Mapindiro atakaita kuburikidza neGreat Firewall yeChina (Chikamu 3)

Nhai!
Nyaya dzese dzakanaka dzinopera. Uye nyaya yedu nezvekuti tauya sei nemhinduro yekukurumidza kupfuudza iyo Chinese Firewall haina mutsauko. Naizvozvo, ndinokurumidza kugovana newe yekupedzisira, chikamu chekupedzisira pamusoro penyaya iyi.

Muchikamu chakapfuura takataura nezvemabhenji mazhinji ebvunzo atakauya nawo uye kuti ndeapi mhedzisiro yavakapa. Uye takagara pane zvingava zvakanaka kuwedzera CDN! ye viscosity muchirongwa chedu.

Ini ndichakuudza kuti takaedza sei Alibaba Cloud CDN, Tencent Cloud CDN naAkamai, uye zvatakaguma nazvo. Uye chokwadi, ngatipfupikisai.

Alibaba Cloud CDN

Isu tinotambirwa paAlibaba Cloud uye tinoshandisa IPSEC uye CEN kubva kwavari. Zvingava zvine musoro kuti vatange vaedza kugadzirisa.

Alibaba Cloud ine marudzi maviri echigadzirwa chinogona kuenderana nesu: CDN и DCDN. Sarudzo yekutanga ndeyekare CDN kune yakatarwa domain (subdomain). Chechipiri sarudzo inomirira Dynamic Route yeCDN (Ini ndinoidaidza kuti dynamic CDN), inogona kugoneswa muYakazara-saiti modhi (ye wildcard domains), iyo zvakare inochengetedza static zvemukati uye inomhanyisa zvine simba zvemukati pachezvayo, ndiko kuti, masimba epeji anozotakurwa zvakare kuburikidza nemupi wekupa. fast network. Izvi zvakakosha kwatiri, nekuti zvakanyanya saiti yedu ine simba, inoshandisa akawanda subdomain, uye zviri nyore kumisa CDN kamwe chete ye "asterisk" - *.semrushchina.cn.

Takanga tatoona chigadzirwa ichi mumatanho ekutanga epurojekiti yedu yeChinese, asi zvino yakanga isati yashanda, uye vagadziri vakavimbisa kuti chigadzirwa chaizowanikwa kune vese vatengi. Uye akadaro.

MuDCDN unogona:

• gadzirisa SSL kupera nechitupa chako,
• gonesa kukwidziridzwa kwezvinhu zvine simba,
• gadzirisa nekugadzirisa caching ye static mafaira,
• bvisa cache,
• mberi kwewebhu sockets,
• gonesa kudzvanya uye kunyangwe HTML Inonakisa.

Muzhinji, zvese zvakafanana nevakuru uye vakuru veCDN vanopa.

Mushure meMavambo (nzvimbo iyo CDN edge maseva ichaenda) yatsanangurwa, chasara kugadzira CNAME yeasterisk, kunongedzera. all.semrushchina.cn.w.kunluncan.com (iyi CNAME yakagamuchirwa muAlibaba Cloud console) uye CDN ichashanda.

Zvichienderana nemhedzisiro yebvunzo, iyi CDN yakatibatsira zvakanyanya. Nhamba idzi dzinoratidzwa pasi apa.

chisarudzo
Uptime
Median
75 Percentile
95 Percentile

Cloudflare
86.6
18s
30s
60s

IPsec
99.79
18s
21s
30s

cen
99.75
16s
21s
27s

CEN/IPsec + GLB
99.79
13s
16s
25s

Ali CDN + CEN/IPsec + GLB
99.75
10s
12.8s
17.3s

Iyi mibairo yakanaka kwazvo, kunyanya kana ukaaenzanisa neaive manhamba pekutanga. Asi isu taiziva kuti bvunzo yebrowser yeAmerican vhezheni yewebhusaiti yedu www.semrush.com inomhanya kubva kuUSA muavhareji ye8.3s (yakanyanya kukosha kukosha). Pane nzvimbo yekuvandudza. Uyezve, kwaivewo nevanopa CDN vainakidza kuyedza.

Saka isu tinofamba zvakanaka kuenda kune imwe hofori mumusika weChinese - Tencent.

Tencent Cloud

Tencent iri kungogadzira gore rayo - izvi zvinogona kuonekwa kubva kunhamba shoma yezvigadzirwa. Tichiri kuishandisa, isu taida kuyedza kwete CDN yavo chete, asiwo network yavo yese network:

• vane chimwe chinhu chakafanana neCEN?
• IPSEC inoshanda sei kwavari? Inokurumidza, chii chiri nguva?
• vane Anycast here?

Ngatitarisei mibvunzo iyi zvakasiyana.

Analogue CEN

Tencent ine chigadzirwa Cloud Connect Network (CCN), zvichikubvumidza kuti ubatanidze maVPC kubva kumatunhu akasiyana, kusanganisira matunhu mukati nekunze kweChina. Chigadzirwa chave mubeta yemukati, uye iwe unofanirwa kugadzira tikiti uchikumbira kubatana nacho. Takadzidza kubva parutsigiro kuti maakaundi epasirese (hatisi kutaura nezvevagari vekuChina kana masangano emutemo) haagone kutora chikamu muchirongwa chekuyedza beta uye, kazhinji, kubatanidza dunhu riri mukati meChina nedunhu riri kunze. 1-0 vachifarira Ali Cloud

IPSEC

Nzvimbo yekumaodzanyemba kweTencent ndiyo Guangzhou. Takaunganidza mugero ndokuibatanidza nedunhu reHong Kong muGCP (ipapo dunhu iri rakanga ratovepo). Yechipiri mugero muAli Cloud kubva kuShenzhen kuenda kuHong Kong yakasimudzwawo panguva imwe chete. Zvakazoitika kuti kuburikidza neTencent network iyo latency kuHong Kong kazhinji iri nani (10ms) pane kubva kuShenzhen kuenda kuHong Kong kuenda kuAli (120ms - chii?). Asi izvi hazvina kuita nenzira ipi neipi kukurumidza basa resaiti yakanangana nekushanda kuburikidza neTencent uye mugero uyu, iyo pachayo yaive chokwadi chinoshamisa uye zvakare yakaratidza zvinotevera: latency - kuChina ichi hachisi chiratidzo chakakosha. kuteerera paunenge uchigadzira mhinduro yekupfuura iyo Chinese firewall.

Anycast Internet Kuwedzera

Chimwe chigadzirwa chinokutendera kuti ushande kuburikidza necherocast IP ndeye PANE. Asi zvakare haiwanikwe kumaakaundi epasi rose, saka ini handisi kuzokuudza nezvazvo, asi kuziva kuti chigadzirwa chakadaro chiripo chinogona kubatsira.

Asi iyo CDN bvunzo yakaratidza zvimwe zvinonakidza zvinonaka. Tencent's CDN haigone kugoneswa pane yakazara-saiti, chete pane chaiwo madomasi. Isu takagadzira madomasi uye takatumira traffic kwavari:

Zvakazoitika kuti CDN iyi ine basa rinotevera: Cross Border Traffic Optimization. Iyi ficha inofanirwa kuderedza mitengo kana traffic ikapfuura nepaChinese firewall. As mavambo IP kero yeGoogle GLB (GLB anycast) yakatsanangurwa. Saka, taida kurerutsa mavakirwo eprojekiti.

Mhedzisiro yacho yaive yakanaka kwazvo - padanho reAli Cloud CDN, uye mune dzimwe nzvimbo zvirinani. Izvi zvinoshamisa, nekuti kana bvunzo dzakabudirira, unogona kusiya chikamu chakakosha chezvivakwa, tunnel, CEN, chaiwo michina, nezvimwe.

Hatina kufara kwenguva yakareba, sezvo dambudziko rakaratidzwa: bvunzo muCatchpoint yakundikana kune Internet mupi China Mobile. Kubva chero kupi kwatakawana nguva yekupera kuburikidza neTencent's CDN. Kunyorerana nerutsigiro rwehunyanzvi hakuna kutungamira kune chero chinhu. Takaedza kugadzirisa dambudziko iri kwerinenge zuva, asi hapana chakashanda.

Ndakanga ndiri kuChina panguva iyoyo, asi handina kuwana yeruzhinji Wi-Fi pane network yemupi uyu kuti ndione dambudziko pachangu. Zvikasadaro zvese zvaitaridzika nekukurumidza uye zvakanaka.
Nekudaro, nekuda kwekuti China Mobile ndeimwe yevatatu makuru anoshanda, takamanikidzwa kudzorera traffic kuAli CDN.
Asi zvakazara, iyi yaive mhinduro inonakidza inofanirwa kuyedzwa kwenguva refu uye kugadzirisa dambudziko iri.

Akamai

Wekupedzisira CDN mupi watakaedza aive Akamai. Uyu mupi mukuru ane network yake muChina. Chokwadi, hatina kukwanisa kupfuura.

Kubva pakutanga, takabvumirana naAkamai kwenguva yekuedza kuti tikwanise kushandura domain uye kuona kuti yaizoshanda sei pane network yavo. Ini ndichatsanangura mhedzisiro yekuyedzwa kwese muchimiro che "Zvandaida" uye "Zvandisina kufarira," uye ini ndichapawo mhinduro dzebvunzo.

Zvandafarira:

• Vakomana veAkamai vaibatsira zvakanyanya mumibvunzo yese uye vakatiperekedza pamatanho ese ekuyedzwa. Taigara tichiedza kuvandudza chimwe chinhu kudivi redu. Vakapa mazano akanaka ehunyanzvi.
• Akamai inenge 10-15% inononoka pane mhinduro yedu kuburikidza neAli Cloud CDN. Chinofadza ndechekuti muOrigin for Akamai takatsanangura IP kero yeGLB, zvichireva kuti traffic haina kupinda nemhinduro yedu (zvichida tinogona kusiya chikamu chezvivakwa). Asi zvakadaro, mhinduro dzebvunzo dzakaratidza kuti mhinduro iyi yakashata pane yedu yazvino vhezheni (kuenzanisa mhinduro pazasi).
• Yakaedzwa zvese Mavambo GLB uye Mavambo muChina. Zvose zvingasarudzwa zvinenge zvakafanana.
• kune Sure Route (otomatiki routing optimization). Iwe unogona kugamuchira chinhu chekuyedza paMavambo, uye Akamai Edge maseva anoedza kuitora (nguva dzose GET). Kune izvi zvikumbiro, kumhanya uye mamwe metrics anoyerwa, zvichibva pane iyo Akamai network inokwidziridza nzira kuitira kuti traffic iende nekukurumidza kune yedu saiti uye zvaive pachena kuti kugonesa chimiro ichi kwakanyatso kukonzeresa kumhanya kwesaiti.
• Kushandura iyo gadziriso muwebhu interface inotonhorera. Unogona kuita Enzanisa neshanduro, tarisa diff. Ona shanduro dzakapfuura.
• Iwe unogona kuburitsa vhezheni nyowani kutanga chete paAkamai Staging network - iyo yakafanana netiweki sekugadzirwa, iyi nzira chete haizokanganisa vashandisi chaivo. Kune iyi bvunzo, iwe unofanirwa kukanganisa DNS marekodhi pamushini wako wemuno.
• Kukurumidza kurodha kumhanyisa kuburikidza netiweki yavo kune yakakura static mafaera, uye, sezviri pachena, chero mamwe mafaera. Faera kubva pa "kutonhora" cache rinodzoserwa kakawanda nekukurumidza kupfuura faira rimwe chete kubva "kutonhora" cache yeAli CDN. Kubva pa "hot" cache, kumhanya kwatove kwakafanana, kuwedzera kana kubvisa.

Ali CDN bvunzo:

root@shenzhen1:~# curl -o /dev/null -w@curl_time https://en.semrushchina.cn/my_reports/build/scripts/simpleInit.js?v=1551879212
  % Total    % Received % Xferd  Average Speed   Time    Time     Time  Current
                                 Dload  Upload   Total   Spent    Left  Speed
100 5757k    0 5757k    0     0   513k      0 --:--:--  0:00:11 --:--:--  526k
time_namelookup:  0.004286
time_connect:  0.030107
time_appconnect:  0.117525
time_pretransfer:  0.117606
time_redirect:  0.000000
time_starttransfer:  0.840348
----------
time_total:  11.208119
----------
size_download:  5895467 Bytes
speed_download:  525999.000B/s

Akamai test:

root@shenzhen1:~# curl -o /dev/null -w@curl_time https://www.semrushchina.cn/my_reports/build/scripts/simpleInit.js?v=1551879212
  % Total    % Received % Xferd  Average Speed   Time    Time     Time  Current
                                 Dload  Upload   Total   Spent    Left  Speed
100 5757k    0 5757k    0     0  1824k      0 --:--:--  0:00:03 --:--:-- 1825k
time_namelookup:  0.509005
time_connect:  0.528261
time_appconnect:  0.577235
time_pretransfer:  0.577324
time_redirect:  0.000000
time_starttransfer:  1.327013
----------
time_total:  3.154850
----------
size_download:  5895467 Bytes
speed_download:  1868699.000B/s

Takaona kuti mamiriro ezvinhu mumuenzaniso uri pamusoro anoenderana nezvinhu zvakasiyana-siyana. Panguva yekunyora iyi pfungwa, ndakamhanya bvunzo zvakare. Mibairo yemapuratifomu ese ari maviri anga akafanana. Izvi zvinotitaurira kuti Indaneti muChina, kunyange kune vashandi vakuru uye vanopa makore, vanoita zvakasiyana nguva nenguva.

Kunzvimbo yapfuura, ini ndichawedzera yakakura yekuwedzera yeAkamai: kana Ali achiratidza kupenya kwakafanana kwekuita kwepamusoro uye kuderera kwakanyanya (izvi zvinoshanda kuna Ali CDN, Ali CEN, uye Ali IPSEC), ipapo Akamai, nguva dzese, zvisinei. kuti ndinoedza sei network yavo, zvese zvinoshanda zvakatsiga.
Akamai ane yakawanda yekuvhara muChina uye inoshanda kuburikidza nevazhinji vanopa.

Zvandaisafarira:

• Ini handifarire iyo webhu interface uye nemashandiro ayo - haina kunaka. Asi zvakanyanya iwe unojaira (zvichida).
• Miedzo mibairo yakaipa kupfuura saiti yedu.
• Pane zvikanganiso zvakawanda panguva yekuedzwa kupfuura pane yedu saiti (uptime pazasi).
• Isu hatina edu ega DNS maseva muChina. Saka pane zvikanganiso zvakawanda mukuedzwa nekuda kweDNS kugadzirisa nguva yekubuda.
• Ivo havape yavo IP marengeti -> hapana nzira yekunyoresa iwo chaiwo set_real_ip_kubva pamaseva edu.

Metrics (~ 3626 inomhanya; ese metrics kunze kweUptime, mune ms; nhamba dzenguva imwe chete):

CDN Provider
Median
75%
95%
Response
Webhu Response
Uptime
DNS
batanidza
mira
mutoro
SSL

AliCDN
9195
10749
17489
1,715
10,745
99.531
57
17
927
479
200

Akamai
9783
11887
19888
2,352
11,550
98.980
424
91
1408
381
50

Kugoverwa nePercentile (mu ms):

percentile
Akamai
AliCDN

10
7,092
6,942

20
7,775
7,583

30
8,446
8,092

40
9,146
8,596

50
9,783
9,195

60
10,497
9,770

70
11,371
10,383

80
12,670
11,255

90
15,882
13,165

100
91,592
91,596

Mhedziso ndeiyi: iyo Akamai sarudzo inoshanda, asi haipe kugadzikana kwakafanana nekumhanya seyedu mhinduro yakasanganiswa neAli CDN.

Zvinyorwa zvidiki

Dzimwe nguva hadzina kuverengerwa munyaya, asi ndinoda kunyora nezvadzo zvakare.

Beijing + Tokyo neHong Kong

Sezvandambotaura pamusoro, takaedza IPSEC mugero kuHong Kong (HK). Asi isu takaedzawo CEN kuHK. Zvinodhura zvishoma, uye ndanga ndichinetseka kuti zvaizoshanda sei pakati pemaguta ane chinhambwe che ~ 100 km. Zvakazonakidza kuti latency iri pakati pemaguta aya yakakwira 100ms pane yedu yekutanga vhezheni (kuTaiwan). Kumhanya, kugadzikana kwaive zvakare nani kuTaiwan. Nekuda kweizvozvo, isu takasiya HK seyakagadzika IPSEC dunhu.

Mukuwedzera, takaedza kuisa inotevera yekuisa:

• kubviswa kwevatengi muBeijing,
• IPSEC uye CEN kuenda kuTokyo,
• muAli CDN sevha muBeijing yakaratidzwa seyakabva.

Ichi chirongwa chaive chisina kugadzikana, kunyangwe maererano nekumhanya kwaiwanzo kusiri pasi pemhinduro yedu. Nezve mugero, ndaona madonhwe epakati kunyangwe eCEN, aifanira kunge akagadzikana. Naizvozvo, takadzokera kuchirongwa chekare uye tikabvisa iyi nhandare.

Pazasi pane nhamba dze latency pakati penzvimbo dzakasiyana dzenzira dzakasiyana. Zvichida mumwe munhu achazvifarira.

IPsec
Ali cn-beijing <—> GCP asia-northeast1 — 193ms
Ali cn-shenzhen <—> GCP asia-east2 — 91ms
Ali cn-shenzhen <—> GCP us-east4 — 200ms

cen
Ali cn-beijing <—> Ali ap-northeast-1 — 54ms (!)
Ali cn-shenzhen <—> Ali cn-hongkong — 6ms (!)
Ali cn-shenzhen <—> Ali us-east1 — 216ms

Ruzivo rwakakwana nezveInternet muChina

Sekuwedzera kune matambudziko neInternet anotsanangurwa pakutanga, muchikamu chekutanga chechinyorwa.

• Internet muChina inokurumidza mukati.
  • Mhedziso yakaitwa yakavakirwa pakuyedza veruzhinji maWi-Fi network munzvimbo dzakasiyana siyana dzinoshandiswa nenhamba huru yevanhu.
  • Iko kurodha uye kurodha kumhanya kumaseva mukati meChina angangoita makumi maviri Mbit/s uye 20-5 Mbit/s, zvichiteerana.
  • Iko kumhanya kumaseva kunze kweChina ishoma, isingasviki 1 Mbit/s.
• IInternet muChina haina kugadzikana zvakanyanya.
  • Dzimwe nguva masayiti anogona kuvhura nekukurumidza, dzimwe nguva zvishoma nezvishoma (panguva imwe chete yezuva pamazuva akasiyana), kunze kwekunge iyo gadziriso isingachinji. Takacherechedza izvi nemuenzaniso we semrushchina.cn. Izvi zvinogona kuverengerwa naAli CDN, iyo inoshandawo nenzira iyi uye iyo zvichienderana nenguva yezuva, chinzvimbo chenyeredzi, nezvimwe.
• Mobile Internet inenge kwese kwese 4G kana 4G+. Ibate mu subway, elevator - muchidimbu, kwese kwese.
• Inhema kuti vashandisi veChinese vanovimba chete nematunhu mu.cn zone. Takadzidza izvi zvakananga kubva kune vashandisi.
  • Unogona kuona sei http://baidu.cn redirect to www.baidu.com (mu mainland China futi).
• Zviwanikwa zvakawanda zvechokwadi zvakavharwa. Yekutanga: google.com, Facebook, Twitter. Asi zvakawanda zveGoogle zviwanikwa zvinoshanda (zvechokwadi, kwete paWi-Fi yese uye VPN haina kushandiswa (padivi re router zvakare, ichokwadi).
• Mazhinji "technical" madomasi emakambani akavharika ari kushandawo. Izvi zvinoreva kuti haufanirwe kugara uchicheka zvisina hanya zvese zveGoogle uye zvimwe zvinoita kunge zvakavharwa zviwanikwa. Iwe unofanirwa kutsvaga mamwe mazita emadomasi akarambidzwa.
• Ivo chete vane matatu makuru eInternet anoshanda: China Unicom, China Telecom, China Mobile. Kune kunyange zviduku, asi mugove wavo wemusika hauna kukosha

Bonus: yekupedzisira mhinduro dhayagiramu

Mugumisiro

Kwapera gore kubva pakatanga chirongwa ichi. Takatanga nenyaya yekuti saiti yedu yaiwanzoramba kushanda zvakajairwa kubva kuChina, uye kungoti GET curl yakatora masekonzi mashanu.

Zvadaro, nezviratidzo izvi mune yekutanga mhinduro (Cloudflare):

chisarudzo
Uptime
Median
75 Percentile
95 Percentile

Cloudflare
86.6
18s
30s
60s

Takazowana zvinotevera zvinotevera (nhamba dzemwedzi wapfuura):

chisarudzo
Uptime
Median
75 Percentile
95 Percentile

Ali CDN + CEN/IPsec + GLB
99.86
8.8s
9.5s
13.7s

Sezvauri kuona, isu hatisati takwanisa kuwana 100% uptime, asi isu tichauya nechimwe chinhu, uye tozokuudza nezve mhedzisiro mune imwe chinyorwa :)

Remekedzo kune vakaverenga zvikamu zvitatu zvose kusvika kumagumo. Ndinovimba wakawana zvese izvi zvinonakidza sezvandakaita pandakazviita.

PS Zvikamu zvakapfuura

1 chikamu
2 chikamu

Source: www.habr.com