2015/12/19

Easy way to prevent from GFW DNS abusing

The easiest way to distinguish the GFW DNS abusing result from real DNS responses is using iptables to block the dummy DNS response by GFW

# iptables -t mangle -I PREROUTING -s 8.8.8.8/16 -m ttl --ttl-gt 63 -j DROP
# ip6tables -t mangle -I PREROUTING -s 2001:4860:4860::8844/112 -m hl --hl-gt 52 -j DROP

发表评论