前几天我说过，来自译言的《如何忽略防火长城》,非常精彩，这篇文章应该是GFW详细介绍的最好的文章。那篇文章里提到GFW的三种干扰网民访问网站的方法分別是关键字过滤、屏蔽境外网站IP和NS（Domain Name System）劫持，前两者比较常见，我就先不介绍如何对付前两种干扰方式，我先讲一下如何应付DNS劫持。
要了解如何应付DNS劫持，首先必须了解DNS如何实现劫持。我还是先用我的语言通俗地介绍一下DNS如何工作的吧。
DNS如何工作
DNS是域名查询系统，当人们访问一个网站时，如访问www.zuola.com， 网页瀏览器要首先查询一下这个域名对应的IP是什么，DNS返回一个IP后，瀏览器才向那个IP发出数据包，一路上，路由器会按照路由表里的地址一路朝目 標IP发过去数据包，对方主机如果认为自己的主机有这么一个网站，於是返回响应，开始传递网页给瀏览器。如果DNS服务器返回一个假的结果给瀏览器，瀏览 器的访问请求就永远到不了真实的网站那里。这就是DNS劫持。
比如，我现在在湖南电信上网得到的IP和DNS缓存服务器参数是
IP Address:222.244.222.32
Gateway address:222.244.222.1
DNS Server:222.246.129.80, 59.51.78.210
这里的DNS服务器的IP是222.246.129.80和59.51.78.210，这是两台离我最近的DNS缓存服务器，我们可以来利用这两个 DNS服务器来查询世界上任何一个网站的域名，因为他开通了递归查询，也就是说，如果当前DNS服务器不知道这个域名，他会向上级DNS进行查询，开通递 归查询的DNS服务器也本身设置了另一个DNS服务器，遇到他不知道IP的域名他就会向上查询，如果上级的上级都不知道，就会查到域名的whois信息， 然后查whois信息里指定的DNS服务器，whois信息里指定的DNS服务器是权威服务器，返回的值就是“权威应答”。
什么情况下遇到非权威应答呢？那就是我们的上一级DNS服务器里缓存了DNS查询结果，DNS服务器就会马上返回一个IP，这时得到的应答就是非权 威应答，也就是说，可以这样划分，DNS服务器相对於某个具体的域名来说，可以分为权威DNS服务器和DNS缓存服务器。权威DNS服务器是在internic.net註册了的主机，DNS缓存服务器却是任何人都可以自己建立的服务器。
DNS如何变得不诚实
通常情况下，DNS缓存服务器是公正的敬业的值得信任的，会老老实实工作，但有些情况下却会做假。如最近炒的比较火的一个漏洞是DNS 协议的漏洞，人们可以伪造端口和TXID识别符均能匹配的UDP数据包来欺骗DNS服务器缓存一个虚假的结果，可以实现phishing， 比如当你访问你的邮箱或网上银行的时候，把你骗到一个假网站上面，但你看到你访问的网址地址却是准確无误的。还有一种情况下DNS缓存服务器会作假，比如 在DNS服务器里登记一些敏感网站的域名，然后给这些网站设置一些假的IP，这样就阻止使用当前DNS服务器的用户访问不到这些网站。当年我阻止公司同事 被3721流氓软件所害，就是这么乾的，当然，我需要让他们用DHCP获得的DNS服务器IP为我在公司设置的私有DNS缓存服务器IP。
实际上，我之前提到的222.246.129.80和59.51.78.210不是公正无私的DNS缓存服务器，他们会作弊，我演示给你看他们是怎么作弊的：
在Windows操作系统下的“开始”菜单里找到“运行”，然后输入cmd，出现一个黑色的命令行窗口，在这里我们输入
nslookup www.zuola.com 222.246.129.80
然后看到返回一个奇怪的结果
C:\Users\Zola>nslookup www.zuola.com 222.246.129.80
服务器: 222.246.129.80
Address: 222.246.129.80非权威应答:
名称: www.zuola.com
Address: 202.106.1.2
这个IP根本不是我的IP，我按向上箭头键重复执行这命令，会得到好几个不同的结果，如4.36.66.178 / 216.234.179.13 / 203.161.230.171 / 64.33.88.161 / 202.106.1.2 / 202.181.7.85 / 211.94.66.147，就是得不到正確的IP。网友看到这里可以亲手测试一下。如果nslookup www.zuola.com 后面不再添加IP或服务器域名，就意味著使用当前的DNS服务器来查询我的网站IP。
如果直接用权威DNS服务器来查询，
C:\Users\Zola>nslookup www.zuola.com ns1.oray.net
服务器: ns1.oray.net
Address: 202.105.21.217名称: www.zuola.com
Address: 208.97.181.48
则马上得到了我域名的正確的IP。好了，到这里，我似乎可以总结陈述GFW在利用DNS劫持来制止其他中国网友访问我的网站了，但，事情还没完，我 还有更多发现:边界路由器上的GFW不仅能过滤网页中敏感內容，而且能干扰DNS查询並给出错误的IP地址，GFW早就实现了DNS"Cache 投毒"（cache poisoning）。DNS 缓存投毒的结果是，即便是在北京工作的时代周刊的记者使用了代理服务器，或是使用了MCI的VPN网络，他们仍然不能访问我的网站。
证明GFW使用"Cache 投毒"（cache poisoning）的过程很简单：
由於我的域名的whois里指定的权威DNS服务器是ns1.oray.net，这个服务器是中国公司的，这个NS服务器也在中国境內，当在中国境 內查询的时候，查询域名的A记录的UDP数据包就不需要出国，此时不受GFW影响，所以能查到我的真实IP为208.97.181.48。
现在，我登录美国Linux服务器的终端，由於ns1.oray.net 在中国境內，这个时候查询nslookup www.zuola.com ns1.oray.net就需要经过中国的网络边境线了，GFW就会捣蛋了，你看，
[zolazhou]$ nslookup www.zuola.com ns1.dreamhost.com（此服务器在美国）
Server: ns1.dreamhost.com
Address: 66.33.206.206#53Name: www.zuola.com
Address: 208.97.181.48 (这里返回是正確的IP，因为没有越过GFW，不受GFW影响)[zolazhou]$ nslookup www.zuola.com ns1.oray.net
Server: ns1.oray.net
Address: 202.105.21.217#53Name: www.zuola.com
Address: 64.33.88.161 (GFW干扰后给出的假IP地址，也许是一个honeypot)[zolazhou]$ nslookup www.zuola.com ns1.oray.net
Server: ns1.oray.net
Address: 202.105.21.217#53Name: www.zuola.com
Address: 202.106.1.2 (GFW干扰后给出的另一个假IP地址)[zolazhou]$ nslookup www.zuola.com ns1.oray.net
Server: ns1.oray.net
Address: 202.105.21.217#53Name: www.zuola.com
Address: 216.234.179.13 (GFW干扰后给出的另一个假IP地址)[zolazhou]$ nslookup www.zuola.com ns1.oray.net
Server: ns1.oray.net
Address: 202.105.21.217#53Name: www.zuola.com
Address: 4.36.66.178 (GFW干扰后给出的另一个假IP地址)[zolazhou]$ nslookup www.zuola.com ns1.oray.net
Server: ns1.oray.net
Address: 202.105.21.217#53Name: www.zuola.com
Address: 216.234.179.13 (GFW干扰后给出的另一个假IP地址)[zolazhou]$ nslookup www.zuola.com ns1.oray.net
Server: ns1.oray.net
Address: 202.105.21.217#53Name: www.zuola.com
Address: 4.36.66.178 (GFW干扰后给出的另一个假IP地址)[zolazhou]$ nslookup www.zuola.com ns1.oray.net
Server: ns1.oray.net
Address: 202.105.21.217#53Name: www.zuola.com
Address: 211.94.66.147 (GFW干扰后给出的另一个假IP地址)[zolazhou]$ nslookup www.zuola.com ns1.oray.net
Server: ns1.oray.net
Address: 202.105.21.217#53Name: www.zuola.com
Address: 202.181.7.85 (GFW干扰后给出的另一个假IP地址)[zolazhou]$ nslookup www.zuola.com ns1.oray.net
Server: ns1.oray.net
Address: 202.105.21.217#53Name: www.zuola.com
Address: 209.145.54.50 (GFW干扰后给出的另一个假IP地址)
上图来看，国外的朋友访问我的网站也困难是因为他们的DNS请求会经过一次GFW，所以会得到一个假的IP地址並会到这些假IP上去取数据，当然不 会得到任何应答。也是时代周刊的记者都无法访问我的网站的原因。所以，一个小时前，我把我的权威DNS服务器改为美国Dreamhost公司的 ns1.dreamhost.com 的域名解析服务器了。国外的朋友访问我的网站就会得到正確的IP地址了，不会再受GFW的欺骗了。
这个时候，ns1.oray.net这个服务器不再为我工作了，国內的网友访问我的网站里却会总是被GFW所欺骗了：
C:\Users\Zola>nslookup www.zuola.com ns1.dreamhost.com
服务器: ns1.dreamhost.com
Address: 66.33.206.206名称: www.zuola.com.lan
Addresses: ca6a:102:0:f00::e095:1100
202.181.7.85 (又是假IP)C:\Users\Zola>nslookup www.zuola.com ns1.dreamhost.com
服务器: ns1.dreamhost.com
Address: 66.33.206.206名称: www.zuola.com.lan
Addresses: d8ea:b30d:0:5600::e095:5800
209.145.54.50 （又是该死的假IP，DNS劫持）C:\Users\Zola>nslookup www.zuola.com ns1.dreamhost.com
服务器: ns1.dreamhost.com
Address: 66.33.206.206名称: www.zuola.com.lan
Addresses: 424:42b2:0:1000::e095:1200
64.33.88.161( 操！)C:\Users\Zola>nslookup www.zuola.com 208.67.222.222 （即便是OPENDNS也不能解决问题，GFW照样来作弊劫持掉DNS结果）
服务器: resolver1.opendns.com
Address: 208.67.222.222名称: www.zuola.com.lan
Addresses: 202.106.1.2
64.33.88.161 (又是这两个混蛋IP地址)C:\Users\Zola>nslookup www.zuola.com 208.67.222.222
服务器: resolver1.opendns.com
Address: 208.67.222.222名称: www.zuola.com.lan
Addresses: 216.234.179.13
4.36.66.178（一次还给俩假IP，操你妈的GFW）
如何被动应对DNS劫持
网友们读到这里，知道我承受多么残酷的封杀了吧？都怪我太有名了。根据我搜索上面的IP的结果，发现GFW使用此阴毒招数不是今年的事情了。在 2003年就有很多域名受到同样的待遇了。如果不是外宾，用脚都可以想到那些网站是什么类型网站，作为一个普通公民的个人网站，受到GFW如此狠毒的待 遇，估计我是头一个。
Google.cn也奉命屏蔽我的网站內容，GFW又使出如此残忍的手段来封杀我的网站，我有机会的话，我要当著胡锦涛总书记问下我在他眼中到底做 错了什么？GFW的主人到底害怕我什么？我觉得，要么直接给我一幅手銬好了，要么像对待Kevin Mitnick一样不准我接触电脑和网络好了。如果有国外记者看到我这段话，拜託转告一下胡锦涛这个问题。
好了，发泄一下怨气后还是得想想解决办法。还好我们有办法让DNS解析也通过代理服务器来完成。使用FireFox的用户可以下载TOR，然后安装FoxyProxy， 然后找到FoxyRroxy选项里的全局选项，把“使用SOCKS代理服务器来查找DNS”。面对GFW的大力封杀，我只好放弃国內流量了，尽量通过鼓励 RSS订阅和推广使用代理器来恢復自己的网站的功力好了。如果有可能，我改为英文BLOG来赚英文世界的广告费好了，反正写中文网志也赚不到什么钱，写英 文网志的话也不需要来自中国的流量。
如何主动应对DNS劫持
下面开始做一些针对GFW的猜测，眾所周知，UDP协议是一个无连接的协议，对数据包的到达顺序以及是否正确是不关心的，由於GFW会审查53端口 的数据包，所以给针对GFW进行DOS攻击提供了可能。如果有人开发类似病毒的软件不断的向国外IP隨机发出通往UDP53端口的敏感网址数据查询请求， 估计可以让GFW累得罢工，我会很乐意感染这种病毒，我相信很多恨GFW的人也乐意感染这个病毒。谁能在技术层面反驳我这个思路？
下一节介绍如何突破关键词过滤屏蔽IP的网络封锁手段。
26 条评论:
Upon examining some etymological dictionaries, one can
conclude that games are a creative expression of the human spirit through the creation of an activity that has
an entertaining, instructive and competing element. Finding
good outsourcing companies is the key, as naturally you do not want to lower the quality of the
service. It can go as far as ruining their experience since it is the last interaction
they have with a game.
Also visit my weblog - visit this link - www.militarygrid.com
We have been using internet banking for quiet sometimes now.
This small bio does the marketing for you, helping you to
promote yourself along with your site. You almost certainly have considered ways to enhance your computer internet security, but for one reason or another
have kept putting it off.
Both teams lost in a day of upsets, and with that loss, they were
taken out of the picture for a national championship appearance.
The tables are quite affordable and make beer pong more interesting to play.
The center is stamped with the dollar amount that the chip represents.
Also visit my web site :: omerta city of gangsters
These online dress-up video games have about hundreds of online games stored in its database.
When children fit these fun video game titles into actions require time to view those
facial seems to be and human body expressions.
You're punished more than and in excess of for generating faults in education and encouraged never ever to do it.
My blog gratis spielen
Some worthy charitable causes include service dog
centers, humane societies and even donating to family.
Dialogs and controls can be set at the click of a button and
individual permissions do not take hours of effort or considerable technical knowledge to create or update.
Let them be in the driver's seat as much as possible to help them handle the stress better.
In response to this, there are always some people whose need to be noticed causes them to present themselves in a
manner so bizarre as to stand out in the crowd.
This is especially true of schools that have already established themselves in the
online education space. Could it be the scarcity of money and
the bills needing to be paid.
Here is my blog post: Read the Full Article
They growing need the improvement owing to the pressure from the users led
to introduction of Supercard DSTWO. Deciding
on the best Android UI is tough - after all, these user interfaces appear on phones of
varying specification. Not to get too much off topic, there are things in the latest installment that are not even up to
par with the previous installments.
Also visit my site ... www.pnns.co.il
What I realized is many of the things on the list weren't that far of a stretch, and I could live many of them NOW, if I made a few changes. Everybody knows that Microsoft has done some bad stuff in the past. Various options are available to ensure there is room for everyone.
Look into my web page :: http://kh.db.ac.kr/?document_srl=60730
The low listing prices are definitely an advantage of the e - Bay selling service.
The main question is, do you really believe in what you have to sell to such a degree that you would invest in one yourself.
Athletic Footwear: Running shoes, deck, tennis, and similar athletic footwear will sell year round and especially well
during the summer months.
Also visit my website: www.leefmurphy.com
Congress tried in 2007 to pass a measure that would lock in the rate that could be charged through
2010 at 7. Her first movie was Holiday in the Sun in the year 2001, Help in the year 2004.
Individuals have acquired different software and programe through which you could download these videos.
Also visit my blog http://www.fameb.ufba.br/ead/user/view.php?id=30775&course=1
Just make sure your box leaves the impression they have something wonderful waiting for them inside of it.
Sometimes, items come premixed but still have less packaging.
The reflections of the sky, not only in the water, but
on the boat as well, lend a hand to a desired blending of color and a balance that is perfection.
Here is my web-site Beauty
Aside from being hypoallergenic, this oil has the ability to stimulate the
skin and repair damage. It is one part of plastic surgery, the other one being reconstructive surgery.
The following day after I color, I use a DIY highlighting kit.
Here is my web page; http://www.word-mart.com/forum/nfphpbb/profile.php?mode=viewprofile&u=10929
Over time, many of these radio personnel will be readily agreeable to featuring the entrepreneur whenever they release new products or services.
Remember that most dorm room radio stations
out there may or may not be online from time to time and that
cannot be blamed on the app, however this does hinder the experience of Internet radio on the i - Phone.
This is a fantastic app for people who travel and it now supports multitasking.
Also visit my page; please click the next post
These are not empty words which are uttered by a disciple of Jesus who anyone would anticipate to say such as this.
In my case I listen to all music that is submitted to me before I include it on my
playlist. The viewing angle is extra wide, making it easier for you to read or even
allow others to read with you.
Feel free to visit my webpage :: 오늘의 헤드라인 - 한인(문화)회관 기금납부 전체명단 발표! - www.nzkorea.org
Literally wiping sweat from my forehead after doing my best 90s
dance moves to a memorable mix of old school joints from the likes of Special Ed, Eric B.
If you want to know what folks are listening to
and talking about on the opposite coast, Fly - Cast is terrific.
Some radio stations have also started making use of streaming MP3 format, which could be played through Winamp.
My blog ... Going On this page
Over time, many of these radio personnel will be readily agreeable to featuring the entrepreneur whenever they release new products or services.
For instance i - Pod users will have difficulty syncing their devices with i - Tunes;
the popular media player, sync and marketplace application isn't available on Linux. The viewing angle is extra wide, making it easier for you to read or even allow others to read with you.
Feel free to surf to my site More Info
Much like Safari, the Camera app, the App Store and i - Pod, Game Center has no option
to be deleted when editing your apps. However, every character in the game (even supporting players) should be
presented in this same detail. For the purposes of this game, a "set" is
at least three cards of equal value such as three Jacks or three fours
and a "sequence" is made up of at least four cards that are of the same suit and run
sequentially such as three, four, five, and six of spades.
my website - Frankie - www.mtwebit.com
When it comes to fishing, some goes for fishing as an entertainment activity and many
depends upon fishing for their livelihood. You will also want to have a supply
of different lines that you can use. Garmin Accuracy and Innovation Leads You to the Fish.
Feel free to visit my blog post - sea fishing
You might need heavier line and tackle to account for powerful river flows.
Spinning - Trout are aggressive and definitely will strike and eat smaller fish.
Most of the fishable water in the upper river is boulder
runs in deep canyons and it is scenic.
Also visit my web site; fishing trophies
And indeed Robert has made the paramount sterling effort, guided by his mentor, with beads of perspiration on his brow, Robert has
brought it in to the landing net. Spinning - Trout are aggressive and definitely
will strike and eat smaller fish. If the fish are not
hitting on your main crappie jigs you may need to
switch to live bait or a combination of live and artificial baits.
Also visit my web-site :: visit The following Web page
com provides information on Fishing, Fly Fishing, Fishing Boats,
Deep Sea Fishing and. Here is some helpful information
so you can select a good charter boat and avoid a few of the pitfalls.
One can find another 2 options as to wholesale fishing rod, which might be hollow-tip rods and reels and spliced-tip
rods.
Here is my web-site; Suggested Internet site
This is a small selection of great music I listen to, written
from my own perspective as a fan and a user, with the aim of inspiring others to listen too.
As we ate, not only did our waitress check back with us to see if we required anything further, but the manager stopped by as well.
We are literally not the same person we were a minute ago, let alone a day, a month or a year ago.
Here is my site - author�s external home page�
I enjoy what you guys are up too. Such clever work and coverage!
Keep up the great works guys I've incorporated you guys to my blogroll.
Here is my site: lavalife :: ::
Generally I do not learn post on blogs, but I wish to
say that this write-up very pressured me to take a look
at and do so! Your writing taste has been surprised me.
Thank you, very great post.
Here is my website ... laujourdhui ()
Magnificent goods from you, man. I have understand your stuff previous to and
you're just too fantastic. I actually like what you've acquired
here, really like what you're saying and the way in which you say it. You make it entertaining and you still care for to keep it smart. I can not wait to read far more from you. This is actually a terrific web site.
My web blog ... how to get more followers on twitter without following back for free
Somebody essentially assist to make severely posts I would state.
That is the very first time I frequented your website page and thus far?
I amazed with the research you made to make this actual publish amazing.
Fantastic process!
Feel free to visit my web blog: buy real twitter followers
发表评论