2015/12/19

Easy way to prevent from GFW DNS abusing

The easiest way to distinguish the GFW DNS abusing result from real DNS responses is using iptables to block the dummy DNS response by GFW

# iptables -t mangle -I PREROUTING -s 8.8.8.8/16 -m ttl --ttl-gt 63 -j DROP
# ip6tables -t mangle -I PREROUTING -s 2001:4860:4860::8844/112 -m hl --hl-gt 52 -j DROP

2 条评论:

Unknown 说...

又开始更新了?

linuxyz 说...

IPv4 TTL should be less than 50 in CERNET.

BlockChain 相关电子书

@copyright of Sam Chadwick   - https://thehub.thomsonreuters.com/groups/bitcoin/blog/2017/09/10/blockchain-paper Blockchain Papers A c...