{"id":35939,"date":"2019-10-31T22:07:41","date_gmt":"2019-10-31T19:07:41","guid":{"rendered":"https:\/\/prohoster.info\/blog\/kak-my-probivali-velikij-kitajskij-faervol-ch-1\/"},"modified":"2019-10-31T22:07:41","modified_gmt":"2019-10-31T19:07:41","slug":"kak-my-probivali-velikij-kitajskij-faervol-ch-1","status":"publish","type":"post","link":"https:\/\/prohoster.info\/ro\/blog\/administrirovanie\/kak-my-probivali-velikij-kitajskij-faervol-ch-1","title":{"rendered":"Cum am ocolit Marele Firewall Chinezesc (partea 1)","gt_translate_keys":[{"key":"rendered","format":"text"}]},"content":{"rendered":"<p>Salut tuturor!<\/p>\n<p><\/p>\n<p>Sunt Nikita \u2014 inginer sistem de la compania <strong>SEMrush<\/strong>. Ast\u0103zi v\u0103 voi povesti despre cum ne-am confruntat cu provocarea de a asigura stabilitatea serviciului nostru semrush.com \u00een China \u0219i cu ce probleme ne-am \u00eent\u00e2lnit \u00een timpul realiz\u0103rii acesteia (av\u00e2nd \u00een vedere localizarea centrului nostru de date pe coasta de est a SUA).<\/p>\n<p><\/p>\n<p>Va fi o poveste mare, \u00eemp\u0103r\u021bit\u0103 \u00een mai multe articole. V\u0103 voi spune cum a fost totul pentru noi: de la un serviciu complet nefunc\u021bional din China, p\u00e2n\u0103 la indicatori de performan\u021b\u0103 la nivelul versiunii americane pentru americani. Promit, va fi interesant \u0219i util. A\u0219adar, s\u0103 \u00eencepem.<\/p>\n<p><\/p>\n<h2 id=\"problemy-kitayskogo-interneta\">Problemele internetului chinezesc<\/h2>\n<p><\/p>\n<p>Chiar \u0219i cea mai \u00eendep\u0103rtat\u0103 persoan\u0103 de specificul administr\u0103rii re\u021belelor a auzit, m\u0103car o dat\u0103, despre <strong>Marele Firewall Chinezesc<\/strong>. Uuu, sun\u0103 grozav, nu? Dar ce este, cum func\u021bioneaz\u0103 de fapt \u2014 este o \u00eentrebare destul de complex\u0103. Pe internet se pot g\u0103si multe articole dedicate acestuia, dar din punct de vedere tehnic, structura acestui firewall nu este descris\u0103 nic\u0103ieri. Ceea ce, de altfel, nu este surprinz\u0103tor. Recunosc din start, \u00een urma unui an de munc\u0103 nu voi putea spune exact cum func\u021bioneaz\u0103, dar pot s\u0103 v\u0103 \u00eemp\u0103rt\u0103\u0219esc observa\u021biile \u0219i concluziile mele practice. \u0218i vom \u00eencepe cu zvonurile despre acest firewall.<\/p>\n<p><noindex><a rel=\"nofollow\" name=\"habracut\"><\/a><\/noindex><\/p>\n<p>Exist\u0103 multe zvonuri despre acest firewall. S\u0103 adun\u0103m cele mai importante \u0219i interesante dintre ele \u00eentr-o singur\u0103 list\u0103:<\/p>\n<p><\/p>\n<ul>\n<li>Google, Facebook, Twitter \u0219i alte servicii similare sunt blocate \u0219i nu func\u021bioneaz\u0103 \u00een China.<\/li>\n<li>Orice trafic care intr\u0103 \u0219i iese din China este analizat \u0219i restric\u021bionat prin \u00eenv\u0103\u021bare automat\u0103 (\u00een cazul unui trafic suspect), ceea ce \u00eel \u00eencetine\u0219te considerabil (traficul) \u00een momentul trecerii grani\u021bei.<\/li>\n<li>Serviciile de securitate chineze\u0219ti pot sparge orice trafic criptat care trece prin firewall-ul lor.<\/li>\n<li>Tunelurile VPN, tunelurile IPSEC sunt instabile, c\u0103z\u00e2nd \u0219i fiind constant blocate.<\/li>\n<li>Cu c\u00e2t criptarea este mai simpl\u0103, cu at\u00e2t pass phrase-ul folosit pentru autentificarea\/criptarea traficului este mai simplu, cu at\u00e2t mai repede trece prin firewallul chinezesc.<\/li>\n<\/ul>\n<p><\/p>\n<p>Iat\u0103 ce am reu\u0219it s\u0103 afl\u0103m despre aceste zvonuri:<\/p>\n<p><\/p>\n<ul>\n<li>Google, Facebook, Twitter \u0219i alte servicii similare sunt \u00eentr-adev\u0103r blocate (KO-ul dvs.), dar multe domenii tehnice ale Google, de exemplu, nu sunt blocate \u0219i func\u021bioneaz\u0103 (acela\u0219i gstatic.com). Prin urmare, concluzia este: nu trebuie s\u0103 elimina\u021bi f\u0103r\u0103 discern\u0103m\u00e2nt toate resursele Google \u0219i altele care par a fi blocate.<\/li>\n<li>Orice trafic care traverseaz\u0103 grani\u021ba adaug\u0103 cu adev\u0103rat un delay considerabil. Uita\u021bi-v\u0103 la cele dou\u0103 rezultate. O singur\u0103 pagin\u0103, un singur site, un simplu GET <em>curl<\/em>\u2019. Prima m\u0103surare este din China (frumos ora\u0219 Shenzhen). A doua m\u0103surare este din exterior, din Hong Kong (are suveranitate, iar \u00eentre el \u0219i lume nu exist\u0103 un firewall). Distan\u021ba dintre ora\u0219e pe o linie dreapt\u0103 este de aproximativ 30-40 km.<\/li>\n<\/ul>\n<p><\/p>\n<pre><code class=\"bash\">nikita@china-shenzhen:~# curl -o \/dev\/null -w@curl_time \"https:\/\/www.semrush.com\/info\/ebay.com\"\n  % Total    % Received % Xferd  Average Speed   Time    Time     Time  Current\n                                 Dload  Upload   Total   Spent    Left  Speed\n100  381k    0  381k    0     0  71824      0 --:--:--  0:00:05 --:--:-- 82832\ntime_namelookup:  0.004500\ntime_connect:  0.169342\ntime_appconnect:  0.723189\ntime_pretransfer:  0.723499\ntime_redirect:  0.000000\ntime_starttransfer:  1.532912\n----------\ntime_total:  5.443407\n----------\nsize_download:  390968 Bytes\nspeed_download:  71824.000B\/s\n\nnikita@china-hongkong:~# curl -o \/dev\/null -w@curl_time \"https:\/\/www.semrush.com\/info\/ebay.com\"\n  % Total    % Received % Xferd  Average Speed   Time    Time     Time  Current\n                                 Dload  Upload   Total   Spent    Left  Speed\n100  319k    0  319k    0     0  2555k      0 --:--:-- --:--:-- --:--:-- 2573k\ntime_namelookup:  0.029366\ntime_connect:  0.030742\ntime_appconnect:  0.047310\ntime_pretransfer:  0.047388\ntime_redirect:  0.000000\ntime_starttransfer:  0.120793\n----------\ntime_total:  0.124871\n----------\nsize_download:  326755 Bytes\nspeed_download:  2616740.000B\/s<\/code><\/pre>\n<p><\/p>\n<p>Re\u021bine\u021bi c\u0103 <strong>time_connect<\/strong>. \u0218i \u00een general, observa\u021bi rezultatul: firewall-ul adaug\u0103 4 secunde suplimentare, ceea ce este extrem de lung.<\/p>\n<p><\/p>\n<ul>\n<li>VPN-urile \u0219i tunelurile IPSEC cad adesea. Voi discuta despre acest subiect \u00een detaliu mai t\u00e2rziu. Serverele VPN utilizate de utilizatori sunt blocate \u00een timp (de obicei, \u00een termen de 24 de ore de la \u00eenceputul utiliz\u0103rii). <\/li>\n<li>Exist\u0103 o opinie din partea celor care locuiesc \u00een China, conform c\u0103reia cu c\u00e2t criptarea traficului este mai simpl\u0103, cu at\u00e2t trece mai repede grani\u021ba, deoarece este u\u0219or de \u00een\u021beles c\u0103 \u00een ea nu exist\u0103 nimic ilegal. De asemenea, traficul \"curat\" prime\u0219te mai mult\u0103 l\u0103\u021bime de band\u0103 \u0219i vitez\u0103 de trecere, \u00een timp ce traficul \"murdar\", \u00een care nu se poate decifra nimic, are parte de un parcurs mai lent. Ca exemplu, voi prezenta curl c\u0103tre <em>ifconfig.co<\/em> prin protocolul HTTPS \u0219i HTTP. <\/li>\n<\/ul>\n<p><\/p>\n<pre><code class=\"bash\">curl -o \/dev\/null -w@curl_time \"https:\/\/ifconfig.co\/\"\n  % Total    % Received % Xferd  Average Speed   Time    Time     Time  Current\n                                 Dload  Upload   Total   Spent    Left  Speed\n100    13  100    13    0     0      2      0  0:00:06  0:00:05  0:00:01     3\ntime_namelookup:  0.004305\ntime_connect:  0.397465\ntime_appconnect:  5.149305\ntime_pretransfer:  5.149393\ntime_redirect:  0.000000\ntime_starttransfer:  5.568847\n----------\ntime_total:  5.568893\n----------\nsize_download:  13 Bytes\nspeed_download:  2.000B\/s\n\ncurl -o \/dev\/null -w@curl_time \"http:\/\/ifconfig.co\/\"\n  % Total    % Received % Xferd  Average Speed   Time    Time     Time  Current\n                                 Dload  Upload   Total   Spent    Left  Speed\n100    13  100    13    0     0     28      0 --:--:-- --:--:-- --:--:--    28\ntime_namelookup:  0.004282\ntime_connect:  0.212457\ntime_appconnect:  0.000000\ntime_pretransfer:  0.212484\ntime_redirect:  0.000000\ntime_starttransfer:  0.450565\n----------\ntime_total:  0.450620\n----------\nsize_download:  13 Bytes\nspeed_download:  28.000B\/s<\/code><\/pre>\n<p><\/p>\n<p>Diferen\u021ba de 5 secunde pentru timpul total de \u00eenc\u0103rcare a 13 bytes. De asemenea, f\u0103c\u00e2nd acest test de mai multe ori, se poate observa c\u0103 GET pe HTTP se finalizeaz\u0103 \u00eentr-un timp relativ constant, pe c\u00e2nd pe HTTPS, site-ul r\u0103spunde uneori \u00een 3, 5, 10 \u0219i chiar 17 secunde. Uneori apar erori SSL:<\/p>\n<p><\/p>\n<p><code>Eroare necunoscut\u0103 a protocolului SSL \u00een conexiunea cu ifconfig.co:443.<\/code><\/p>\n<p><\/p>\n<p>A\u0219adar, ce avem:<\/p>\n<p><\/p>\n<ul>\n<li>Problemele create de firewall-ul chinez, descrise mai sus.<\/li>\n<li>Pings c\u0103tre resurse externe \u0219i \u00een interiorul tuneluri dispar periodic.<\/li>\n<li>Latenta \u00eentre dou\u0103 puncte variaz\u0103 constant \u0219i adesea este pur \u0219i simplu imprevizibil\u0103. Conect\u00e2nd diferite ora\u0219e\/regiuni, te a\u0219tep\u021bi ca, av\u00e2nd \u00een vedere loca\u021bia geografic\u0103 a regiunilor, latenta s\u0103 fie mai mic\u0103, dar ob\u021bii exact opusul. <\/li>\n<li>Internetul \u0219i canalele de comunica\u021bie func\u021bioneaz\u0103 pe r\u00e2nd rapid \u0219i lent. Exist\u0103 o mic\u0103 dependen\u021b\u0103 de ora din zi \u0219i de ziua s\u0103pt\u0103m\u00e2nii, dar nu \u00eentotdeauna.<\/li>\n<li>DNS-urile externe din China dep\u0103\u0219esc uneori timeout-ul acceptabil.<\/li>\n<\/ul>\n<p><\/p>\n<p>Imaginea se contureaz\u0103 ca fiind \u201eexcelent\u0103\u201d. <\/p>\n<p><\/p>\n<p>Datacenterul, dup\u0103 cum am men\u021bionat, se afl\u0103 \u00een estul Statelor Unite, iar tot SEMrush este format din zeci de produse interconectate, backend-uri, frontend-uri, baze de date, \u0219i totul se afl\u0103 \u00een datacenter \u0219i \u00een cloud. Ca echip\u0103 de administratori de sistem, ne-a fost stabilit\u0103 sarcina de a \u00eencepe rapid activitatea \u00een China cu eforturi minime.<\/p>\n<p><\/p>\n<p>Trebuia s\u0103 r\u0103spundem la o \u00eentrebare important\u0103: putem s\u0103 economisim resurse \u0219i s\u0103 rezolv\u0103m toate problemele legate de internetul \u0219i firewall-ul chinez la nivel de re\u021bea\/cloud\/servere?<\/p>\n<p><\/p>\n<p>Am \u00eenceput cu ob\u021binerea <noindex><a rel=\"nofollow\" href=\"https:\/\/ru.wikipedia.org\/wiki\/%D0%9B%D0%B8%D1%86%D0%B5%D0%BD%D0%B7%D0%B8%D1%8F_ICP\"><strong>licen\u021bei ICP<\/strong>-licen\u021bei<\/a><\/noindex>.<\/p>\n<p><\/p>\n<h2 id=\"icp-licenziya\">licen\u021ba ICP<\/h2>\n<p><\/p>\n<p>Pentru a putea s\u0103 \u00ee\u021bi g\u0103zduie\u0219ti serviciul \u00een interiorul Chinei (Mainland China) \u0219i s\u0103 efectuezi teste, trebuie mai \u00eent\u00e2i s\u0103 ob\u021bii licen\u021ba ICP pentru domeniu.<\/p>\n<p><\/p>\n<p>Dac\u0103 traficul utilizatorului de pe site-ul dvs. este terminat \u00een Mainland China \u0219i dac\u0103 domeniul dvs. nu are o licen\u021b\u0103 ICP, traficul va fi blocat de c\u0103tre furnizorul de servicii de internet\/g\u0103zduire. Interesant este c\u0103 licen\u021ba ICP este legat\u0103 de un anumit furnizor, fie acesta Cloudflare sau Alibaba Cloud. Prin urmare, dac\u0103 a\u021bi ob\u021binut o licen\u021b\u0103 ICP pentru Cloudflare \u0219i v-a\u021bi g\u0103zduit site-ul la ei, ulterior nu ve\u021bi putea s\u0103 migra\u021bi \u201ef\u0103r\u0103 \u00eentreruperi\u201d pe Alibaba Cloud. Va trebui s\u0103 ad\u0103uga\u021bi un alt furnizor de g\u0103zduire la aceast\u0103 licen\u021b\u0103.<\/p>\n<p><\/p>\n<p>Dup\u0103 ob\u021binerea licen\u021bei ICP pentru domeniu, am putut s\u0103 venim cu solu\u021bii \u0219i idei tehnice specifice.<\/p>\n<p><\/p>\n<h2 id=\"testirovanie-resheniy\">Testarea solu\u021biilor<\/h2>\n<p><\/p>\n<p>Dar \u00eenainte de a crea efectiv variantele de staging, de a regla set\u0103rile, de a optimiza func\u021bionarea site-ului \u0219i viteza acestuia, trebuie s\u0103 alegem un instrument pentru testare, pentru a vedea care dintre ac\u021biunile noastre \u00eembun\u0103t\u0103\u021besc sau, dimpotriv\u0103, afecteaz\u0103 negativ func\u021bionarea site-ului.<\/p>\n<p><\/p>\n<p>Instrumentul nostru de testare trebuie s\u0103 \u00eendeplineasc\u0103 dou\u0103 cerin\u021be principale:<\/p>\n<p><\/p>\n<ul>\n<li>trebuie s\u0103 aib\u0103 capacitatea de a rula teste din China,<\/li>\n<li>trebuie s\u0103 aib\u0103 teste \u00een browsere.<\/li>\n<\/ul>\n<p><\/p>\n<p>Astfel, am g\u0103sit <noindex><a rel=\"nofollow\" href=\"https:\/\/www.catchpoint.com\/\">Catchpoint<\/a><\/noindex>! Au o acoperire excelent\u0103 cu puncte de testare \u00een \u00eentreaga lume. \u00cen China, prin acest instrument se pot rula teste \u0219i din 100500 de provincii. \u00cen fiecare exist\u0103 mai mul\u021bi furnizori diferi\u021bi + posibilitatea de a efectua <strong>teste Backbone (ceva de genul unei ma\u0219ini virtuale \u00een centru de date) \u0219i<\/strong>teste Lastmile (foarte apropiate de condi\u021biile utilizatorilor, adic\u0103 sta\u021bie de lucru). Ultimul tip de teste este mai costisitor. <strong>Dup\u0103 \u00eencheierea unui contract anual (nu se poate mai pu\u021bin), am \u00eenceput s\u0103 studiem instrumentul. Trebuie s\u0103 recunoa\u0219tem c\u0103 am fost pl\u0103cut surprin\u0219i de func\u021bionalitatea sa. Se pot rula:<\/strong>teste DNS,<\/p>\n<p><\/p>\n<p>teste Web (\u00een browsere, simple GET\/POST, simularea unui client mobil etc.),<\/p>\n<p><\/p>\n<ul>\n<li>verific\u0103ri tranzac\u021bionale (de exemplu, autentificare),<\/li>\n<li>teste API,<\/li>\n<li>Ping, traceroute, NTP etc.<\/li>\n<li>Nu se pot enumera toate. \u0218i ceea ce este cel mai important, fiecare test poate fi personalizat destul de bine, ad\u0103ug\u00e2nd un set de antete \u0219i alte parametri. La final, se ob\u021bine o cantitate imens\u0103 de informa\u021bii, descriind pe deplin testul dumneavoastr\u0103. Dac\u0103 vorbim despre ceea ce este cel mai interesant pentru noi (teste \u00een browsere), rezultatul include:<\/li>\n<li>Connect, Wait, Load, SSL, DNS time,<\/li>\n<\/ul>\n<p><\/p>\n<p>TTFB, TTLB, Document complete, Render time, DOM load,<\/p>\n<p><\/p>\n<ul>\n<li>Response (ceva apropiat de Time To First Byte), Webpage Response (ceva apropiat de Time To Last Byte),<\/li>\n<li>Orice percentil\u0103, Timp mediu, Timp median<\/li>\n<li>\u0218i a\u0219a mai departe.<\/li>\n<li>Orice percentil, medie, median\u0103 de timp<\/li>\n<li>\u0218i altele<\/li>\n<\/ul>\n<p><\/p>\n<p>Prin urmare, toate aceste metrici ajut\u0103 excelent la observarea schimb\u0103rilor \u0219i \u00een\u021belegerea dac\u0103 s-au \u00eembun\u0103t\u0103\u021bit lucrurile. Ne-am concentrat \u00een principal pe <strong>Response, Webpage Response, Median, 75 \u0219i 95 Percentile<\/strong>. <\/p>\n<p><\/p>\n<p>O \u00eentrebare important\u0103 care a plutesc \u00een aer de la \u00eenceput: <strong>dar poate fi de \u00eencredere Catchpoint<\/strong>? \u041e\u0442\u0440\u0430\u0436\u0430\u0435\u0442 \u043b\u0438 \u044d\u0442\u043e\u0442 \u0438\u043d\u0441\u0442\u0440\u0443\u043c\u0435\u043d\u0442 \u0440\u0435\u0430\u043b\u044c\u043d\u0443\u044e \u0441\u043a\u043e\u0440\u043e\u0441\u0442\u044c \u0437\u0430\u0433\u0440\u0443\u0437\u043a\u0438 \u0441\u0430\u0439\u0442\u0430 \u0432 \u041a\u0438\u0442\u0430\u0435 \u0438\u0437 \u0440\u0430\u0437\u043d\u044b\u0445 \u0433\u043e\u0440\u043e\u0434\u043e\u0432 \u0438\u043b\u0438 \u0436\u0435 \u044d\u0442\u043e \u043f\u0440\u043e\u0441\u0442\u043e \u043a\u0430\u043a\u043e\u0439-\u0442\u043e \u0442\u0435\u0441\u0442 \u0432 \u0432\u0430\u043a\u0443\u0443\u043c\u0435, \u043d\u0435 \u0438\u043c\u0435\u044e\u0449\u0438\u0439 \u043d\u0438\u0447\u0435\u0433\u043e \u043e\u0431\u0449\u0435\u0433\u043e \u0441 real user experience?<br \/>\nEste o problem\u0103 mare, deoarece fiind \u00een Rusia este practic imposibil s\u0103 afli cu certitudine cum func\u021bioneaz\u0103 un site din China. Folosind un socks-proxy printr-o ma\u0219in\u0103 virtual\u0103, ob\u021bii o \u00eenc\u0103rcare a site-ului \u00een c\u00e2teva minute, ceea ce este inacceptabil pentru teste, astfel c\u0103 singura op\u021biune pentru testarea manual\u0103 r\u0103m\u00e2ne curl \u0219i simple GET din consol\u0103 cu m\u0103surarea timpului. Acest lucru ajut\u0103, deoarece acest test reflect\u0103 bine viteza solu\u021biei de re\u021bea, iar dac\u0103 exist\u0103 \u0219i teste \u00een browser, devine \u0219i mai bine.<\/p>\n<p><\/p>\n<p>Ulterior, am c\u0103l\u0103torit \u00een China \u0219i ne-am convins c\u0103 <strong>se poate avea \u00eencredere \u00een Catchpoint, el reflect\u0103 destul de precis indicatorii reali de vitez\u0103.<\/strong><\/p>\n<p><\/p>\n<h2 id=\"cloudflare-china-network\">Cloudflare China Network<\/h2>\n<p><\/p>\n<p>Din moment ce pentru domeniul principal semrush.com folosim cu succes Cloudflare, am decis s\u0103 \u00eencerc\u0103m imediat func\u021bia lor numit\u0103 <noindex><a rel=\"nofollow\" href=\"https:\/\/www.cloudflare.com\/network\/china\/\">China Network<\/a><\/noindex>. Aceast\u0103 op\u021biune se activeaz\u0103 doar pentru site-urile Enterprise, la cerere separat\u0103 \u0219i contra unui cost suplimentar. De asemenea, este disponibil\u0103 doar pentru site-urile care au o licen\u021b\u0103 ICP corespunz\u0103toare, \u00een care este specificat Cloudflare ca furnizor. Dup\u0103 activare, site-ul beneficiaz\u0103 de \"CDN chinezesc\" de la Cloudflare \u2014 traficul din regiunile chineze ajunge la cel mai apropiat PoP (Punct de Prezen\u021b\u0103) CF, iar apoi este livrat prin re\u021belele sale sau re\u021belele providerilor\/partenerilor p\u00e2n\u0103 la origine. <\/p>\n<p><\/p>\n<p>Schema acestui stand de test este prezentat\u0103 mai jos.<\/p>\n<p><\/p>\n<p>Pentru noi, acesta este o op\u021biune excelent\u0103. A\u0219adar, al doilea domeniu va fi, de asemenea, sub CF, ceea ce nu adaug\u0103 la num\u0103rul solu\u021biilor utilizate \u00een companie, precum \u0219i nu complic\u0103 practic infrastructura.<\/p>\n<p><\/p>\n<p>Am ini\u021biat teste \u00een browser \u0219i iat\u0103 ce a rezultat:<\/p>\n<p><\/p>\n<p>Rombergile ro\u0219ii reprezint\u0103 e\u0219ecurile testelor. E\u0219ecurile de jos \u2014 erori DNS (timeout la rezolvare). E\u0219ecurile de sus \u2014 timeout-uri.<\/p>\n<p><\/p>\n<p><em>Uptime: 86.6<br \/>\nMedian: 18s<br \/>\n75 Percentile: 29.3s<br \/>\n95 Percentile: 60s<\/em><\/p>\n<p><\/p>\n<p>Mediana, dup\u0103 ce am eliminat \u00eenc\u0103rcarea <em>reCaptcha<\/em> (serviciul Google, blocat \u00een China), a sc\u0103zut de la 28 la 18 secunde. Dar, totu\u0219i, sunt indicatori teribili, av\u00e2nd \u00een vedere c\u0103 acela\u0219i test pentru semrush.com (din SUA) a livrat mai pu\u021bin de 10 secunde pentru 95% din utilizatori (din SUA) pe aceea\u0219i pagin\u0103 (static\u0103 + dinamic\u0103).<\/p>\n<p><\/p>\n<p>\u00cen fiecare test po\u021bi intra \u0219i viziona <em>Waterfall<\/em> \u0219i alte informa\u021bii detaliate. Am \u00eenceput s\u0103 investig\u0103m cauzele erorilor, \u0219i dac\u0103 pentru timpii de a\u0219teptare totul este mai mult sau mai pu\u021bin clar: internetul din China \u201ese leag\u0103, apoi se deconecteaz\u0103\u201d, din aceast\u0103 cauz\u0103 viteza de conectare \u0219i \u00eenc\u0103rcarea resurselor din str\u0103in\u0103tate este instabil\u0103 \u0219i variabil\u0103, atunci erorile DNS ne-au surprins profund. Am descoperit c\u0103 <em>PoP<\/em> la Cloudflare se afl\u0103 cu adev\u0103rat \u00een China, adresa site-ului este rezolvat\u0103 \u00eentr-un IP anycast, dar serverele DNS folosite sunt americane, motiv pentru care cererile DNS trebuie s\u0103 treac\u0103 prin grani\u021b\u0103, de aceea uneori acestea e\u0219ueaz\u0103.<\/p>\n<p><\/p>\n<p>Dup\u0103 ce am clarificat aceast\u0103 problem\u0103 cu CF, am aflat c\u0103 <strong>nu au propriile servere DNS \u00een China<\/strong>, iar c\u00e2nd vor avea \u2013 este \u00eenc\u0103 necunoscut.<\/p>\n<p><\/p>\n<p>Prin urmare, am decis s\u0103 test\u0103m doar DNS Cloudflare \u0219i am schimbat mecanismul de operare Cloudflare pentru site-ul nostru \u00een modul \u201e<strong>Doar DNS<\/strong>\u201d. Acest mod este cel \u00een care Cloudflare nu proxy-eaz\u0103 traficul, ceea ce \u00eenseamn\u0103 c\u0103 nu ofer\u0103 protec\u021bie DDoS, CDN \u0219i alte func\u021bii, \u0219i func\u021bioneaz\u0103 ca un server DNS obi\u0219nuit. <\/p>\n<p><\/p>\n<p>Aceast\u0103 configura\u021bie este prezentat\u0103 schematic \u00een imaginea urm\u0103toare. \u00cen imagine sunt luate \u00een considerare cuno\u0219tin\u021bele ap\u0103rute cu privire la faptul c\u0103 serverele DNS Cloudflare sunt \u00een spatele unui firewall.<\/p>\n<p><\/p>\n<p>\u00cen Catchpoint, am executat teste GET simple (nu \u00een browser), care au ar\u0103tat foarte multe erori. Cauza acestora au fost acelea\u0219i erori DNS.<\/p>\n<p><\/p>\n<p>Am \u00eenceput s\u0103 depan\u0103m aceste erori cu ajutorul <em>dig<\/em> \u0219i am descoperit c\u0103 la prima cerere adresa este determinat\u0103 corect, iar la cererea repetat\u0103 primim de fiecare dat\u0103 <em>SERVFAIL<\/em> \u0219i <em>not found<\/em>. De ce a ap\u0103rut asta?<\/p>\n<p><\/p>\n<pre><code class=\"bash\">root@iZwz97n2wgbp61qucbfrjsZ:~# host semrushchina.cn\nsemrushchina.cn are adres\u0103 220.170.186.192\nHost semrushchina.cn not found: 2(SERVFAIL)\nroot@iZwz97n2wgbp61qucbfrjsZ:~# host semrushchina.cn\nsemrushchina.cn are adres\u0103 220.170.186.192\nHost semrushchina.cn not found: 2(SERVFAIL)\nroot@iZwz97n2wgbp61qucbfrjsZ:~# host semrushchina.cn\nsemrushchina.cn are adres\u0103 220.170.186.192\nHost semrushchina.cn not found: 2(SERVFAIL)\nroot@iZwz97n2wgbp61qucbfrjsZ:~# host semrushchina.cn\nsemrushchina.cn are adres\u0103 220.170.186.192\nHost semrushchina.cn not found: 2(SERVFAIL)<\/code><\/pre>\n<p><\/p>\n<p>La cererea serverelor NS Cloudflare direct, astfel de erori nu exist\u0103:<\/p>\n<p><\/p>\n<pre><code class=\"bash\">root@iZwz97n2wgbp61qucbfrjsZ:~# for i in `seq 1 2`; do host semrushchina.cn ray.ns.cloudflare.com.; done\nFolosind serverul de domeniu:\nNume: ray.ns.cloudflare.com.\nAdres\u0103: 173.245.59.138#53\nAliasuri:\n\nsemrushchina.cn are adres\u0103 220.170.186.192\nsemrushchina.cn are adres\u0103 220.170.186.192\nFolosind serverul de domeniu:\nNume: ray.ns.cloudflare.com.\nAdres\u0103: 173.245.59.138#53\nAliasuri:\n\nsemrushchina.cn are adres\u0103 220.170.186.192\nsemrushchina.cn are adres\u0103 220.170.186.192<\/code><\/pre>\n<p><\/p>\n<p>Deci, problema este de partea serverului DNS \u201elocal\u201d sau a serverului furnizorului.<br \/>\nO investiga\u021bie ulterioar\u0103 a ar\u0103tat c\u0103 <em>SERVFAIL<\/em> ob\u021binem la rezolvare <em>AAAA<\/em>-\u00eenregistr\u0103ri. <\/p>\n<p><\/p>\n<p>Se pare c\u0103 la cererea de la Cloudflare <em>AAAA<\/em>-\u00eenregistrare, care nu exist\u0103 \u00een domeniu, Cloudflare a r\u0103spuns <em>Un<\/em>-\u00eenregistrare, ceea ce reprezint\u0103 o eroare \u0219i o inconformitate cu RFC. Din acest motiv, rezolvatorul local (<em>x.x.x.x<\/em>) nu a fost mul\u021bumit \u0219i a r\u0103spuns <em>SERVFAIL<\/em>. \u00cen jurnalul de mai jos, acest comportament este clar vizibil:<\/p>\n<p><\/p>\n<pre><code class=\"bash\">root@iZwz97n2wgbp61qucbfrjsZ:~# dig -t AAAA semrushchina.cn @x.x.x.x\n\n; &lt;&gt; DiG 9.10.3-P4-Ubuntu &lt;&gt; -t AAAA semrushchina.cn @x.x.x.x\n;; op\u021biuni globale: +cmd\n;; Am primit r\u0103spuns:\n;; -&gt;&gt;HEADER&lt;&lt;- opcode: QUERY, status: SERVFAIL, id: 55467\n;; steaguri: qr rd ra; \u00ceNTREBARE: 1, R\u0102SPUNS: 0, AUTORITATE: 0, ADI\u021aIONAL: 1\n\n;; SEC\u021aIUNE PSEUDOOPT:\n; EDNS: versiune: 0, steaguri:; udp: 4096\n;; SEC\u021aIUNE \u00ceNTREBARE:\n;semrushchina.cn.               IN      AAAA\n\n;; Timp de interogare: 334 msec\n;; SERVER: x.x.x.x#53(x.x.x.x)\n;; C\u00c2ND: Mar Aug 14 23:38:50 CST 2018\n;; DIMENSIUNE MSG  primit: 44\n\nroot@iZwz97n2wgbp61qucbfrjsZ:~# dig -t AAAA semrushchina.cn @dana.ns.cloudflare.com.\n\n; &lt;&gt; DiG 9.10.3-P4-Ubuntu &lt;&gt; -t AAAA semrushchina.cn @dana.ns.cloudflare.com.\n;; op\u021biuni globale: +cmd\n;; Am primit r\u0103spuns:\n;; -&gt;&gt;HEADER&lt;&lt;- opcode: QUERY, status: NOERROR, id: 63944\n;; steaguri: qr aa rd; \u00ceNTREBARE: 1, R\u0102SPUNS: 1, AUTORITATE: 0, ADI\u021aIONAL: 1\n;; AVERTISMENT: recursiune solicitat\u0103, dar nu disponibil\u0103\n\n;; SEC\u021aIUNE PSEUDOOPT:\n; EDNS: versiune: 0, steaguri:; udp: 512\n;; SEC\u021aIUNE \u00ceNTREBARE:\n;semrushchina.cn.               IN      AAAA\n\n;; SEC\u021aIUNE R\u0102SPUNS:\nsemrushchina.cn.        300     IN      A       220.170.186.192\n\n;; Timp de interogare: 185 msec\n;; SERVER: 173.245.58.105#53(173.245.58.105)\n;; C\u00c2ND: Mar Aug 14 23:43:03 CST 2018\n;; DIMENSIUNE MSG  primit: 60\n<\/code><\/pre>\n<p><\/p>\n<p>Am trimis un raport de bug c\u0103tre Cloudflare, iar ei l-au rezolvat dup\u0103 o perioad\u0103. A fost interesant: \u00een acest moment, \u00een China nu exist\u0103 \u00eenc\u0103 suport pentru IPv6, astfel \u00eenc\u00e2t Cloudflare nu putea oferi adresa sa IPv6 \u00een r\u0103spunsul la solicitare <em>AAAA<\/em>-\u00eenregistrare. \u00cen final, totul s-a rezolvat astfel \u00eenc\u00e2t pentru China, Cloudflare a \u00eenceput s\u0103 r\u0103spund\u0103 <em>NODATA<\/em> la astfel de solicit\u0103ri.<\/p>\n<p><\/p>\n<p>Astfel, erorile DNS \u00een testele Catchpoint s-au redus brusc, dar nu au disp\u0103rut complet. Ceasurile de timeout nu au disp\u0103rut nici ele:<\/p>\n<p><\/p>\n<p>\u0218i am \u00eenceput s\u0103 c\u0103ut\u0103m o alt\u0103 solu\u021bie. <\/p>\n<p><\/p>\n<p>\u00cen partea urm\u0103toare voi povesti cum am testat cloudul chinezesc <strong>Alibaba Cloud<\/strong>, cum ajutorul unei mici &#171;magii&#187; Nginx am reu\u0219it s\u0103 cre\u0103m rapid PoC (Dovada conceptului) pentru solu\u021bii, cum am dezvoltat solu\u021bii Multi-Cloud, una dintre ele contribuind foarte mult la accelerarea func\u021bion\u0103rii serviciului din China.<\/p>\n<p><\/p>\n<p><strong>R\u0103m\u00e2ne\u021bi conecta\u021bi!<\/strong><\/p>\n<p><\/p>\n<h3 id=\"sleduyuschie-chasti\">Par\u021bile urm\u0103toare<\/h3>\n<p><\/p>\n<p><noindex><a rel=\"nofollow\" href=\"https:\/\/habr.com\/ru\/company\/semrush\/blog\/458840\/\">Partea 2<\/a><\/noindex><\/p>\n<p>Sursa: <a content=\"nofollow\" rel=\"nofollow\" href=\"https:\/\/habr.com\/ru\/company\/semrush\/blog\/458602\/\">habr.com<\/a><\/p>","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"excerpt":{"rendered":"<p>\u0412\u0441\u0435\u043c \u043f\u0440\u0438\u0432\u0435\u0442! \u041d\u0430 \u0441\u0432\u044f\u0437\u0438 \u041d\u0438\u043a\u0438\u0442\u0430 \u2014 \u0441\u0438\u0441\u0442\u0435\u043c\u043d\u044b\u0439 \u0438\u043d\u0436\u0435\u043d\u0435\u0440 \u0438\u0437 \u043a\u043e\u043c\u043f\u0430\u043d\u0438\u0438 S\u0415Mrush. \u0421\u0435\u0433\u043e\u0434\u043d\u044f \u044f \u0440\u0430\u0441\u0441\u043a\u0430\u0436\u0443 \u0432\u0430\u043c \u043e \u0442\u043e\u043c, \u043a\u0430\u043a \u043f\u0435\u0440\u0435\u0434 \u043d\u0430\u043c\u0438 \u0432\u0441\u0442\u0430\u043b\u0430 \u0437\u0430\u0434\u0430\u0447\u0430 \u043e\u0431\u0435\u0441\u043f\u0435\u0447\u0438\u0442\u044c \u0441\u0442\u0430\u0431\u0438\u043b\u044c\u043d\u043e\u0441\u0442\u044c \u0440\u0430\u0431\u043e\u0442\u044b \u043d\u0430\u0448\u0435\u0433\u043e \u0441\u0435\u0440\u0432\u0438\u0441\u0430 semrush.com \u0432 \u041a\u0438\u0442\u0430\u0435, \u0438 \u0441 \u043a\u0430\u043a\u0438\u043c\u0438 \u043f\u0440\u043e\u0431\u043b\u0435\u043c\u0430\u043c\u0438 \u043c\u044b \u0441\u0442\u043e\u043b\u043a\u043d\u0443\u043b\u0438\u0441\u044c \u0432 \u0445\u043e\u0434\u0435 \u0435\u0435 \u0432\u044b\u043f\u043e\u043b\u043d\u0435\u043d\u0438\u044f (\u0443\u0447\u0438\u0442\u044b\u0432\u0430\u044f \u043c\u0435\u0441\u0442\u043e\u043d\u0430\u0445\u043e\u0436\u0434\u0435\u043d\u0438\u0435 \u043d\u0430\u0448\u0435\u0433\u043e \u0434\u0430\u0442\u0430-\u0446\u0435\u043d\u0442\u0440\u0430 \u043d\u0430 \u0432\u043e\u0441\u0442\u043e\u0447\u043d\u043e\u043c \u043f\u043e\u0431\u0435\u0440\u0435\u0436\u044c\u0435 \u0421\u0428\u0410). \u042d\u0442\u043e \u0431\u0443\u0434\u0435\u0442 \u0431\u043e\u043b\u044c\u0448\u0430\u044f \u0438\u0441\u0442\u043e\u0440\u0438\u044f, \u0440\u0430\u0437\u0431\u0438\u0442\u0430\u044f \u043d\u0430 \u043d\u0435\u0441\u043a\u043e\u043b\u044c\u043a\u043e [&hellip;]<\/p>\n","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"author":1,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[688],"tags":[],"class_list":["post-35939","post","type-post","status-publish","format-standard","hentry","category-administrirovanie"],"aioseo_notices":[],"aioseo_head":"\n\t\t<!-- All in One SEO 5.0.2.1 - aioseo.com -->\n\t<meta name=\"description\" content=\"\u0412\u0441\u0435\u043c \u043f\u0440\u0438\u0432\u0435\u0442! \u041d\u0430 \u0441\u0432\u044f\u0437\u0438 \u041d\u0438\u043a\u0438\u0442\u0430 \u2014 \u0441\u0438\u0441\u0442\u0435\u043c\u043d\u044b\u0439 \u0438\u043d\u0436\u0435\u043d\u0435\u0440 \u0438\u0437 \u043a\u043e\u043c\u043f\u0430\u043d\u0438\u0438 S\u0415Mrush.\" \/>\n\t<meta name=\"robots\" content=\"max-image-preview:large\" \/>\n\t<meta name=\"author\" content=\"Yuri Gagarin\"\/>\n\t<link rel=\"canonical\" href=\"https:\/\/prohoster.info\/ro\/blog\/administrirovanie\/kak-my-probivali-velikij-kitajskij-faervol-ch-1\" \/>\n\t<meta name=\"generator\" content=\"All in One SEO (AIOSEO) 5.0.2.1\" \/>\n\t\t<meta property=\"og:locale\" content=\"ro_RO\" \/>\n\t\t<meta property=\"og:site_name\" content=\"ProHoster | \u041a\u0443\u043f\u0438\u0442\u044c \u043d\u0430\u0434\u0435\u0436\u043d\u044b\u0439 \u0445\u043e\u0441\u0442\u0438\u043d\u0433 \u0434\u043b\u044f \u0441\u0430\u0439\u0442\u043e\u0432 \u0441 \u0437\u0430\u0449\u0438\u0442\u043e\u0439 \u043e\u0442 DDoS, VPS VDS \u0441\u0435\u0440\u0432\u0435\u0440\u044b\" \/>\n\t\t<meta property=\"og:type\" content=\"article\" \/>\n\t\t<meta property=\"og:title\" content=\"\ud83e\udd47\u041a\u0430\u043a \u043c\u044b \u043f\u0440\u043e\u0431\u0438\u0432\u0430\u043b\u0438 \u0412\u0435\u043b\u0438\u043a\u0438\u0439 \u041a\u0438\u0442\u0430\u0439\u0441\u043a\u0438\u0439 \u0424\u0430\u0435\u0440\u0432\u043e\u043b (\u0447.1) | ProHoster\" \/>\n\t\t<meta property=\"og:description\" content=\"\u0412\u0441\u0435\u043c \u043f\u0440\u0438\u0432\u0435\u0442! \u041d\u0430 \u0441\u0432\u044f\u0437\u0438 \u041d\u0438\u043a\u0438\u0442\u0430 \u2014 \u0441\u0438\u0441\u0442\u0435\u043c\u043d\u044b\u0439 \u0438\u043d\u0436\u0435\u043d\u0435\u0440 \u0438\u0437 \u043a\u043e\u043c\u043f\u0430\u043d\u0438\u0438 S\u0415Mrush.\" \/>\n\t\t<meta property=\"og:url\" content=\"https:\/\/prohoster.info\/ro\/blog\/administrirovanie\/kak-my-probivali-velikij-kitajskij-faervol-ch-1\" \/>\n\t\t<meta property=\"og:image\" content=\"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg\" \/>\n\t\t<meta property=\"og:image:secure_url\" content=\"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg\" \/>\n\t\t<meta property=\"og:image:width\" content=\"350\" \/>\n\t\t<meta property=\"og:image:height\" content=\"350\" \/>\n\t\t<meta property=\"article:published_time\" content=\"2019-10-31T19:07:41+00:00\" \/>\n\t\t<meta property=\"article:modified_time\" content=\"2019-10-31T19:07:41+00:00\" \/>\n\t\t<meta property=\"article:publisher\" content=\"https:\/\/www.facebook.com\/prohoster\" \/>\n\t\t<meta property=\"article:author\" content=\"https:\/\/www.facebook.com\/prohoster\" \/>\n\t\t<!-- All in One SEO -->\n\n","aioseo_head_json":{"title":"\ud83e\udd47Cum am dep\u0103\u0219it Marele Firewall Chinezesc (partea 1) | ProHoster","description":"Salut tuturor! Eu sunt Nikita \u2014 inginer sistem din cadrul companiei SEMrush.","canonical_url":"https:\/\/prohoster.info\/ro\/blog\/administrirovanie\/kak-my-probivali-velikij-kitajskij-faervol-ch-1","robots":"max-image-preview:large","keywords":"","webmasterTools":{"miscellaneous":""},"schema":null,"og:locale":"ro_RO","og:site_name":"ProHoster | \u041a\u0443\u043f\u0438\u0442\u044c \u043d\u0430\u0434\u0435\u0436\u043d\u044b\u0439 \u0445\u043e\u0441\u0442\u0438\u043d\u0433 \u0434\u043b\u044f \u0441\u0430\u0439\u0442\u043e\u0432 \u0441 \u0437\u0430\u0449\u0438\u0442\u043e\u0439 \u043e\u0442 DDoS, VPS VDS \u0441\u0435\u0440\u0432\u0435\u0440\u044b","og:type":"article","og:title":"\ud83e\udd47\u041a\u0430\u043a \u043c\u044b \u043f\u0440\u043e\u0431\u0438\u0432\u0430\u043b\u0438 \u0412\u0435\u043b\u0438\u043a\u0438\u0439 \u041a\u0438\u0442\u0430\u0439\u0441\u043a\u0438\u0439 \u0424\u0430\u0435\u0440\u0432\u043e\u043b (\u0447.1) | ProHoster","og:description":"\u0412\u0441\u0435\u043c \u043f\u0440\u0438\u0432\u0435\u0442! \u041d\u0430 \u0441\u0432\u044f\u0437\u0438 \u041d\u0438\u043a\u0438\u0442\u0430 \u2014 \u0441\u0438\u0441\u0442\u0435\u043c\u043d\u044b\u0439 \u0438\u043d\u0436\u0435\u043d\u0435\u0440 \u0438\u0437 \u043a\u043e\u043c\u043f\u0430\u043d\u0438\u0438 S\u0415Mrush.","og:url":"https:\/\/prohoster.info\/ro\/blog\/administrirovanie\/kak-my-probivali-velikij-kitajskij-faervol-ch-1","og:image":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:secure_url":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:width":350,"og:image:height":350,"article:published_time":"2019-10-31T19:07:41+00:00","article:modified_time":"2019-10-31T19:07:41+00:00","article:publisher":"https:\/\/www.facebook.com\/prohoster","article:author":"https:\/\/www.facebook.com\/prohoster"},"aioseo_meta_data":{"post_id":"35939","title":null,"description":null,"keywords":null,"keyphrases":null,"primary_term":null,"canonical_url":null,"og_title":null,"og_description":null,"og_object_type":"default","og_image_type":"default","og_image_url":null,"og_image_width":null,"og_image_height":null,"og_image_custom_url":null,"og_image_custom_fields":null,"og_video":null,"og_custom_url":null,"og_article_section":null,"og_article_tags":null,"twitter_use_og":false,"twitter_card":"default","twitter_image_type":"default","twitter_image_url":null,"twitter_image_custom_url":null,"twitter_image_custom_fields":null,"twitter_title":null,"twitter_description":null,"schema":{"blockGraphs":[],"customGraphs":[],"default":{"data":{"Article":[],"Course":[],"Dataset":[],"FAQPage":[],"Movie":[],"Person":[],"Product":[],"ProductReview":[],"Car":[],"Recipe":[],"Service":[],"SoftwareApplication":[],"WebPage":[]},"graphName":"","isEnabled":true},"graphs":[]},"schema_type":null,"schema_type_options":null,"pillar_content":false,"robots_default":true,"robots_noindex":false,"robots_noarchive":false,"robots_nosnippet":false,"robots_nofollow":false,"robots_noimageindex":false,"robots_noodp":false,"robots_notranslate":false,"robots_max_snippet":null,"robots_max_videopreview":null,"robots_max_imagepreview":"large","priority":null,"frequency":null,"local_seo":null,"seo_analyzer_scan_date":"2026-01-22 01:21:19","breadcrumb_settings":null,"limit_modified_date":false,"reviewed_by":null,"ai":null,"created":"2021-03-01 01:53:31","updated":"2026-01-22 01:21:19","focus_keyword":null,"additional_keywords":null,"truseo_locale":null},"gt_translate_keys":[{"key":"link","format":"url"}],"_links":{"self":[{"href":"https:\/\/prohoster.info\/ro\/wp-json\/wp\/v2\/posts\/35939","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/prohoster.info\/ro\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/prohoster.info\/ro\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/prohoster.info\/ro\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/prohoster.info\/ro\/wp-json\/wp\/v2\/comments?post=35939"}],"version-history":[{"count":0,"href":"https:\/\/prohoster.info\/ro\/wp-json\/wp\/v2\/posts\/35939\/revisions"}],"wp:attachment":[{"href":"https:\/\/prohoster.info\/ro\/wp-json\/wp\/v2\/media?parent=35939"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/prohoster.info\/ro\/wp-json\/wp\/v2\/categories?post=35939"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/prohoster.info\/ro\/wp-json\/wp\/v2\/tags?post=35939"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}