{"id":29814,"date":"2019-10-31T21:32:09","date_gmt":"2019-10-31T18:32:09","guid":{"rendered":"https:\/\/prohoster.info\/blog\/razvyornutyj-otvet-na-kommentarij-a-takzhe-nemnogo-o-zhizni-provajderov-v-rf\/"},"modified":"2019-10-31T21:32:09","modified_gmt":"2019-10-31T18:32:09","slug":"razvyornutyj-otvet-na-kommentarij-a-takzhe-nemnogo-o-zhizni-provajderov-v-rf","status":"publish","type":"post","link":"https:\/\/prohoster.info\/sk\/blog\/razvyornutyj-otvet-na-kommentarij-a-takzhe-nemnogo-o-zhizni-provajderov-v-rf","title":{"rendered":"Roz\u0161\u00edren\u00e1 odpove\u010f na koment\u00e1r, ako aj nie\u010do o \u017eivote poskytovate\u013eov v RF","gt_translate_keys":[{"key":"rendered","format":"text"}]},"content":{"rendered":"<p>In\u0161pirovalo ma to k tomuto pr\u00edspevku <noindex><a rel=\"nofollow\" href=\"https:\/\/habr.com\/ru\/post\/443898\/#comment_19891124\">tento koment\u00e1r<\/a><\/noindex>.<\/p>\n<p>Uv\u00e1dzam ho tu:<\/p>\n<blockquote><p><noindex><a rel=\"nofollow\" href=\"https:\/\/habr.com\/ru\/users\/kaleman\/\" class=\"user_link\">kaleman<\/a><\/noindex> dnes o 18:53<\/p>\n<p>Dnes ma pote\u0161il poskytovate\u013e. Spolu s aktualiz\u00e1ciou syst\u00e9mu blokovania str\u00e1nok sa dostal pod z\u00e1kaz po\u0161tov\u00fd server mail.ru. Od r\u00e1na kontaktujem technick\u00fa podporu, nem\u00f4\u017eu s t\u00fdm ni\u010d urobi\u0165. Poskytovate\u013e je mal\u00fd a zd\u00e1 sa, \u017ee blokuj\u00fa nadriaden\u00ed poskytovatelia. E\u0161te som si v\u0161imol spomalenie na\u010d\u00edtania v\u0161etk\u00fdch str\u00e1nok, mo\u017eno nasadili nejak\u00fd chybn\u00fd DLP? Predt\u00fdm neboli \u017eiadne probl\u00e9my s pr\u00edstupom. Ni\u010denie runetu pokra\u010duje priamo pred mojimi o\u010dami\u2026<\/p><\/blockquote>\n<p> Ide o to, \u017ee sa zd\u00e1, \u017ee sme pr\u00e1ve my ten poskytovate\u013e \ud83d\ude41<\/p>\n<p>A naozaj, <noindex><a rel=\"nofollow\" href=\"https:\/\/habr.com\/ru\/users\/kaleman\/\" class=\"user_link\">kaleman<\/a><\/noindex> takmer sme sa trafili do pr\u00ed\u010diny probl\u00e9mov s mail.ru (aj ke\u010f sme dlho odmietali veri\u0165 v nie\u010do tak\u00e9).<\/p>\n<p>\u010eal\u0161ie bude rozdelen\u00e9 na dve \u010dasti:<\/p>\n<ol>\n<li>pr\u00ed\u010diny na\u0161ich dne\u0161n\u00fdch probl\u00e9mov s mail.ru a fascinuj\u00faci quest po ich h\u013eadan\u00ed<\/li>\n<li>existencia ISP v dne\u0161n\u00fdch re\u00e1li\u00e1ch, stabilita suver\u00e9nneho runetu.<\/li>\n<\/ol>\n<p><noindex><a rel=\"nofollow\" name=\"habracut\"><\/a><\/noindex><\/p>\n<h3>Probl\u00e9my s dostupnos\u0165ou mail.ru<\/h3>\n<p>\nOch, to je dos\u0165 dlh\u00fd pr\u00edbeh. <\/p>\n<p>Ide o to, \u017ee na realiz\u00e1ciu po\u017eiadaviek \u0161t\u00e1tu (podrobnej\u0161ie v druhej \u010dasti) sme zak\u00fapili, nastavili a nain\u0161talovali niektor\u00e9 zariadenia \u2014 ako na filtrovanie zak\u00e1zan\u00fdch zdrojov, tak aj na vykon\u00e1vanie <noindex><a rel=\"nofollow\" href=\"https:\/\/ru.wikipedia.org\/wiki\/NAT\">NAT prekladov<\/a><\/noindex> abonentov.<\/p>\n<p>Pred nejak\u00fdm \u010dasom sme kone\u010dne prebudovali jadro siete tak, aby cel\u00fd traffic abonentov prech\u00e1dzal cez toto zariadenie pr\u00edsne v po\u017eadovanom smere.<\/p>\n<p>Pred nieko\u013ek\u00fdmi d\u0148ami sme na \u0148om zapli filtrovanie zak\u00e1zan\u00e9ho obsahu (s\u00fa\u010dasne sme nechali fungova\u0165 aj star\u00fd syst\u00e9m) \u2014 na poh\u013ead v\u0161etko prebehlo dobre.<\/p>\n<p>\u010ealej \u2014 postupne sme za\u010dali zap\u00edna\u0165 pre r\u00f4zne \u010dasti abonentov NAT na tomto zariaden\u00ed. Na poh\u013ead \u2014 tie\u017e v\u0161etko, zdalo sa, \u017ee i\u0161lo dobre.<\/p>\n<p>Ale dnes, ke\u010f sme na zariaden\u00ed zapli NAT pre \u010fal\u0161iu \u010das\u0165 abonentov \u2014 od r\u00e1na sme sa stretli so zna\u010dn\u00fdm mno\u017estvom s\u0165a\u017enost\u00ed na nedostupnos\u0165 alebo \u010diasto\u010dn\u00fa dostupnos\u0165 <noindex><a rel=\"nofollow\" href=\"https:\/\/mail.ru\">mail.ru<\/a><\/noindex> a in\u00fdch zdrojov Mail Ru Group.<\/p>\n<p>Za\u010dali sme kontrolova\u0165: nie\u010do niekde <i>ob\u010das<\/i>, <i>zriedkavo<\/i> posiela <noindex><a rel=\"nofollow\" href=\"https:\/\/ru.wikipedia.org\/wiki\/%D0%90%D1%82%D0%B0%D0%BA%D0%B0_TCP_Reset\">TCP RST<\/a><\/noindex> v odpovedi na po\u017eiadavky v\u00fdlu\u010dne k sie\u0165am mail.ru. Navy\u0161e \u2014 posiela nespr\u00e1vne generovan\u00e9 (bez ACK), jasne umel\u00e9 TCP RST. Takto to asi vyzeralo:<\/p>\n<p><img decoding=\"async\" alt=\"Roz\u0161\u00edren\u00e1 odpove\u010f na koment\u00e1r, ako aj nie\u010do o \u017eivote poskytovate\u013eov v RF\" src=\"\/wp-content\/uploads\/2019\/03\/2ce762c44e86b97125806a27d91da1f0.jpg\" style=\"display:block;margin: 0 auto;\" \/><br \/>\n<br \/>\n<img decoding=\"async\" alt=\"Roz\u0161\u00edren\u00e1 odpove\u010f na koment\u00e1r, ako aj nie\u010do o \u017eivote poskytovate\u013eov v RF\" src=\"\/wp-content\/uploads\/2019\/03\/c7041cf0ae273666fe9bb36ff236710f.jpg\" style=\"display:block;margin: 0 auto;\" \/><br \/>\n<br \/>\n<img decoding=\"async\" alt=\"Roz\u0161\u00edren\u00e1 odpove\u010f na koment\u00e1r, ako aj nie\u010do o \u017eivote poskytovate\u013eov v RF\" src=\"\/wp-content\/uploads\/2019\/03\/c594ee9e5f1c7127ac849c6b7afcd5d8.jpg\" style=\"display:block;margin: 0 auto;\" \/><br \/>\n<br \/>\nSamozrejme, prv\u00e9 my\u0161lienky sa t\u00fdkali nov\u00e9ho vybavenia: hrozn\u00e9 DPI, ned\u00f4vera k nemu, ve\u010f nikdy neviete, \u010do m\u00f4\u017ee sp\u00f4sobi\u0165 \u2014 ve\u010f TCP RST je pomerne roz\u0161\u00edren\u00e1 z\u00e1le\u017eitos\u0165 medzi blokovac\u00edmi prostriedkami.<\/p>\n<p>Predpoklad <noindex><a rel=\"nofollow\" href=\"https:\/\/habr.com\/ru\/users\/kaleman\/\" class=\"user_link\">kaleman<\/a><\/noindex> o tom, \u017ee niekto \u201evy\u0161\u0161\u00ed\u201c filtruje, sme tie\u017e navrhli \u2014 ale hne\u010f sme to zamietli.<\/p>\n<p>Po prv\u00e9, m\u00e1me dos\u0165 rozumn\u00e9 uplinky, aby sme sa s t\u00fdmto probl\u00e9mom nestretli \ud83d\ude42<\/p>\n<p>Po druh\u00e9, sme pripojen\u00ed na nieko\u013eko <noindex><a rel=\"nofollow\" href=\"https:\/\/ru.wikipedia.org\/wiki\/%D0%A2%D0%BE%D1%87%D0%BA%D0%B0_%D0%BE%D0%B1%D0%BC%D0%B5%D0%BD%D0%B0_%D0%B8%D0%BD%D1%82%D0%B5%D1%80%D0%BD%D0%B5%D1%82-%D1%82%D1%80%D0%B0%D1%84%D0%B8%D0%BA%D0%BE%D0%BC\">IX<\/a><\/noindex> v Moskve, a prev\u00e1dzka do mail.ru ide pr\u00e1ve cez ne \u2014 a oni nemaj\u00fa \u017eiadne povinnosti ani in\u00e9 motivy filtrova\u0165 prev\u00e1dzku.<\/p>\n<p>Nasleduj\u00faca polovica d\u0148a bola str\u00e1ven\u00e1 t\u00fdm, \u010do oby\u010dajne naz\u00fdvaj\u00fa \u0161amanizmom \u2014 spolu s dod\u00e1vate\u013eom vybavenia, za \u010do im \u010fakujeme, sa nevzdali \ud83d\ude42<\/p>\n<ul>\n<li>kompletn\u00e9 odpojenie filtrovania<\/li>\n<li>NAT sa odpojil pod\u013ea nov\u00e9ho sch\u00e9my<\/li>\n<li>testovac\u00ed PC bol umiestnen\u00fd do samostatn\u00e9ho izolovan\u00e9ho poolu<\/li>\n<li>menila sa IP adresa<\/li>\n<\/ul>\n<p>\nV druhej polovici d\u0148a bola vy\u010dlenen\u00e1 virtu\u00e1lka, ktor\u00e1 sa pripojila do siete pod\u013ea sch\u00e9my be\u017en\u00e9ho pou\u017e\u00edvate\u013ea, a t\u00e1to virtu\u00e1lka aj vybavenie dostali pr\u00edstup k z\u00e1stupcom dod\u00e1vate\u013ea. \u0160amanizmus pokra\u010doval \ud83d\ude42<\/p>\n<p>Nakoniec z\u00e1stupca dod\u00e1vate\u013ea s istotou vyhl\u00e1sil, \u017ee zariadenie s t\u00fdm nem\u00e1 ni\u010d spolo\u010dn\u00e9: rst prich\u00e1dzaj\u00fa odkia\u013esi vy\u0161\u0161ie.<\/p>\n<p><b class=\"spoiler_title\">Pozn\u00e1mka<\/b><i>Na tomto mieste m\u00f4\u017ee niekto vyhl\u00e1si\u0165: ale predsa by bolo ove\u013ea jednoduch\u0161ie z\u00edska\u0165 dump nie z testovacieho PC, ale z magistr\u00e1ly nad DPI?<\/p>\n<p>Nie, bohu\u017eia\u013e, z\u00edska\u0165 dump (a dokonca len jednoducho odmirrorova\u0165) 40+gbps \u2014 rozhodne nie je triv\u00e1lne.<\/i><\/p>\n<p>Po tom, u\u017e ve\u010der \u2014 neost\u00e1valo ni\u010d in\u00e9, len sa vr\u00e1ti\u0165 k predpokladu o zvl\u00e1\u0161tnom filtrovan\u00ed niekde vy\u0161\u0161ie.<\/p>\n<p>Pozrel som sa, cez ktor\u00fd IX teraz prech\u00e1dza prev\u00e1dzka do siet\u00ed MRG a jednoducho som zru\u0161il bgp-sessiony. A \u2014 \u00f3 z\u00e1zrak! \u2014 v\u0161etko sa okam\u017eite normalizovalo \ud83d\ude41<\/p>\n<p>Na jednej strane \u2014 ve\u013emi ma mrz\u00ed, \u017ee na h\u013eadanie probl\u00e9mu bol str\u00e1ven\u00fd cel\u00fd de\u0148, hoci sa dal vyrie\u0161i\u0165 za p\u00e4\u0165 min\u00fat.<\/p>\n<p>Na druhej strane:<\/p>\n<p> \u2014 \u010do sa mne pam\u00e4t\u00e1, je to bezprecedentn\u00e1 z\u00e1le\u017eitos\u0165. Ako som u\u017e predt\u00fdm p\u00edsal \u2014 IX-om <i>naozaj<\/i> nem\u00e1 zmysel filtrova\u0165 tranzitn\u00fa prev\u00e1dzku. Zvy\u010dajne maj\u00fa stovky gigabitov \/ terabitov za sekundu. Jednoducho som a\u017e do poslednej chv\u00edle nemohol seri\u00f3zne nie\u010do tak\u00e9 predpoklada\u0165.<\/p>\n<p> \u2014 neuverite\u013en\u00e1 zhodou okolnost\u00ed: nov\u00e9 zlo\u017eit\u00e9 zariadenie, ktor\u00e9mu sa ned\u00e1 obzvl\u00e1\u0161\u0165 d\u00f4verova\u0165 a od ktor\u00e9ho nie je jasn\u00e9, \u010do mo\u017eno o\u010dak\u00e1va\u0165 \u2014 presne navrhnut\u00e9 na blokovanie zdrojov, vr\u00e1tane TCP RST.<\/p>\n<p>V s\u00fa\u010dasnosti NOC tohto internetov\u00e9ho exchange h\u013ead\u00e1 probl\u00e9m. Pod\u013ea ich tvrdenia (a ja im ver\u00edm) nemaj\u00fa \u017eiadny \u0161peci\u00e1lne nasaden\u00fd filtra\u010dn\u00fd syst\u00e9m. Ale, v\u010faka nebu, \u010fal\u0161\u00ed quest - u\u017e nie je na\u0161\u00edm probl\u00e9mom \ud83d\ude42<\/p>\n<p>Bola to mal\u00e1 snaha ospravedlni\u0165 sa, pros\u00edme, pochopte a odpustite \ud83d\ude42<\/p>\n<p>P.S.: \u00damyselne nespom\u00ednam \u017eiadneho v\u00fdrobcu DPI\/NAT, ani IX (vlastne nem\u00e1m vo\u010di nim \u017eiadne osobitn\u00e9 v\u00fdhrady, hlavne - pochopi\u0165, \u010do to bolo)<\/p>\n<h3>Dne\u0161n\u00e1 (a tie\u017e v\u010deraj\u0161ia a predv\u010deraj\u0161ia) realita z poh\u013eadu internetov\u00e9ho poskytovate\u013ea<\/h3>\n<p>\nPosledn\u00e9 t\u00fd\u017edne som str\u00e1vil v\u00fdznamn\u00fdm prestavovan\u00edm jadra siete, pri\u010dom som robil mno\u017estvo manipul\u00e1ci\u00ed \u201ena\u017eivo\u201c, s rizikom silne zasiahnu\u0165 do \u017eiv\u00e9ho pou\u017e\u00edvate\u013esk\u00e9ho trafiku. Zoh\u013ead\u0148uj\u00fac ciele, v\u00fdsledky a d\u00f4sledky v\u0161etk\u00e9ho tohto - mor\u00e1lne je to v\u0161etko celkom \u0165a\u017ek\u00e9. Zvl\u00e1\u0161\u0165 - po\u010d\u00favaj\u00fac po x-t\u00fd kr\u00e1t idealistick\u00e9 re\u010di o ochrane stability runetu, suverenite, at\u010f.<\/p>\n<p>V tejto \u010dasti sa pok\u00fasim prerozpr\u00e1va\u0165 \u201eevol\u00faciu\u201c jadra siete typick\u00e9ho internetov\u00e9ho poskytovate\u013ea za posledn\u00e9 desa\u0165ro\u010die.<\/p>\n<p><b>Pred desa\u0165ro\u010d\u00edm.<\/b><\/p>\n<p>V t\u00fdch po\u017eehnan\u00fdch \u010dasoch mohlo by\u0165 jadro poskytovate\u013eskej siete jednoduch\u00e9 a spo\u013eahliv\u00e9, ako korkov\u00e1 z\u00e1tka:<\/p>\n<p><img decoding=\"async\" alt=\"Roz\u0161\u00edren\u00e1 odpove\u010f na koment\u00e1r, ako aj nie\u010do o \u017eivote poskytovate\u013eov v RF\" src=\"\/wp-content\/uploads\/2019\/03\/06c455b9debf27799451d9f29a12a4a9.jpg\" style=\"display:block;margin: 0 auto;\" \/><br \/>\n<br \/>\nNa tomto ve\u013emi, ve\u013emi zjednodu\u0161enom obr\u00e1zku ch\u00fdbaj\u00fa magistr\u00e1ly, kruhy, ip\/MPLS smerovanie.<\/p>\n<p>Jeho podstata spo\u010d\u00edva v tom, \u017ee pou\u017e\u00edvate\u013esk\u00fd traffic nakoniec prich\u00e1dzal do jadrovej komut\u00e1cie - odkia\u013e sa posielal do <noindex><a rel=\"nofollow\" href=\"https:\/\/en.wikipedia.org\/wiki\/Broadband_remote_access_server\">BNG<\/a><\/noindex>, z ktor\u00fdch sa spravidla \u2014 vracia do yadrovej komut\u00e1cie, a \u010falej \u201ena v\u00fdstup\u201c \u2014 cez jeden alebo viac border gateway's do internetu.<\/p>\n<p>Podobn\u00e9 sch\u00e9my s\u00fa ve\u013emi, ve\u013emi \u013eahko z\u00e1lohovan\u00e9 ako na L3 (dynamick\u00e9 smerovanie), tak aj na L2 (MPLS).<\/p>\n<p>M\u00f4\u017eete nasadi\u0165 N+1 \u010dohoko\u013evek: pr\u00edstupov\u00fdch serverov, prep\u00edna\u010dov, borderov - a tak alebo onak ich z\u00e1lohovanie pre automatick\u00fd failover.<\/p>\n<p><b>O nieko\u013eko rokov<\/b> v\u0161etk\u00fdm v Rusku sa stalo jasn\u00fdm, \u017ee takto sa \u017ei\u0165 ned\u00e1: je potrebn\u00e9 naliehavo chr\u00e1ni\u0165 deti pred zhubn\u00fdm vplyvom siete.<\/p>\n<p>Vznikla naliehav\u00e1 potreba h\u013eada\u0165 sp\u00f4soby, ako filtrova\u0165 pou\u017e\u00edvate\u013esk\u00fd traffic.<\/p>\n<p>Existuj\u00fa r\u00f4zne pr\u00edstupy.<\/p>\n<p>V nie ve\u013emi dobrej situ\u00e1cii - nie\u010do sa nasadzuje \u201enaprie\u010d\u201c: medzi pou\u017e\u00edvate\u013esk\u00fdm trafficom a internetom. Prech\u00e1dzaj\u00faci cez toto \u201enie\u010do\u201c traffic podlieha anal\u00fdze a, napr\u00edklad, smeruje k odberate\u013eovi falo\u0161n\u00fd paket s preposlan\u00edm.<\/p>\n<p>V trochu lep\u0161om pr\u00edpade \u2014 ak objemy prev\u00e1dzky to umo\u017e\u0148uj\u00fa \u2014 je mo\u017en\u00e9 urobi\u0165 mal\u00fd trik: posiela\u0165 na filtrovanie iba od u\u017e\u00edvate\u013eov prev\u00e1dzku len na tie adresy, ktor\u00e9 je potrebn\u00e9 filtrova\u0165 (na tento \u00fa\u010del je mo\u017en\u00e9 bu\u010f vzia\u0165 z registra uveden\u00e9 tam IP adresy, alebo dodato\u010dne resolvova\u0165 existuj\u00face v registri dom\u00e9ny).<\/p>\n<p>V svojom \u010dase som nap\u00edsal jednoduch\u00fd <noindex><a rel=\"nofollow\" href=\"https:\/\/github.com\/ircop\/nfq_filter\">mini-dpi<\/a><\/noindex> \u2014 hoci ani jazyk sa neobracia ho takto naz\u00fdva\u0165. Je ve\u013emi jednoduch\u00fd a nie ve\u013emi v\u00fdkonn\u00fd \u2014 av\u0161ak pre n\u00e1s, ako aj pre desiatky (ak nie stovky) \u010fal\u0161\u00edch poskytovate\u013eov to umo\u017enilo nezaplatit hne\u010f mili\u00f3ny za priemyseln\u00e9 DPI syst\u00e9my a dalo nieko\u013eko \u010fal\u0161\u00edch rokov \u010dasu.<\/p>\n<p><b class=\"spoiler_title\">Napriek tomu, o vtedaj\u0161\u00edch a s\u00fa\u010dasn\u00fdch DPI<\/b>Mimochodom, mnoh\u00ed, ktor\u00ed k\u00fapili existuj\u00face na trhu DPI syst\u00e9my \u2014 u\u017e ich vyhodili. No nie s\u00fa prisp\u00f4soben\u00e9 pre tak\u00e9to: stovky tis\u00edc adries, desiatky tis\u00edc URL.<\/p>\n<p>A z\u00e1rove\u0148 sa na tento trh ve\u013emi zdvihli dom\u00e1ci v\u00fdrobcovia. Nehovor\u00edm o hardv\u00e9rovej s\u00fa\u010dasti \u2014 tu je v\u0161etko jasn\u00e9, ale softv\u00e9r \u2014 je to hlavn\u00e9, \u010do je v DPI \u2014 mo\u017eno, \u017ee ak nie najpokro\u010dilej\u0161\u00ed na svete, tak ur\u010dite a) sa vyv\u00edja obrovsk\u00fdm tempom, a b) cenovo \u2014 jednoducho neporovnate\u013en\u00e9 so zahrani\u010dn\u00fdmi konkurentmi.<\/p>\n<p>Chcel by som sa p\u00fd\u0161i\u0165, ale je to trochu smutn\u00e9 =)<\/p>\n<p>Teraz to vyzeralo takto:<\/p>\n<p><img decoding=\"async\" alt=\"Roz\u0161\u00edren\u00e1 odpove\u010f na koment\u00e1r, ako aj nie\u010do o \u017eivote poskytovate\u013eov v RF\" src=\"\/wp-content\/uploads\/2019\/03\/d4b36c9f02fbbe7d36e9dc81fb1fe9ed.jpg\" style=\"display:block;margin: 0 auto;\" \/><br \/>\n<br \/>\n<b>E\u0161te o p\u00e1r rokov nesk\u00f4r<\/b> mal ka\u017ed\u00fd u\u017e in\u0161pektorov; zdrojov v registri prib\u00fadalo \u010doraz viac. Pre niektor\u00e9 star\u00e9 zariadenia (napr\u00edklad cisco 7600) sa sch\u00e9ma s \"filtr\u00e1ciou z boku\" stala jednoducho nepou\u017eite\u013enou: po\u010det tr\u00e1s na 76 platform\u00e1ch je obmedzen\u00fd na nie\u010do okolo dev\u00e4\u0165sto tis\u00edc, pri\u010dom len po\u010det IPv4 tr\u00e1s dnes u\u017e dosahuje takmer 800 tis\u00edc. A ak e\u0161te aj ipv6\u2026 A e\u0161te aj\u2026 ko\u013eko tam? 900000 jednotliv\u00fdch adries v z\u00e1kaze rkn? =)<\/p>\n<p>Niektor\u00ed prech\u00e1dzali na sch\u00e9mu s mirrovan\u00edm celej magistr\u00e1lnej prev\u00e1dzky na filtrovanie servera, ktor\u00fd mus\u00ed analyzova\u0165 cel\u00fd tok a pri n\u00e1jden\u00ed nie\u010doho zl\u00e9ho posiela\u0165 na obe strany (odo\u0161lete\u013eovi a pr\u00edjemcovi) RST.<\/p>\n<p>Av\u0161ak \u010d\u00edm viac prev\u00e1dzky, t\u00fdm menej je t\u00e1to sch\u00e9ma aplikovate\u013en\u00e1. Pri najmen\u0161ej oneskoren\u00ed v spracovan\u00ed \u2014 zrkadlen\u00e1 prev\u00e1dzka jednoducho nepozorovane prelet\u00ed nikam, a poskytovate\u013e dostane protokol o pokute.<\/p>\n<p>St\u00e1le viac a viac poskytovate\u013eov sa n\u00fati in\u0161talova\u0165 DPI syst\u00e9my r\u00f4znej \u00farovne spo\u013eahlivosti na hlavn\u00e9 tranzitn\u00e9 cesty.<\/p>\n<p><b>Rok-dva dozadu<\/b> pod\u013ea zvest\u00ed, prakticky od v\u0161etk\u00fdch sa vy\u017eaduje, aby skuto\u010dne in\u0161talovali zariadenia <noindex><a rel=\"nofollow\" href=\"https:\/\/vasexperts.ru\/blog\/osobennosti-i-otlichiya-sorm\/\">SORF<\/a><\/noindex> (predt\u00fdm v\u00e4\u010d\u0161ina poskytovate\u013eov obch\u00e1dzala schv\u00e1len\u00edm s org\u00e1nmi <i>pl\u00e1nu SORF<\/i> \u2014 pl\u00e1nom operat\u00edvnych opatren\u00ed v pr\u00edpade potreby nie\u010do niekde n\u00e1js\u0165)<\/p>\n<p>Okrem pe\u0148az\u00ed (nie tak, \u017ee by to boli priam nebesk\u00e9 sumy, ale predsa \u2014 mili\u00f3ny), SORF od mnoh\u00fdch vy\u017eadoval aj \u010fal\u0161ie manipul\u00e1cie so sie\u0165ou.<\/p>\n<ul>\n<li>SORF mus\u00ed vidie\u0165 \u00ab\u0161ed\u00e9\u00bb adresy pou\u017e\u00edvate\u013eov pred nat-transl\u00e1ciou<\/li>\n<li>SORF m\u00e1 obmedzen\u00fd po\u010det sie\u0165ov\u00fdch rozhran\u00ed.<\/li>\n<\/ul>\n<p>\nPreto sme museli, medzi in\u00fdmi, v\u00fdznamne zrekon\u0161truova\u0165 \u010das\u0165 jadra \u2014 len aby sme niekde na jednom mieste zhroma\u017edili prev\u00e1dzku pou\u017e\u00edvate\u013eov k pr\u00edstupov\u00fdm serverom. Aby sme ich mohli pomocou nieko\u013ek\u00fdch liniek zrkadli\u0165 do SORF.<\/p>\n<p>In\u00fdmi slovami, ve\u013emi zjednodu\u0161ene, bolo (v\u013eavo) vs stalo sa (vpravo):<\/p>\n<p><img decoding=\"async\" alt=\"Roz\u0161\u00edren\u00e1 odpove\u010f na koment\u00e1r, ako aj nie\u010do o \u017eivote poskytovate\u013eov v RF\" src=\"\/wp-content\/uploads\/2019\/03\/0c6af5715ba59eda722309292c6f6735.jpg\" style=\"display:block;margin: 0 auto;\" \/><br \/>\n<br \/>\n<b>Teraz<\/b> od v\u00e4\u010d\u0161iny poskytovate\u013eov sa vy\u017eaduje implement\u00e1cia aj SORF-3 \u2014 ktor\u00fd zah\u0155\u0148a aj logovanie nat-transl\u00e1ci\u00ed.<\/p>\n<p>Na tieto \u00fa\u010dely sme do sch\u00e9my vy\u0161\u0161ie museli prida\u0165 aj samostatn\u00e9 zariadenie pre NAT (presne to, o \u010dom sa hovor\u00ed v prvej \u010dasti). A to prida\u0165 v ur\u010ditom porad\u00ed: ke\u010f\u017ee SORF mus\u00ed \u00abvidie\u0165\u00bb prev\u00e1dzku pred transl\u00e1ciou adries \u2014 prev\u00e1dzka mus\u00ed \u00eds\u0165 pr\u00edsne nasleduj\u00facim sp\u00f4sobom: pou\u017e\u00edvatelia -&gt; prep\u00ednanie, jadro -&gt; pr\u00edstupov\u00e9 servery -&gt; SORF -&gt; NAT -&gt; prep\u00ednanie, jadro -&gt; internet. Na to sme museli, doslova, \u00aboto\u010di\u0165\u00bb toky prev\u00e1dzky na druh\u00fa stranu za\u017eiva, \u010do bolo tie\u017e dos\u0165 zlo\u017eit\u00e9.<\/p>\n<p>Sumarizuj\u00fac: za desa\u0165 rokov sa sch\u00e9ma jadra priemern\u00e9ho poskytovate\u013ea zlo\u017eila mnohon\u00e1sobne, a po\u010det dodato\u010dn\u00fdch bodov zlyhania (\u010di u\u017e vo forme zariadenia, alebo vo forme jednotn\u00fdch prep\u00ednac\u00edch liniek) \u2014 sa v\u00fdznamne zv\u00fd\u0161il. Samotn\u00e1 po\u017eiadavka \u00abvidie\u0165 v\u0161etko\u00bb predpoklad\u00e1 z\u00fa\u017eenie tohto \u00abv\u0161etk\u00e9ho\u00bb do jedn\u00e9ho bodu.<\/p>\n<p>Mysl\u00edm, \u017ee to m\u00f4\u017eeme celkom priestranne extrapolova\u0165 na s\u00fa\u010dasn\u00e9 iniciat\u00edvy v oblasti suvereniz\u00e1cie rusk\u00e9ho internetu, jeho ochrany, stabiliz\u00e1cie a zlep\u0161ovania \ud83d\ude42<\/p>\n<p>A e\u0161te pred nami je Jarovaja.<\/p>\n<p>Zdroj: <a content=\"nofollow\" rel=\"nofollow\" href=\"https:\/\/habr.com\/ru\/post\/444274\/\">habr.com<\/a><\/p>","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"excerpt":{"rendered":"<p>\u0421\u043f\u043e\u0434\u0432\u0438\u0433 \u043c\u0435\u043d\u044f \u043d\u0430 \u044d\u0442\u043e\u0442 \u043f\u043e\u0441\u0442 \u0432\u043e\u0442 \u044d\u0442\u043e\u0442 \u0432\u043e\u0442 \u043a\u043e\u043c\u043c\u0435\u043d\u0442\u0430\u0440\u0438\u0439. \u041f\u0440\u0438\u0432\u043e\u0436\u0443 \u0435\u0433\u043e \u0437\u0434\u0435\u0441\u044c: kaleman \u0441\u0435\u0433\u043e\u0434\u043d\u044f \u0432 18:53 \u041c\u0435\u043d\u044f \u0441\u0435\u0433\u043e\u0434\u043d\u044f \u043f\u043e\u0440\u0430\u0434\u043e\u0432\u0430\u043b \u043f\u0440\u043e\u0432\u0430\u0439\u0434\u0435\u0440. \u0412\u043c\u0435\u0441\u0442\u0435 \u0441 \u043e\u0431\u043d\u043e\u0432\u043b\u0435\u043d\u0438\u0435 \u0441\u0438\u0441\u0442\u0435\u043c\u044b \u0431\u043b\u043e\u043a\u0438\u0440\u043e\u0432\u0430\u043d\u0438\u044f \u0441\u0430\u0439\u0442\u043e\u0432, \u0443 \u043d\u0435\u0433\u043e \u043f\u043e\u0434 \u0431\u0430\u043d \u043f\u043e\u043f\u0430\u043b \u043f\u043e\u0447\u0442\u043e\u0432\u0438\u043a mail.ru \u0421 \u0443\u0442\u0440\u0430 \u0434\u0435\u0440\u0433\u0430\u044e \u0442\u0435\u0445\u043f\u043e\u0434\u0434\u0435\u0440\u0436\u043a\u0443, \u043d\u0438\u0447\u0435\u0433\u043e \u0441\u0434\u0435\u043b\u0430\u0442\u044c \u043d\u0435 \u043c\u043e\u0433\u0443\u0442. \u041f\u0440\u043e\u0432\u0430\u0439\u0434\u0435\u0440 \u043c\u0430\u043b\u0435\u043d\u044c\u043a\u0438\u0439, \u0438 \u0431\u043b\u043e\u043a\u0438\u0440\u0443\u044e\u0442 \u0432\u0438\u0434\u0438\u043c\u043e \u0432\u044b\u0448\u0435\u0441\u0442\u043e\u044f\u0449\u0438\u0435 \u043f\u0440\u043e\u0432\u0430\u0439\u0434\u0435\u0440\u044b. \u0415\u0449\u0435 \u0437\u0430\u043c\u0435\u0442\u0438\u043b \u0437\u0430\u043c\u0435\u0434\u043b\u0435\u043d\u0438\u0435 \u043e\u0442\u043a\u0440\u044b\u0442\u0438\u0435 \u0432\u0441\u0435\u0445 \u0441\u0430\u0439\u0442\u043e\u0432, \u043c\u043e\u0436\u0435\u0442 [&hellip;]<\/p>\n","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"author":1,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[],"tags":[],"class_list":["post-29814","post","type-post","status-publish","format-standard","hentry"],"aioseo_notices":[],"aioseo_head":"\n\t\t<!-- All in One SEO 5.0.4 - aioseo.com -->\n\t<meta name=\"description\" content=\"\u0421\u043f\u043e\u0434\u0432\u0438\u0433 \u043c\u0435\u043d\u044f \u043d\u0430 \u044d\u0442\u043e\u0442 \u043f\u043e\u0441\u0442 \u0432\u043e\u0442 \u044d\u0442\u043e\u0442 \u0432\u043e\u0442 \u043a\u043e\u043c\u043c\u0435\u043d\u0442\u0430\u0440\u0438\u0439. \u041f\u0440\u0438\u0432\u043e\u0436\u0443 \u0435\u0433\u043e \u0437\u0434\u0435\u0441\u044c:\" \/>\n\t<meta name=\"robots\" content=\"max-image-preview:large\" \/>\n\t<meta name=\"author\" content=\"Yuri Gagarin\"\/>\n\t<link rel=\"canonical\" href=\"https:\/\/prohoster.info\/sk\/blog\/razvyornutyj-otvet-na-kommentarij-a-takzhe-nemnogo-o-zhizni-provajderov-v-rf\" \/>\n\t\t<meta name=\"generator\" content=\"All in One SEO (AIOSEO) 5.0.4\" \/>\n\t\t<meta property=\"og:locale\" content=\"sk_SK\" \/>\n\t\t<meta property=\"og:site_name\" content=\"ProHoster | \u041a\u0443\u043f\u0438\u0442\u044c \u043d\u0430\u0434\u0435\u0436\u043d\u044b\u0439 \u0445\u043e\u0441\u0442\u0438\u043d\u0433 \u0434\u043b\u044f \u0441\u0430\u0439\u0442\u043e\u0432 \u0441 \u0437\u0430\u0449\u0438\u0442\u043e\u0439 \u043e\u0442 DDoS, VPS VDS \u0441\u0435\u0440\u0432\u0435\u0440\u044b\" \/>\n\t\t<meta property=\"og:type\" content=\"article\" \/>\n\t\t<meta property=\"og:title\" content=\"\ud83e\udd47\u0420\u0430\u0437\u0432\u0451\u0440\u043d\u0443\u0442\u044b\u0439 \u043e\u0442\u0432\u0435\u0442 \u043d\u0430 \u043a\u043e\u043c\u043c\u0435\u043d\u0442\u0430\u0440\u0438\u0439, \u0430 \u0442\u0430\u043a\u0436\u0435 \u043d\u0435\u043c\u043d\u043e\u0433\u043e \u043e \u0436\u0438\u0437\u043d\u0438 \u043f\u0440\u043e\u0432\u0430\u0439\u0434\u0435\u0440\u043e\u0432 \u0432 \u0420\u0424 | ProHoster\" \/>\n\t\t<meta property=\"og:description\" content=\"\u0421\u043f\u043e\u0434\u0432\u0438\u0433 \u043c\u0435\u043d\u044f \u043d\u0430 \u044d\u0442\u043e\u0442 \u043f\u043e\u0441\u0442 \u0432\u043e\u0442 \u044d\u0442\u043e\u0442 \u0432\u043e\u0442 \u043a\u043e\u043c\u043c\u0435\u043d\u0442\u0430\u0440\u0438\u0439. \u041f\u0440\u0438\u0432\u043e\u0436\u0443 \u0435\u0433\u043e \u0437\u0434\u0435\u0441\u044c:\" \/>\n\t\t<meta property=\"og:url\" content=\"https:\/\/prohoster.info\/sk\/blog\/razvyornutyj-otvet-na-kommentarij-a-takzhe-nemnogo-o-zhizni-provajderov-v-rf\" \/>\n\t\t<meta property=\"og:image\" content=\"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg\" \/>\n\t\t<meta property=\"og:image:secure_url\" content=\"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg\" \/>\n\t\t<meta property=\"og:image:width\" content=\"350\" \/>\n\t\t<meta property=\"og:image:height\" content=\"350\" \/>\n\t\t<meta property=\"article:published_time\" content=\"2019-10-31T18:32:09+00:00\" \/>\n\t\t<meta property=\"article:modified_time\" content=\"2019-10-31T18:32:09+00:00\" \/>\n\t\t<meta property=\"article:publisher\" content=\"https:\/\/www.facebook.com\/prohoster\" \/>\n\t\t<meta property=\"article:author\" content=\"https:\/\/www.facebook.com\/prohoster\" \/>\n\t\t<!-- All in One SEO -->\n\n","aioseo_head_json":{"title":"\ud83e\udd47Rozsiahla odpove\u010f na koment\u00e1r, ako aj trochu o \u017eivote poskytovate\u013eov v RF | ProHoster","description":"Tento pr\u00edspevok ma in\u0161piroval tento koment\u00e1r. Uv\u00e1dzam ho tu:","canonical_url":"https:\/\/prohoster.info\/sk\/blog\/razvyornutyj-otvet-na-kommentarij-a-takzhe-nemnogo-o-zhizni-provajderov-v-rf","robots":"max-image-preview:large","keywords":"","webmasterTools":{"miscellaneous":""},"schema":null,"og:locale":"sk_SK","og:site_name":"ProHoster | \u041a\u0443\u043f\u0438\u0442\u044c \u043d\u0430\u0434\u0435\u0436\u043d\u044b\u0439 \u0445\u043e\u0441\u0442\u0438\u043d\u0433 \u0434\u043b\u044f \u0441\u0430\u0439\u0442\u043e\u0432 \u0441 \u0437\u0430\u0449\u0438\u0442\u043e\u0439 \u043e\u0442 DDoS, VPS VDS \u0441\u0435\u0440\u0432\u0435\u0440\u044b","og:type":"article","og:title":"\ud83e\udd47\u0420\u0430\u0437\u0432\u0451\u0440\u043d\u0443\u0442\u044b\u0439 \u043e\u0442\u0432\u0435\u0442 \u043d\u0430 \u043a\u043e\u043c\u043c\u0435\u043d\u0442\u0430\u0440\u0438\u0439, \u0430 \u0442\u0430\u043a\u0436\u0435 \u043d\u0435\u043c\u043d\u043e\u0433\u043e \u043e \u0436\u0438\u0437\u043d\u0438 \u043f\u0440\u043e\u0432\u0430\u0439\u0434\u0435\u0440\u043e\u0432 \u0432 \u0420\u0424 | ProHoster","og:description":"\u0421\u043f\u043e\u0434\u0432\u0438\u0433 \u043c\u0435\u043d\u044f \u043d\u0430 \u044d\u0442\u043e\u0442 \u043f\u043e\u0441\u0442 \u0432\u043e\u0442 \u044d\u0442\u043e\u0442 \u0432\u043e\u0442 \u043a\u043e\u043c\u043c\u0435\u043d\u0442\u0430\u0440\u0438\u0439. \u041f\u0440\u0438\u0432\u043e\u0436\u0443 \u0435\u0433\u043e \u0437\u0434\u0435\u0441\u044c:","og:url":"https:\/\/prohoster.info\/sk\/blog\/razvyornutyj-otvet-na-kommentarij-a-takzhe-nemnogo-o-zhizni-provajderov-v-rf","og:image":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:secure_url":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:width":350,"og:image:height":350,"article:published_time":"2019-10-31T18:32:09+00:00","article:modified_time":"2019-10-31T18:32:09+00:00","article:publisher":"https:\/\/www.facebook.com\/prohoster","article:author":"https:\/\/www.facebook.com\/prohoster"},"aioseo_meta_data":{"post_id":"29814","title":null,"description":null,"keywords":null,"keyphrases":null,"primary_term":null,"canonical_url":null,"og_title":null,"og_description":null,"og_object_type":"default","og_image_type":"default","og_image_url":null,"og_image_width":null,"og_image_height":null,"og_image_custom_url":null,"og_image_custom_fields":null,"og_video":null,"og_custom_url":null,"og_article_section":null,"og_article_tags":null,"twitter_use_og":false,"twitter_card":"default","twitter_image_type":"default","twitter_image_url":null,"twitter_image_custom_url":null,"twitter_image_custom_fields":null,"twitter_title":null,"twitter_description":null,"schema":{"blockGraphs":[],"customGraphs":[],"default":{"data":{"Article":[],"Course":[],"Dataset":[],"FAQPage":[],"Movie":[],"Person":[],"Product":[],"ProductReview":[],"Car":[],"Recipe":[],"Service":[],"SoftwareApplication":[],"WebPage":[]},"graphName":"Article","isEnabled":true},"graphs":[]},"schema_type":null,"schema_type_options":null,"pillar_content":false,"robots_default":true,"robots_noindex":false,"robots_noarchive":false,"robots_nosnippet":false,"robots_nofollow":false,"robots_noimageindex":false,"robots_noodp":false,"robots_notranslate":false,"robots_max_snippet":null,"robots_max_videopreview":null,"robots_max_imagepreview":"large","priority":null,"frequency":null,"local_seo":null,"seo_analyzer_scan_date":"2026-01-20 22:35:19","breadcrumb_settings":null,"limit_modified_date":false,"reviewed_by":null,"ai":null,"created":"2021-03-01 03:48:50","updated":"2026-01-20 22:35:19","focus_keyword":null,"additional_keywords":null,"truseo_locale":null},"gt_translate_keys":[{"key":"link","format":"url"}],"_links":{"self":[{"href":"https:\/\/prohoster.info\/sk\/wp-json\/wp\/v2\/posts\/29814","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/prohoster.info\/sk\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/prohoster.info\/sk\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/prohoster.info\/sk\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/prohoster.info\/sk\/wp-json\/wp\/v2\/comments?post=29814"}],"version-history":[{"count":0,"href":"https:\/\/prohoster.info\/sk\/wp-json\/wp\/v2\/posts\/29814\/revisions"}],"wp:attachment":[{"href":"https:\/\/prohoster.info\/sk\/wp-json\/wp\/v2\/media?parent=29814"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/prohoster.info\/sk\/wp-json\/wp\/v2\/categories?post=29814"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/prohoster.info\/sk\/wp-json\/wp\/v2\/tags?post=29814"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}