ืื ืืขืืข ืืื ืฉืืื ืืขืฉืืืื, ืืื ืืืืกื. ืคึฟืึทืจ ืืืึทืฉืคึผืื, ืขืก ืืื ืึท ืืจืืืก , ืึธืืขืจ ืืืืื ืื IP ืืืื ืคืื ืื ืืืึธืงืืืกื ืืื ืืึทืืจืึทืื ืืึธืจื. ืืืจ ืืืขืื ืืืื ืืืืื ืืึธืืืืื ื.
ืฆืืืื ืืขื ืืืืก ืื ืืขืจืืืื ืืื ืื ืจืงื ืืืืงืืจื ืืืขืก ืจืขืืืก ืืื ืืื ืงืก, ืืื ืื ืคืืจืืืจืืขืจืก ืคืจืืืืจื ืืื ื ืืฉื ืฆื ืคืืื ืืื ืืขืจ ืื ืงื ืกืืช ืืืืก ืจืขืืืืืืจืจื ืืื ืืจืืืกืืขืืขืื, ืืขื ืขื ืื ืฆืืืขืืื ืืขื ืข ืคืืจืืืกืื ืคืื ืืืืงืืจืื ื ืืื ืฅ ืืจืืืก. ืืื ืฆืืืืฉื ืื "ืืึธืคืึทืื" ืืคืืขืฉืืขืื ืืืืืืขื ืขืก ืืขื ืขื ืคืืืข ื ืืฆืืง ืึธื ืขืก (ืืขืื, ืจืืืจืึทืงืขืจ)
ืืื ืืืืืื ืืืืกืขืจ ืื ืืืฉืืจืืกืืืงืฉืึทื ืคืื ืจืงื, ืึธืืขืจ ืืืื ืขืืืขืจื, ืงืจืืืื ืืื ืคืจืืื ื ืืขื ืขื ืืขืืืืื ืืื ืฉืืื. ืึทืืื ืขืก ืืื ืืึทืฉืืึธืกื ืฆื ืงืืืขื ืึทืจืืืฃ ืืื ืึทื ืืจืื ื ืืืขื ืคึฟืึทืจ ืืขื ืืฉื ืืืืึทื ืคืื ืขืก ืฆื ืืืืคึผืึทืก ืืืึทืงืื ื, ืคึผืจืขืคืขืจืึทืืื ืึธื ืืืืขืจ ืึธื ืืืื ืืื ืึทืืข.
ืืื ืืขื ืืึธื, ืืื ืืืขื ื ืืฉื ืืึทืฉืจืืึทืื ืื ืืงืขืจืืืง ื ืขืฅ ืืื ืื ืืื ืกืืขืคึผืก, ืึธืืขืจ ืืื ืืืขื ืืึทืฉืจืืึทืื ืื ืึทืืืขืืืื ืข ืคึผืจืื ืกืึทืคึผืึทืื ืคืื ืืื ืืขื ืกืืขืืข ืงืขื ืขื ืืืื ืืืคึผืืึทืืขื ืึทื. ืึทืืื ืืืืกื ืคืื ืืื ืื ื ืขืฅ ืึทืจืืขื ืืื ืึทืืืขืืืื ืืื ืืื ืืื ืืงืก ืืื ืืึทืืื ืืขืจ ืืื ืึท ืืืื ืืึธืื.
ืืืืคึผืก ืคืื ืืึทืงืก
ืงืืื ืืืืืจ ืืขืจืคืจืืฉื ืืื ืืขืจ ืืืจืื ืคืื ืืืืก ืืขื ืืืืงืืจื.
ืขืก ืืขื ืขื ืขืืืขืืข ืืืืคึผืก ืคืื ืืึทืงืก ืืื ืื ืึทื ืืึธืืืื ืงืกืื ืคึฟืื RKN:
- IP
- ืคืขืื
- URL
ืคึฟืึทืจ ืคึผืึทืฉืืขืก, ืืืจ ืืืขืื ืจืขืืืฆืืจื ืืื ืฆื ืฆืืืื: IP ืืื ืคืขืื, ืืื ืืืจ ืืืขืื ืคืฉืื ืฆืืขื ืื ืคืขืื ืคืื ืืืึทืงืื ื ืืืจื URL (ืืขืจ ืืขื ืื, ืืื ืืึธืื ืฉืืื ืืขืืื ืืึธืก ืคึฟืึทืจ ืืื ืื).
ืืืืข ืืขื ืืฉื ืคืื ืืืื ืืขืืขื ืึท ืืืื ืืขืจืืขื , ืืืจื ืืืึธืก ืืืจ ืงืขื ืขื ืืึทืงืืืขื ืืืึธืก ืืืจ ืืึทืจืคึฟื:
- IP:
- ืืึธืืืืื ื:
ืึทืงืกืขืก ืฆื ืืคืืขืฉืืขืื ืืืืืืขื
ืฆื ืืึธื ืืึธืก, ืืืจ ืืึทืจืคึฟื ืขืืืขืืข ืงืืืื ืคืจืขืื ืืืคึผืก, ืคึผืจืขืคืขืจืึทืืื ืืื ืึทื ืืืืึทืืึทื ืคืึทืจืงืขืจ - ืขืก ืืขื ืขื ืคืืืข ืคืื โโโโืืื ืคึฟืึทืจ 3-5 ืืึทืงืก. ืืืจ ืืึทืจืคึฟื ืฆื ื ืขืืขื ืขืก ืืื ืื ืืขืื ืืืืกืืื ื ืึทืืื ืึทื ืื ืคึผืื ื ืืื ื ืืฉื ืืืืขืจ ืืจืืืก, ืึธืืขืจ ืืืืืขืจ, ื ืขืืขื ืืื ืืฉืืื ืึทื ืื ืืื ืืขืจื ืขื ืืื ืืขืึธืืจืึทืคื ืืึธื ื ืื ืฉืืขื ืืืง ืฆืื ืืืคืคืึทืื. ืืื ืืื ื ืขืก ืืื ืงืืื SLA ืคึฟืึทืจ 5 ืืึทืงืก, ืขืก ืืื ืืขืกืขืจ ืฆื ื ืขืืขื 2+ ืืจืขืงืืขื ืคืื ืคืึทืจืฉืืืขื ืข ืคึผืจืึทืืืืืืขืจื ืคึฟืึทืจ ืฉืืื ืืึธืืขืจืึทื ืฅ.
ืืืืึทืืขืจ, ืืืจ ืืึทืจืคึฟื ืฆื ืฉืืขืื ืึทืจืืืฃ ืึท ืื ืงืจืืคึผืืื ืืื ืขื ืคืื ืื ืงืืืขื ื ืจืึทืืืขืจ ืฆื ืื ืืืคึผืก. ืืื ื ืืฆื Wireguard ืืื ืื ืคืึทืกืืึทืกื ืืื ืืืืึทืกื ืฆื ืฉืืขืื ืึทืจืืืฃ. ืืื ืืืื ืืึธืื ืงืืืขื ื ืจืึธืืืขืจืก ืืืืืจื ืืืืฃ ืืื ืืงืก ( ืึธืืขืจ ืขืคึผืขืก ืืื OpenWRT). ืืื ืืขื ืคืึทื ืคืื ืขืืืขืืข ืืืงืจืึธืืืง / ืกืืกืงืึธ, ืืืจ ืงืขื ืขื ื ืืฆื ืื ืคึผืจืึธืืึธืงืึธืืก ืื ืืืฆื ืืืืฃ ืืื ืืื OpenVPN ืืื GRE-over-IPSEC.
ืืขืืืืืืึทืฆืืข ืืื ืจืืืขืจืขืงืฉืึทื ืคืื ืคืึทืจืงืขืจ ืคืื ืืื ืืขืจืขืก
ืืืจ ืงืขื ืขื, ืคืื ืงืืจืก, ืงืขืจ ืึทืืืขืง ืึทืืข ืืื ืืขืจื ืขื ืคืึทืจืงืขืจ ืืืจื ืคืจืขืื ืืขื ืืขืจ. ืึธืืขืจ, ืจืืึฟ ืืกืชึผืื, ืื ืืืืงืืึทื ืคืื ืืจืืขืื ืืื ืืืืข ืืื ืืึทืื ืืืขื ืืืึทืื ืืืืขืจ ืคืื ืืขื. ืคึผืืืก, ืื ืืึทื ืืืืืื ืจืขืงืืืืจืขืืขื ืฅ ืืืืฃ VPS ืืืขื ืืืื ืคืื ืืขืืขืจ.
ืืขืจืืืขืจ, ืืืจ ืืึทืจืคึฟื ืฆื ืขืคืขืก ืึทืืึทืงืืื ืคืึทืจืงืขืจ ืฆื ืืคืืขืฉืืขืื ืืืืืืขื ืืื ืกืึทืืขืงืืืืืื ืืืจืขืงื ืขืก ืฆื ืืขื ืืื ืขื. ืืคืืื ืืืื ืืืื ืคืื ืื "ืขืงืกืืจืข" ืคืึทืจืงืขืจ ืงืืื ืืึธืจื, ืขืก ืืื ื ืึธื ืคืื ืืขืกืขืจ ืืื ืคืึธืจ ืึทืืฅ ืืืจื ืืขื ืืื ืขื.
ืฆื ืคืืจื ืคืึทืจืงืขืจ, ืืืจ ืืืขืื ื ืืฆื ืื BGP ืคึผืจืึธืืึธืงืึธื ืืื ืืขืืื ืจืืฅ ืฆื ืื ื ืืืืืง ื ืขืืืืึธืจืงืก ืคึฟืื ืืื ืืืขืจ ืืืคึผืก ืฆื ืงืืืืึทื ืฅ. ืืึธืืืจ ื ืขืืขื BIRD ืืื ืืืื ืขืจ ืคืื ืื ืืขืจืกื ืคืึทื ืืงืฉืึทื ืึทื ืืื ืืึทืงืืืขื BGP ืืขืืึธื ืก.
IP
ืืื ืืืึทืงืื ื ืืืจื IP, ืึทืืฅ ืืื ืงืืึธืจ: ืืืจ ืคืฉืื ืืขืืื ืึทืืข ืืคืืขืฉืืขืื IPs ืืื VPS. ืืขืจ ืคึผืจืึธืืืขื ืืื ืึทื ืขืก ืืขื ืขื ืืืขืื 600 ืืืืื ื ืกืืื ืขืฅ ืืื ืืขืจ ืจืฉืืื ืืืึธืก ืื API ืงืขืจื, ืืื ืื ืืืึทืกื ืืขืจืืืึทื ืคืื ืืื ืืขื ืขื /32 ืืื ืืช. ืื ื ืืืขืจ ืคืื ืจืืฅ ืงืขื ืขื ืฆืขืืืฉื ืฉืืืึทื ืงืืืขื ื ืจืึธืืืขืจืก.
ืืขืจืืืขืจ, ืืืขื ืคึผืจืึทืกืขืกืื ื ืื ืจืฉืืื, ืขืก ืืื ืืึทืฉืืึธืกื ืฆื ืกืึทืืขืจืืื ืึทืจืืืฃ ืฆื ืื ื ืขืฅ / 24 ืืืื ืขืก ืืื 2 ืึธืืขืจ ืืขืจ ืืื ืืช. ืืืื, ืื ื ืืืขืจ ืคืื ืจืืฅ ืืื ืจืืืืกื ืฆื ~ 100 ืืืืื ื. ืืขืจ ืฉืจืืคื ืคึฟืึทืจ ืืขื ืืืขื ื ืึธืืคืึธืืื.
ืืึธืืืืื ื
ืขืก ืืื ืืขืจ ืงืึธืืคึผืืืฆืืจื ืืื ืขืก ืืขื ืขื ืขืืืขืืข ืืืขืื. ืคึฟืึทืจ ืืืึทืฉืคึผืื, ืืืจ ืงืขื ืขื ืื ืกืืึทืืืจื ืึท ืืจืึทื ืกืคึผืขืจืึทื ื ืกืงืืืื ืืืืฃ ืืขืืขืจ ืงืืืขื ื ืจืึทืืืขืจ ืืื ืืึธื ืืืืคึผ ืื ืืขืจืกืขืคึผืฉืึทื ืืึธืจื ืืื ืคึผืืคึผืก ืืื ืื TLS ืืึทื ืืฉืืืง ืฆื ืืึทืงืืืขื ืื ืืขืืขืื URL ืืื ืืขืจ ืขืจืฉืืขืจ ืคืึทื ืืื ืื ืคืขืื ืคืื SNI ืืื ืื ืจืืข.
ืึธืืขืจ ืจืขืื ืฆื ืึทืืข ืกืึธืจืฅ ืคืื ื ืืึท-ืคืึทื ืืืึทืื TLS1.3 + eSNI, HTTPS ืึทื ืึทืืืกืืก ืืืขืจื ืืืืื ืืงืขืจ ืืื ืืืืื ืืงืขืจ ืคืึทืงืืืฉ ืืขืืขืจ ืืึธื. ืืึธ, ืืื ืื ืื ืคืจืึทืกืืจืึทืงืืฉืขืจ ืืืืฃ ืื ืงืืืขื ื ืืืึทื ืืื ืฉืืื ืืขืจ ืงืึธืืคึผืืืฆืืจื - ืืืจ ืืืขื ืืึธืื ืฆื ื ืืฆื ืืคึผืืืช OpenWRT.
ืืขืจืืืขืจ, ืืื ืืึทืฉืืึธืกื ืฆื ื ืขืืขื ืืขื ืืืขื ืคืื ืื ืืขืจืกืขืคึผืืื ื ืจืขืกืคึผืึธื ืกืขืก ืฆื ืื ืก ืจืืงืืืขืก. ืืึธ ืืืื, ืงืืื DNS-over-TLS / HTTPS ืืืืื ืฆื ืืึทืืืขืจ ืืืืขืจ ืืืื ืงืึธืคึผ, ืึธืืขืจ ืืืจ ืงืขื ืขื (ืืขืจืืืืื) ืงืึธื ืืจืึธืืืจื ืืขื ืืืื ืืืืฃ ืืขื ืงืืืขื ื - ืึธืืขืจ ืืืกืืืืึทื ืขืก ืึธืืขืจ ื ืืฆื ืืืื ืืืืืขื ืข ืกืขืจืืืขืจ ืคึฟืึทืจ ืืึธื / ืืึธื.
ืืื ืฆื ืื ืืขืจืกืขืคึผื DNS?
ืืืื ืืึธ, ืขืก ืงืขื ืืืื ืขืืืขืืข ืึทืคึผืจืึธืืืฉืื.
- ืื ืืขืจืกืขืคึผืฉืึทื ืคืื ืื ืก ืคืึทืจืงืขืจ ืืืจื PCAP ืึธืืขืจ NFLOG
ืืืืืข ืื ืืขืืืึธืืก ืคืื ืื ืืขืจืกืขืคึผืฉืึทื ืืขื ืขื ืืืคึผืืึทืืขื ืึทื ืืื ืื ื ืืฆื . ืืืขืจ ืขืก ืืื ื ืืฉื ืืขืฉืืืฆื ืคึฟืึทืจ ืึท ืืึทื ื ืฆืืึทื ืืื ืื ืคืึทื ืืงืฉืึทื ืึทืืืื ืืื ืืืืขืจ ืคึผืจืืืืืืื, ืึทืืื ืืืจ ื ืึธื ืืึทืจืคึฟื ืฆื ืฉืจืืึทืื ืึท ืืึทืจื ืืก ืคึฟืึทืจ ืขืก. - ืึทื ืึทืืืกืืก ืคืื ืื ืก ืกืขืจืืืขืจ ืืึธืืก
ืฆืื ืืึทืืืืขืจื, ืื ืจืขืงืืจืกืึธืจืก ืืืงืื ื ืฆื ืืืจ ืืขื ืขื ื ืืฉื ืืืืืืช ืฆื ืงืืึธืฅ ืจืขืกืคึผืึธื ืกืขืก, ืึธืืขืจ ืืืืื ืจืืงืืืขืก. ืืื ืคึผืจืื ืฆืืคึผ, ืืึธืก ืืื ืืึทืืืฉืืงืึทื, ืืืืึทื, ื ืื ืขื ืืขื ืจืืงืืืขืก, ืขื ืืคึฟืขืจืก ืืึธืื ืึท ืงืึธืืคึผืืขืงืก ืกืืจืืงืืืจ ืืื ืขืก ืืื ืฉืืืขืจ ืฆื ืฉืจืืึทืื ืืื ืืื ืืขืงืกื ืคืึธืจืขื.
ืฆืื ืืืืง, ืคืืืข ืคืื โโืืื ืฉืืื ืฉืืืฆื DNSTap ืคึฟืึทืจ ืืขื ืฆืืืขืง.
ืืืึธืก ืืื DNSTap?
ืขืก ืืื ืึท ืงืืืขื ื-ืกืขืจืืืขืจ ืคึผืจืึธืืึธืงืึธื ืืืืืจื ืืืืฃ ืคึผืจืึธืืึธืงืึธื ืืึทืคืขืจืก ืืื ืจืึทื ืกืืจืขืึทืืก ืคึฟืึทืจ ืืจืึทื ืกืคืขืจืื ื ืคืื ืึท ืื ืก ืกืขืจืืืขืจ ืฆื ืึท ืืึทืืืขืจ ืคืื ืกืืจืึทืงืืฉืขืจื ืื ืก ืคึฟืจืืื ืืื ืจืขืกืคึผืึธื ืกืขืก. ืืกืขื ืฉืึทืื, ืื ืื ืก ืกืขืจืืืขืจ ืืจืึทื ืกืืืฅ ืึธื ืคึฟืจืขื ืืื ืขื ืืคืขืจ ืืขืืึทืืึทืืึท (ืืืคึผ ืคืื ืึธื ืืึธื, ืงืืืขื ื / ืกืขืจืืืขืจ IP, ืืื"ื ื) ืคึผืืืก ืืึทื ืฅ ืื ืก ืึทืจืืืงืืขื ืืื ืื (ืืืื ืขืจื) ืคืึธืจืขื ืืื ืืืึธืก ืขืก ืึทืจืืขื ืืื ืืื ืืืืขืจ ืื ื ืขืฅ.
ืขืก ืืื ืืืืืืืง ืฆื ืคึฟืึทืจืฉืืืื ืึทื ืืื ืื DNSTap ืคึผืึทืจืึทืืืื, ืื ืื ืก ืกืขืจืืืขืจ ืึทืงื ืืื ืึท ืงืืืขื ื ืืื ืืขืจ ืืึทืืืขืจ ืึทืงื ืืื ืึท ืกืขืจืืืขืจ. ืึทื ืืื, ืื ืื ืก ืกืขืจืืืขืจ ืงืึทื ืขืงืฅ ืฆื ืื ืงืึทืืขืงืืขืจ, ืืื ื ืืฉื ืืืืฆืข ืืืขืจืกืึท.
ืืืึทื ื DNSTap ืืื ืืขืฉืืืฆื ืืื ืึทืืข ืคืึธืืงืก ืื ืก ืกืขืจืืืขืจืก. ืึธืืขืจ, ืคึฟืึทืจ ืืืึทืฉืคึผืื, BIND ืืื ืคืืืข ืืืกืืจืืืืืฉืึทื ื (ืืื Ubuntu LTS) ืืื ืึธืคื ืืขืืืื ืคึฟืึทืจ ืขืืืขืืข ืกืืื ืึธื ืฉืืืฆื. ืึทืืื ืืึธืื ืืื ืื ื ืืฉื ืึทืจื ืืื ืจืืึทืกืขืืืึทืืื ื, ืึธืืขืจ ื ืขืืขื ืึท ืืืืืขืจ ืืื ืคืึทืกืืขืจ ืจืขืงืืจืกืึธืจ - ืื ืืึทืื ื.
ืืื ืฆื ืืึทืคึผื DNSTap?
ืขืก ืื ืคืึทืจืึทื CLI ืืืืืืึทืืื ืคึฟืึทืจ ืืจืืขืื ืืื ืึท ืืืึทื ืคืื DNSTap events, ืึธืืขืจ ืืื ืืขื ืขื ื ืืฉื ืคึผืึทืกืืง ืคึฟืึทืจ ืกืึทืืืืื ื ืืื ืืืขืจ ืคึผืจืึธืืืขื. ืืขืจืืืขืจ, ืืื ืืึทืฉืืึธืกื ืฆื ืืืืกืืจืึทืืื ืืืื ืืืืื ืืืขืืึธืกืืคึผืขื ืืืึธืก ืืืขื ืืึธื ืึทืืฅ ืืืึธืก ืืื ื ืืืืืง:
ืึทืจืืขื ืึทืืืขืจืืืึทื:
- ืืืขื ืืึธื ืืฉื, ืขืก ืืึธืืื ืึท ืจืฉืืื ืคืื ืืึธืืืืื ื ืคืื ืึท ืืขืงืกื ืืขืงืข, ืื ืืืขืจืฅ ืืื (habr.com -> com.habr), ืืงืกืงืืืื ืฆืขืืจืืื ืฉืืจืืช, ืืืคึผืืืงืึทืื ืืื ืกืืืืึธืืึทืื ืก (ื"ื ืืืื ืื ืจืฉืืื ืึผืืื habr.com ืืื www.habr.com, ืขืก ืืืขื ืืืื ืืึธืืืื ืืืืื ืืขืจ ืขืจืฉืืขืจ) ืืื ืืืืขื ืึท ืคึผืจืขืคืืงืก ืืืื ืคึฟืึทืจ ืฉื ืขื ืืืื ืืืจื ืืขื ืจืฉืืื
- ืึทืงืืื ื ืืื ืึท DNSTap ืกืขืจืืืขืจ, ืขืก ืืืืืฅ ืคึฟืึทืจ ืึท ืงืฉืจ ืคืื ืึท ืื ืก ืกืขืจืืืขืจ. ืืื ืคึผืจืื ืฆืืคึผ, ืขืก ืฉืืืฆื ืืืืืข ืืื ืืงืก ืืื ืืงืคึผ ืกืึทืงืึทืฅ, ืึธืืขืจ ืื ืื ืก ืกืขืจืืืขืจืก ืืื ืืืืกื ืงืขื ืขื ืืืืื ื ืืฆื ืืื ืืงืก ืกืึทืงืึทืฅ
- ืื ืงืึทืืื ื DNSTap ืคึผืึทืงืืฅ ืืขื ืขื ืขืจืฉืืขืจ ืืขืกืขืจืืึทืืืืขื ืืื ืึท ืคึผืจืึธืืึธืืืฃ ืกืืจืืงืืืจ, ืืื ืืขืจื ืึธื ืื ืืืื ืขืจื ืื ืก ืึธื ืืึธื ืืื, ืืืื ืืื ืืืื ืขืจ ืคืื ืื ืคึผืจืึธืืึธืืืฃ ืคืขืืืขืจ, ืืื ืคึผืึทืจืกื ืฆื ืื ืืืจืื ืคืื ืื ืก ืจืจ ืจืขืงืึธืจืืก
- ืขืก ืืื ืึธืคึผืืขืฉืืขืื ืฆื ืืขืจ ืืขืืขืื ืืึทืืขืืึธืก (ืึธืืขืจ ืืืื ืคืึธืืขืจ ืคืขืื) ืืื ืืื ืื ืืึธืืืื ืจืฉืืื, ืืืื ื ืืฉื, ืืขืจ ืขื ืืคืขืจ ืืื ืืืื ืึธืจืืจื
- ืืืืื A / AAAA / CNAME RR ืก ืืขื ืขื ืืืืกืืขืงืืืื ืคืื ืื ืขื ืืคืขืจ ืืื ืื ืงืึธืจืึทืกืคึผืึทื ืืื ื IPv4 / IPv6 ืึทืืจืขืกืขืก ืืขื ืขื ืืงืกืืจืึทืงืืื ืคืื ืืื
- IP ืึทืืจืขืกืขืก ืืขื ืขื ืงืึทืฉื ืืื ืงืึทื ืคืืืืขืจืึทืืึทื TTL ืืื ืึทืืืืขืจืืืืื ืฆื ืึทืืข ืงืึทื ืคืืืืขืจื BGP ืคึผืืจื
- ืืืขื ืืืจ ืืึทืงืืืขื ืึท ืขื ืืคืขืจ ืฆื ืึท ืฉืืื ืงืึทืฉื IP, ืื TTL ืืื ืืขืจืืืึทื ืืืงื
- ื ืึธื ืื TTL ืืงืกืคึผืืืขืจื, ืื ืคึผืึธืืืฆืืข ืืื ืึทืืืขืงืืขื ืืืขื ืคืื ืื ืงืึทืฉ ืืื ืคืื BGP ืืืืขืืช
ื ืึธื ืคืึทื ืืงืฉืึทื ืึทืืืื:
- ืจืืจืืืื ื ืื ืจืฉืืื ืคืื ืืึธืืืืื ื ืืืจื SIGHUP
- ืืึทืืื ืื ืงืึทืฉ ืืื ืกืื ืง ืืื ืื ืืขืจืข ืื ืกืืึทื ืกืื ืื ืกืืึทืคึผ-ืืืคึผ ืืืจื ืืืืคึผ / ืืืฉืกืึธื
- ืืืคึผืืืงืึทื ืื ืงืึทืฉ ืืืืฃ ืืืกืง (ืืื ืื BoltDB ืืึทืืึทืืืืก) ืฆื ืืืงืขืจื ืื ืืื ืืึทืื ื ืึธื ืึท ืจืืกืืึทืจื
- ืฉืืืฆื ืคึฟืึทืจ ืกืืืืืฉืื ื ืฆื ืึท ืึทื ืืขืจืฉ ื ืขืฅ ื ืึธืืขื (ืืืึธืก ืืึธืก ืืื ืืืจืฃ ืืืขื ืืืื ืืืกืงืจืืืื ืืื ืื)
- IPv6 ืฉืืืฆื
ืืืืืืืืฉืึทื ื:
- IDN ืืึธืืืืื ื ืืขื ืขื ื ืืฉื ืืขืฉืืืฆื ื ืึธื
- ืขืืืขืืข BGP ืกืขืืืื ืืก
ืืื ืืขืืืืื ืคึผืึทืงืึทืืืฉืึทื ืคึฟืึทืจ ืืจืื ื ืื ืกืืึทืืืจืื ื. ืืึธื ืึทืจืืขืื ืืืืฃ ืึทืืข ืืขืคืืขืจืขื ืคืจืืฉ ืึธืกืขืก ืืื ืกืืกืืขื. ืืื ืืึธื ื ืื ืืึธืื ืงืืื ืืืคึผืขื ืืึทื ืกืื.
ืกืืขืืข
ืึทืืื, ืืึธืื 'ืก ืึธื ืืืืื ืึทืกืขืืืึทืืื ื ืึทืืข ืื ืงืึทืืคึผืึธืื ืึทื ืฅ ืฆืืืึทืืขื. ืืื ืึท ืจืขืืืืืึทื, ืืืจ ืืึธื ืืึทืงืืืขื ืขืคึผืขืก ืืื ืืขื ื ืขืฅ ืืึธืคึผืึธืืึธืื:
ืื ืืึธืืืง ืคืื ืึทืจืืขื, ืืื ืืจืึทืืื, ืืื ืงืืึธืจ ืคืื ืื ืืืึทืืจืึทืืข:
- ืืขืจ ืงืืืขื ื ืืื ืืื ืืืขืจ ืกืขืจืืืขืจ ืงืึทื ืคืืืืขืจื ืืื ืื ืก, ืืื ืื ืก ืงืืืืจืื ืืืื ืืืื ืืืื ืืืืขืจ ืื ืืืคึผื. ืืึธืก ืืื ื ืืืืืง ืึทืืื ืึทื ืืขืจ ืฉืคึผืืึทืืขืจ ืงืขื ื ืืฉื ื ืืฆื ืื ืก ืื ืืขืจืกืขืคึผืฉืึทื ืฆื ืคืึทืจืฉืคึผืึทืจื.
- ืืืขื ืขืคื ืืขื ืคึผืืึทืฅ, ืืขืจ ืงืืืขื ื ืกืขื ืื ืึท ืื ืก ืึธื ืคึฟืจืขื ืืื "ืืืึธืก ืืขื ืขื ืื IPs ืคืื xxx.org"
- ืื ืืึธืื ื ืกืึทืืืื xxx.org (ืึธืืขืจ ื ืขืื ืขืก ืคืื ืื ืงืึทืฉ) ืืื ืกืขื ืื ืึท ืขื ืืคืขืจ ืฆื ืืขื ืงืืืขื ื "xxx.org ืืื ืึทืืึท ืืื ืึทืืึท IP", ืืืคึผืืืงืึทื ืขืก ืคึผืึทืจืึทืืขื ืืืจื DNSTap
- ืื ืกืืึทืคึผ-ืืืคึผ ืึทื ืึทืื ืกืื ืื ืึทืืจืขืกืขืก ืืื ืคืืืื ืืืจื BGP ืืืื ืื ืคืขืื ืืื ืืืืฃ ืื ืืคืืขืฉืืขืื ืจืฉืืื
- ืคืืืื ืึทืืืืขืจืืืืืื ืึท ืืึทืจืฉืจืื ืฆื ืื IPs ืืื
next-hop selfืงืืืขื ื ืจืึทืืืขืจ - ืกืึทืืกืึทืงืืืึทื ื ืคึผืึทืงืืฅ ืคืื ืืขื ืงืืืขื ื ืฆื ืื IPs ืืืื ืืืจื ืืขื ืืื ืขื
ืืืืฃ ืื ืกืขืจืืืขืจ, ืคึฟืึทืจ ืจืืฅ ืฆื ืืคืืขืฉืืขืื ืืืืืืขื, ืืื ื ืืฆื ืึท ืืึทืืื ืืขืจ ืืืฉ ืื BIRD ืืื ืขืก ืืื ื ืืฉื ืื ืืขืจืกืขืงื ืืื ืื ืึทืก ืืื ืงืืื ืืืขื.
ืืขืจ ืกืืขืืข ืืื ืึท ืฉืืขืจืื ื: ืืขืจ ืขืจืฉืืขืจ SYN ืคึผืึทืงืึทื ืคืื ืืขื ืงืืืขื ื, ืจืืึฟ ืืกืชึผืื, ืืืขื ืืึธืื ืฆืืื ืฆื ืืึธืื ืืืจื ืื ืืื ืขืจ ืฉืคึผืืึทืืขืจ. ืืขืจ ืืึทืจืฉืจืื ืืื ื ืืฉื ืืืืืข ืืื. ืืื ืืึธ ืึธืคึผืฆืืขืก ืืขื ืขื ืืขืืืขื ืืืคึผืขื ืืื ื ืืืืฃ ืืื ืืขืจ ืฉืคึผืืึทืืขืจ ืืื ืื ืืืึทืงืื ื. ืืืื ืขืจ ื ืึธืจ ืืจืืคื ืก ืคืึทืจืงืขืจ, ืขืก ืืื ืงืืื ืคึผืจืึธืืืขื. ืืื ืืืื ืขืจ ืจืืืขืจืขืงืฅ ืขืก ืฆื ืขืืืขืืข ืืคึผื, ืืขืืึธืื (ืืขืึธืจืขืืืฉ) ืกืคึผืขืฆืืขื ืืคืขืงืฅ ืืขื ืขื ืืขืืืขื.
ืขืก ืืื ืืืื ืืขืืืขื ืึทื ืงืืืืึทื ืฅ ืืึธื ื ืื ืจืขืกืคึผืขืงื ืื DNS TTL ืืืจืึทืงืึทืื, ืืืึธืก ืงืขื ืขื ืึธื ืืึทืื ืืขื ืงืืืขื ื ืฆื ื ืืฆื ืขืืืขืืข ืึทืื - ืืขืืึทืงื ืืืื ืกื ืคึฟืื ืืืื ืคึผืึทืกืงืืื ืข ืงืึทืฉ ืึทื ืฉืืึธื ืคืื ืึทืกืงืื ื ืึทื ืืึทืื ื.
ืืื ืคืืจ, ื ืื ืืขืจ ืขืจืฉืืขืจ ืืืขืจ ืื ืจืืข ืืขืคึฟืืจื ืคึผืจืึธืืืขืืก ืคึฟืึทืจ ืืืจ, ืึธืืขืจ ืืืื ืืืืืืืืฉ ืงืขื ืืืึทืื.
ืกืขืจืืืืจืขืจ ืืื ืื ื
ืคึฟืึทืจ ืื ืคืื ืจืึธืืืื ื, ืืื ืืขืฉืจืืื . ืขืก ืงืขื ืขื ืงืึทื ืคืืืืขืจ ืืืืืข ืกืขืจืืืขืจืก ืืื ืงืืืืึทื ืฅ ืืืืืจื ืืืืฃ ืืื ืืงืก (ืืืืืื ื ืคึฟืึทืจ ืืขื-ืืืืืจื ืืืกืืจืืืืืฉืึทื ื). ืึทืืข ืกืขืืืื ืืก ืืขื ืขื ืืึทื ืฅ ืงืืึธืจ ืืื ืืขืจ ืืึธื ืืื ืืขื ืขื ืฉืืขืื ืืื inventory.yml. ืื ืจืึธืืข ืืื ืฉื ืืึทืื ืคึฟืื ืืืื ืืจืืืก ืคึผืืืึทืืึธืึธืง, ืึทืืื ืขืก ืงืขื ืึทื ืืืึทืืื ืขืจืจืึธืจืก - ืืึทืืจืืกืื ื ๐
ืืื ืก ืืืื ืืืจื ืื ืืืืคึผื ืงืึทืืคึผืึธืื ืึทื ืฅ.
BGP
ืคืืืกื ืืืง ืฆืืืื BGP ืืขืืึธื ืก ืืืืฃ ืืขืจ ืืขืืืืงืขืจ ืืึทืืขืืึธืก ืืื ืึท ืคืื ืืึทืืขื ืืึทื ืคึผืจืึธืืืขื: BIRD ืืื ื ืืฉื ืืืขืื ืฆื ืฉืืขืื BGP ืคึผืืจืื ื ืืื ืื ืืึธืงืึทืืืึธืกื (ืึธืืขืจ ืงืืื ืืืืข ืฆืืืื ื). ืคืื ืื ืืืึธืจื ืืืื. ืืึธืึธืืืื ื ืืื ืืืืขื ืขื ืืืืืื ื ืจืฉืืืืช ืืื ื ืืฉื ืืขืืึธืืคึฟื, ืืื ืคืึธืืขืจื ืึทื ืืึธืก ืืื ืืืจื ืคึผืืึทื. ืืคืฉืจ ืืื ืื ื ืืืขื, ืืืขืจ ืืื ืืื ืขืก ื ืืฉื ืืขืคืื ืขื.
ืืืจ ืงืขื ืขื ืคึผืจืืืืจื ืื ืื ืืขืจ BGP ืืืืืึทื, ืึธืืขืจ ืืื ืืื BIRD ืืื ืขืก ืืื ืืขื ืืฆื ืืืืขืืื ืืืจื ืืืจ, ืืื ืืึธื ื ืืฉื ืืืขืื ืฆื ืคึผืจืึธืืืฆืืจื ืขื ืืืืื.
ืืขืจืคึฟืึทืจ ืืึธื ืืื ืืึทืืึทืืื dnstap-bgp ืืื ืื ื ืขืฅ ื ืึธืืขื ืกืคึผืืืก, ืืืึธืก ืืื ืคืืจืืื ืื ืฆื ืืขืจ ืืืึธืจืฆื ืืืจื ืื ืืืขืื ืฆืืืื ื: ืขืก ืืื ืืื ืึท ืจืขืจ, ืื ืขื ืืก ืคืื ืืืึธืก ืฉืืขืงื ืืืืก ืืื ืคืึทืจืฉืืืขื ืข ื ืึทืืขืกืคึผืึทืกืขืก. ืืืืฃ ืืขืืขืจ ืคืื ืื ืขื ืืก, ืืืจ ืืขื ืืขื ืคึผืจืืืืึทื ืคึผ 2 ืคึผ IP ืึทืืจืขืกืขืก ืืืึธืก ืืึธื ื ืื ืืืื ืืืืึทืืขืจ ืคืื ืืขืจ ืืึทืืขืืึธืก, ืึทืืื ืืื ืงืขื ืขื ืืืื ืขืคึผืขืก. ืืึธืก ืืื ืืขืจ ืืขืืืืงืขืจ ืืขืงืึทื ืืืึทื ืืขื ืืฆื ืฆื ืึทืงืกืขืก ืคึผืจืึทืกืขืกืึทื ืื ืืื ืืขืืื ืืืจื ืึทืืข ืืึธืงืงืขืจ ืืื ืื ืืขืจืข ืงืึทื ืืืื ืขืจื.
ืคึฟืึทืจ ืืขื ืขืก ืืื ืืขืืืขื ืืขืฉืจืืื ืืื ืื ืคืึทื ืืงืฉืึทื ืึทืืืื ืฉืืื ืืืกืงืจืืืื ืืืืื ืคึฟืึทืจ ืฉืืขืคึผื ืืื ืืื ืื ืืึธืจ ืฆื ืื ืื ืืขืจ ื ืึธืืขื ืคึผืืึทืฅ ืืื ืฆืืืขืืขืื ืฆื dnstap-bgp. ืืืืึทื ืคืื ืืขื, ืขืก ืืืื ืืืื ืืืืคื ืืื ืืืึธืจืฆื ืึธืืขืจ ืืจืืืก ืฆื ืื CAP_SYS_ADMIN ืืืื ืขืจื ืืืจื ืื ืกืขืืงืึทืคึผ ืืึทืคึฟืขื.
ืืืึทืฉืคึผืื ืฉืจืืคื ืคึฟืึทืจ ืงืจืืืืืื ื ื ืึทืืขืกืคึผืึทืกืข
#!/bin/bash
NS="dtap"
IP="/sbin/ip"
IPNS="$IP netns exec $NS $IP"
IF_R="veth-$NS-r"
IF_NS="veth-$NS-ns"
IP_R="192.168.149.1"
IP_NS="192.168.149.2"
/bin/systemctl stop dnstap-bgp || true
$IP netns del $NS > /dev/null 2>&1
$IP netns add $NS
$IP link add $IF_R type veth peer name $IF_NS
$IP link set $IF_NS netns $NS
$IP addr add $IP_R remote $IP_NS dev $IF_R
$IP link set $IF_R up
$IPNS addr add $IP_NS remote $IP_R dev $IF_NS
$IPNS link set $IF_NS up
/bin/systemctl start dnstap-bgpdnstap-bgp.conf
namespace = "dtap"
domains = "/var/cache/rkn_domains.txt"
ttl = "168h"
[dnstap]
listen = "/tmp/dnstap.sock"
perm = "0666"
[bgp]
as = 65000
routerid = "192.168.149.2"
peers = [
"192.168.149.1",
]bird.conf
router id 192.168.1.1;
table rkn;
# Clients
protocol bgp bgp_client1 {
table rkn;
local as 65000;
neighbor 192.168.1.2 as 65000;
direct;
bfd on;
next hop self;
graceful restart;
graceful restart time 60;
export all;
import none;
}
# DNSTap-BGP
protocol bgp bgp_dnstap {
table rkn;
local as 65000;
neighbor 192.168.149.2 as 65000;
direct;
passive on;
rr client;
import all;
export none;
}
# Static routes list
protocol static static_rkn {
table rkn;
include "rkn_routes.list";
import all;
export none;
}rkn_routes.list
route 3.226.79.85/32 via "ens3";
route 18.236.189.0/24 via "ens3";
route 3.224.21.0/24 via "ens3";
...ืื ืก
ืืืจื ืคืขืืืงืืึทื, ืืื ืืืื ืื, ืื ืื ืืึทืื ื ืืืื ืขืจื ืืื ืงืืึทืืคึผื ืืืจื ืื ืึทืคึผืคึผืึทืจืืึธืจ ืคึผืจืึธืคืื, ืืืึธืก ืคืึทืจืืืขืจื ืขืก ืคืื ืงืึทื ืขืงืืื ื ืฆื ืึทืืข ืกืึธืจืฅ ืคืื DNSTap ืกืึทืงืึทืฅ. ืืืจ ืงืขื ื ืืืกืืขืงื ืืขื ืคึผืจืึธืคืื ืึธืืขืจ ืืืกืืืืึทื ืขืก:
# cd /etc/apparmor.d/disable && ln -s ../usr.sbin.unbound .
# apparmor_parser -R /etc/apparmor.d/usr.sbin.unboundืืึธืก ืืึธื ืืืกืืึธืืข ืืืื ืืืกืืฃ ืฆื ืื ืคึผืืืึทืืึธืึธืง. ืขืก ืืื ืืืขืึทื, ืคืื ืงืืจืก, ืฆื ืคืึทืจืจืืืื ืืขื ืคึผืจืึธืคืื ืืื ืึทืจืืืกืืขืื ืื ื ืืืืืง ืจืขืื, ืึธืืขืจ ืืื ืืื ืืขืืืขื ืฆื ืคืืื.
unbound.conf
server:
chroot: ""
port: 53
interface: 0.0.0.0
root-hints: "/var/lib/unbound/named.root"
auto-trust-anchor-file: "/var/lib/unbound/root.key"
access-control: 192.168.0.0/16 allow
remote-control:
control-enable: yes
control-use-cert: no
dnstap:
dnstap-enable: yes
dnstap-socket-path: "/tmp/dnstap.sock"
dnstap-send-identity: no
dnstap-send-version: no
dnstap-log-client-response-messages: yesืืึทืื ืืึธืืืื ื ืืื ืคึผืจืึทืกืขืกืื ื ืจืฉืืืืช
ืขืก ืืึทืื ืืึธืืื ืื ืจืฉืืื, ืกืึทืื ืึทืจืืืฃ ืฆื ืื ืคึผืจืขืคืืงืก pfx. ืื ืืึธื ื ืื_ืึทืื ะธ ืืึธื ื ืื_ืกืืืขืจืืื ืืืจ ืงืขื ืขื ืืึธืื ืื IPs ืืื ื ืขืืืืึธืจืงืก ืฆื ืืึธืคึผืงืขื ืึธืืขืจ ื ืืฉื ืกืึทืืขืจืืื. ืืื ืืืจืฃ ืขืก. ืื ืกืืื ืขื ืคืื ืืืื ืืืคึผืก ืืื ืืขืืืขื ืืื ืื ืืืึทืงืืืกื ๐
ืื ืืึธืื ืข ืืึทื ืืื ืึทื ืื RosKomSvoboda API ืืืึทืงืก ืจืืงืืืขืก ืืื ืื ืคืขืืืงืืึทื ืคึผืืืืึธื ืืึทื ืืฆืขืจ ืึทืืขื ื. ืงืืงื ืืื ืืขืจ ืฉืจืืคื-ืงืืื ืืื ืขืก. ืืขืจืืืขืจ, ืืืจ ืืืืฉื ืขืก ืฆื Ognelis.
ืืื ืืืฆื, ืขืก ืึทืจืืขื ืืืืื ืืื IPv4. ืื ืืืืื ืคืื IPv6 ืืื ืงืืืื, ืึธืืขืจ ืขืก ืืืขื ืืืื ืืจืื ื ืฆื ืคืึทืจืจืืืื. ืกืืึทืื ืืืจ ืืึธืื ืฆื ื ืืฆื bird6 ืืืื.
rkn.py
#!/usr/bin/python3
import json, urllib.request, ipaddress as ipa
url = 'https://api.reserve-rbl.ru/api/v2/ips/json'
pfx = '24'
dont_summarize = {
# ipa.IPv4Network('1.1.1.0/24'),
}
dont_add = {
# ipa.IPv4Address('1.1.1.1'),
}
req = urllib.request.Request(
url,
data=None,
headers={
'User-Agent': 'Mozilla/5.0 (Macintosh; Intel Mac OS X 10_9_3) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/35.0.1916.47 Safari/537.36'
}
)
f = urllib.request.urlopen(req)
ips = json.loads(f.read().decode('utf-8'))
prefix32 = ipa.IPv4Address('255.255.255.255')
r = {}
for i in ips:
ip = ipa.ip_network(i)
if not isinstance(ip, ipa.IPv4Network):
continue
addr = ip.network_address
if addr in dont_add:
continue
m = ip.netmask
if m != prefix32:
r[m] = [addr, 1]
continue
sn = ipa.IPv4Network(str(addr) + '/' + pfx, strict=False)
if sn in dont_summarize:
tgt = addr
else:
tgt = sn
if not sn in r:
r[tgt] = [addr, 1]
else:
r[tgt][1] += 1
o = []
for n, v in r.items():
if v[1] == 1:
o.append(str(v[0]) + '/32')
else:
o.append(n)
for k in o:
print(k)
ืืื ืืืืคื ืขืก ืืืืฃ ืื ืงืจืืื ืึทืืึธื ืึท ืืึธื, ืืคึฟืฉืจ ืขืก ืืื ืืืขืจื ืคึผืืืื ื ืขืก ืืขืืขืจ 4 ืฉืขื. ืืึธืก ืืื, ืืืื ืืืื ืืืื ืื ื, ืื ืจืื ืืึทื ืฆืืึทื ืืืึธืก ืื ืจืงื ืคืืจืืื ืื ืคืื ืคึผืจืึทืืืืืืขืจื. ืคึผืืืก, ืืื ืืึธืื ืขืืืขืืข ืื ืืขืจืข ืกืืคึผืขืจ-ืืจืื ืืืขื ืืืึทืงืื ื, ืืืึธืก ืงืขื ืึธื ืงืืืขื ืคืึทืกืืขืจ.
ืืื ืื ืคืืืืขื ืืข:
- ืืืืคื ืืขืจ ืขืจืฉืืขืจ ืฉืจืืคื ืืื ืืขืจืืืึทื ืืืงื ืื ืจืฉืืื ืคืื ืจืืฅ (
rkn_routes.list) ืคึฟืึทืจ ืคืืืื - ืจืืืึธืื ืคืืืื
- ืืขืจืืืึทื ืืืงืื ืืขื ืืื ืงืืื ื ืื ืจืฉืืื ืคืื ืืึธืืืืื ื ืคึฟืึทืจ dnstap-bgp
- ืจืืืึธืื ืnstap-bgp
rkn_update.sh
#!/bin/bash
ROUTES="/etc/bird/rkn_routes.list"
DOMAINS="/var/cache/rkn_domains.txt"
# Get & summarize routes
/opt/rkn.py | sed 's/(.*)/route 1 via "ens3";/' > $ROUTES.new
if [ $? -ne 0 ]; then
rm -f $ROUTES.new
echo "Unable to download RKN routes"
exit 1
fi
if [ -e $ROUTES ]; then
mv $ROUTES $ROUTES.old
fi
mv $ROUTES.new $ROUTES
/bin/systemctl try-reload-or-restart bird
# Get domains
curl -s https://api.reserve-rbl.ru/api/v2/domains/json -o - | jq -r '.[]' | sed 's/^*.//' | sort | uniq > $DOMAINS.new
if [ $? -ne 0 ]; then
rm -f $DOMAINS.new
echo "Unable to download RKN domains"
exit 1
fi
if [ -e $DOMAINS ]; then
mv $DOMAINS $DOMAINS.old
fi
mv $DOMAINS.new $DOMAINS
/bin/systemctl try-reload-or-restart dnstap-bgpืืื ืืขื ืขื ืืขืฉืจืืื ืึธื ืคืื ืืขืืึทื ืง, ืึทืืื ืืืื ืืืจ ืืขื ืขืคึผืขืก ืืืึธืก ืงืขื ืขื ืืืื ืืืคึผืจืืืื - ืืืื ืคึฟืึทืจ ืืื.
ืงืืืขื ื ืกืขืืึทืคึผ
ืืึธ ืืื ืืืขื ืืขืื ืืืืฉืคืืื ืคึฟืึทืจ ืืื ืืงืก ืจืึธืืืขืจืก, ืึธืืขืจ ืืื ืืขื ืคืึทื ืคืื ืืืงืจืึธืืืง / ืกืืกืงืึธ ืขืก ืืึธื ืืืื ืืคืืื ืืจืื ืืขืจ.
ืขืจืฉืืขืจ, ืืืจ ืฉืืขืื ืึทืจืืืฃ BIRD:
bird.conf
router id 192.168.1.2;
table rkn;
protocol device {
scan time 10;
};
# Servers
protocol bgp bgp_server1 {
table rkn;
local as 65000;
neighbor 192.168.1.1 as 65000;
direct;
bfd on;
next hop self;
graceful restart;
graceful restart time 60;
rr client;
export none;
import all;
}
protocol kernel {
table rkn;
kernel table 222;
scan time 10;
export all;
import none;
}ืืืื, ืืืจ ืืืขืื ืกืื ืืงืจืึทื ืืื ืื ืจืืฅ ืืืงืืืขื ืคึฟืื BGP ืืื ืื ืงืขืจื ืจืืืื ื ืืืฉ ื ืืืขืจ 222.
ื ืึธื ืืขื, ืขืก ืืื ืืขื ืื ืฆื ืคืจืขืื ืื ืงืขืจื ืฆื ืงืืงื ืืื ืืขื ืืขืืขืจ ืืืืืขืจ ืืืจ ืงืืง ืืื ืื ืคืขืืืงืืึทื ืืืื ืขืจ:
# ip rule add from all pref 256 lookup 222
# ip rule
0: from all lookup local
256: from all lookup 222
32766: from all lookup main
32767: from all lookup defaultืึทืืฅ, ืขืก ืืืืืื ืฆื ืงืึทื ืคืืืืขืจ DHCP ืืืืฃ ืื ืจืึทืืืขืจ ืฆื ืคืึทืจืฉืคึผืจืืืื ืื ืืื ืขื IP ืึทืืจืขืก ืคืื ืื ืกืขืจืืืขืจ ืืื ืื ืก, ืืื ืื ืกืืขืืข ืืื ืืจืืื.
ืืืืืืืืฉืึทื ื
ืืื ืืขื ืงืจืึทื ื ืึทืืืขืจืืืึทื ืคึฟืึทืจ ืืืฉืขื ืขืจืืืืื ื ืืื ืคึผืจืึทืกืขืกืื ื ืื ืจืฉืืื ืคืื ืืึธืืืืื ื, ืขืก ืืืื, ืฆืืืืฉื ืื ืืขืจืข, youtube.com ืืื ืืืึทื CDNs.
ืืื ืืึธืก ืคืืจื ืฆื ืื ืคืึทืงื ืึทื ืึทืืข ืืืืืืืก ืืืขืื ืืืื ืืืจื ืื ืืืคึผื, ืืืึธืก ืงืขื ืขื ืคืึทืจืืืืื ืื ืืื ืฆืข ืงืึทื ืึทื. ืืึธืืขืจ ืืื ืึผืืึทื ืฆื ืืึทืื ืึท ืจืฉืืื ืคืื ืคึผืึธืคึผืืืขืจืข ืืึธืืืืื ื-ืืืืกืฉืืืกื ืืืึธืก ืคืึทืจืฉืคึผืึทืจื ืืขื ืจืงื ืืขืจืืืืื, ืื ืืขืืขืจืขื ืืื ืืื. ืืื ืืึธืคึผืงืขื ืืื ืืืขื ืคึผืึทืจืกืื ื.
ืกืึธืฃ
ืื ืืืกืงืจืืืื ืืืคึฟื ืึทืืึทืื ืืืจ ืฆื ืืืืคึผืึทืก ืึผืืขื ืงืืื ืืืึทืงืื ื ืึทื ืคึผืจืึทืืืืืืขืจื ืืขืจืืืืึทื ืื ืกืืจืืืขื ื.
ืืื ืคึผืจืื ืฆืืคึผ, ืื ืกืืึทืคึผ-ืืืคึผ ืงืขื ืขื ืืืขืจื ืืขื ืืฆื ืคึฟืึทืจ ืงืืื ืื ืืขืจืข ืฆืืืขืง ืืื ืขืืืขืืข ืืืจืื ืคืื ืคืึทืจืงืขืจ ืงืึธื ืืจืึธื ืืื ืืืจืฃ ืืืืืจื ืืืืฃ ืื ืคืขืื ื ืึธืืขื. ื ืึธืจ ืืึทืืื ืืื ืืืื ืื ื ืึทื ืืื ืืื ืืืขืจ ืฆืืื, ืึท ืืืืื ื ืืืืืืขื ืงืขื ืขื ืืขื ืืขื ืืืืฃ ืืขืจ ืืขืืืืงืขืจ IP ืึทืืจืขืก (ืืื ืืขืจ ืขืืืขืืข ืงืืึธืืืคืืึทืจืข, ืคึฟืึทืจ ืืืึทืฉืคึผืื), ืึทืืื ืืขื ืืืคึฟื ืืื ืึท ืืึทื ืฅ ื ืืืขืจืืง ืึทืงืืขืจืึทืกื.
ืืืขืจ ืคึฟืึทืจ ืื ืืืืขืจืคืขื ืืฉื ืคืื ืืืืคึผืึทืกืื ื ืืึทืงืก, ืืึธืก ืืื ืืึทื ืฅ ืืขื ืื.
ืึทืืืฉืึทื ื, ืขืืืืื ื, ืฆืืขื ืจืืงืืืขืก - ืืึทืืจืืกื!
ืืงืืจ: www.habr.com