card":"default","twitter_image_type":"default","twitter_image_url":null,"twitter_image_custom_url":null,"twitter_image_custom_fields":null,"twitter_title":null,"twitter_description":null,"schema":{"blockGraphs":[],"customGraphs":[],"default":{"data":{"Article":[],"Course":[],"Dataset":[],"FAQPage":[],"Movie":[],"Person":[],"Product":[],"ProductReview":[],"Car":[],"Recipe":[],"Service":[],"SoftwareApplication":[],"WebPage":[]},"graphName":"","isEnabled":true},"graphs":[]},"schema_type":null,"schema_type_options":null,"pillar_content":false,"robots_default":true,"robots_noindex":false,"robots_noarchive":false,"robots_nosnippet":false,"robots_nofollow":false,"robots_noimageindex":false,"robots_noodp":false,"robots_notranslate":false,"robots_max_snippet":null,"robots_max_videopreview":null,"robots_max_imagepreview":"large","priority":null,"frequency":null,"local_seo":null,"seo_analyzer_scan_date":"2026-01-22 01:21:19","breadcrumb_settings":null,"limit_modified_date":false,"reviewed_by":null,"ai":null,"created":"2021-03-01 01:53:31","updated":"2026-01-22 01:21:19","focus_keyword":null,"additional_keywords":null,"truseo_locale":null},"gt_translate_keys":[{"key":"link","format":"url"}],"_links":{"self":[{"href":"https:\/\/prohoster.info\/hr\/wp-json\/wp\/v2\/posts\/35939","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/prohoster.info\/hr\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/prohoster.info\/hr\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/prohoster.info\/hr\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/prohoster.info\/hr\/wp-json\/wp\/v2\/comments?post=35939"}],"version-history":[{"count":0,"href":"https:\/\/prohoster.info\/hr\/wp-json\/wp\/v2\/posts\/35939\/revisions"}],"wp:attachment":[{"href":"https:\/\/prohoster.info\/hr\/wp-json\/wp\/v2\/media?parent=35939"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/prohoster.info\/hr\/wp-json\/wp\/v2\/categories?post=35939"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/prohoster.info\/hr\/wp-json\/wp\/v2\/tags?post=35939"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}