{"id":29814,"date":"2019-10-31T21:32:09","date_gmt":"2019-10-31T18:32:09","guid":{"rendered":"https:\/\/prohoster.info\/blog\/razvyornutyj-otvet-na-kommentarij-a-takzhe-nemnogo-o-zhizni-provajderov-v-rf\/"},"modified":"2019-10-31T21:32:09","modified_gmt":"2019-10-31T18:32:09","slug":"razvyornutyj-otvet-na-kommentarij-a-takzhe-nemnogo-o-zhizni-provajderov-v-rf","status":"publish","type":"post","link":"https:\/\/prohoster.info\/sv\/blog\/razvyornutyj-otvet-na-kommentarij-a-takzhe-nemnogo-o-zhizni-provajderov-v-rf","title":{"rendered":"Ett utf\u00f6rligt svar p\u00e5 kommentaren, samt lite om livet f\u00f6r leverant\u00f6rer i Ryssland.","gt_translate_keys":[{"key":"rendered","format":"text"}]},"content":{"rendered":"

Inspiration for this post this comment<\/a><\/noindex>.<\/p>\n

I'm sharing it here:<\/p>\n

kaleman<\/a><\/noindex> today at 18:53<\/p>\n

Today I was pleased by the provider. Along with the update of the website blocking system, they accidentally blocked the mail.ru email service. I've been contacting tech support since morning, but they can't do anything. The provider is small, and they probably get blocked by higher-tier providers. I've also noticed a slowdown in opening all websites; perhaps they\u2019ve implemented some faulty DLP? There were no access issues before. The destruction of the RuNet is happening right before my eyes...<\/p><\/blockquote>\n

The thing is, it seems we are that very provider \ud83d\ude41<\/p>\n

And indeed, kaleman<\/a><\/noindex> I almost guessed the reason for the problems with mail.ru (although we long refused to believe it).<\/p>\n

The continuation will be divided into two parts:<\/p>\n

    \n
  1. the reasons for our current problems with mail.ru and an exciting quest to find them<\/li>\n
  2. the existence of ISPs in today's realities, the stability of a sovereign RuNet.<\/li>\n<\/ol>\n

    <\/a><\/noindex><\/p>\n

    Problems with the availability of mail.ru<\/h3>\n

    \nOh, it's quite a long story. <\/p>\n

    The thing is, to comply with government requirements (more details in the second part), we acquired, configured, and installed some equipment \u2014 both for filtering prohibited resources and for executing NAT translations<\/a><\/noindex> of subscribers.<\/p>\n

    Some time ago, we finally restructured the network core so that all subscriber traffic would strictly pass through this equipment in the required direction.<\/p>\n

    A few days ago, we turned on filtering for prohibited content on it (while keeping the old system operational) \u2014 everything seemed to go well.<\/p>\n

    Next, we gradually started enabling NAT for different parts of subscribers on this equipment. It also seemed to go fine.<\/p>\n

    But today, after enabling NAT for another group of subscribers \u2014 since this morning, we faced quite a number of complaints about the unavailability or partial availability of mail.ru<\/a><\/noindex> and other resources of Mail Ru Group.<\/p>\n

    We started checking: something somewhere sometimes<\/i>, occasionally<\/i> was sending TCP RST<\/a><\/noindex> in response to requests exclusively to the mail.ru networks. Moreover \u2014 it's sending incorrectly generated (without ACK), clearly artificial TCP RST. It looked something like this:<\/p>\n

    \"Ett
    \n
    \n\"Ett
    \n
    \n\"Ett
    \n
    \nNaturally, the first thoughts were about the new equipment: scary DPI, no trust in it, who knows what it might do \u2014 after all, TCP RST is quite a common occurrence among blocking tools.<\/p>\n

    Antagande kaleman<\/a><\/noindex> om att n\u00e5gon \"\u00f6verordnad\" filtrerar, har vi ocks\u00e5 framf\u00f6rt \u2014 men vi avvisade det omedelbart.<\/p>\n

    F\u00f6r det f\u00f6rsta har vi tillr\u00e4ckligt bra uplinkar f\u00f6r att inte beh\u00f6va drabbas av s\u00e5dant \ud83d\ude42<\/p>\n

    F\u00f6r det andra \u00e4r vi anslutna till flera IX<\/a><\/noindex> i Moskva, och trafiken till mail.ru g\u00e5r just genom dem \u2014 och de har varken n\u00e5gra skyldigheter eller motivation att filtrera trafik.<\/p>\n

    Den n\u00e4sta halvan av dagen spenderades p\u00e5 det som vanligtvis kallas schamanism \u2014 tillsammans med utrustningsleverant\u00f6ren, vilket jag tackar dem f\u00f6r, gav vi oss inte \ud83d\ude42<\/p>\n