闲来无事 : Easy way to prevent from GFW DNS abusing

2015/12/19

Easy way to prevent from GFW DNS abusing

The easiest way to distinguish the GFW DNS abusing result from real DNS responses is using iptables to block the dummy DNS response by GFW

# iptables -t mangle -I PREROUTING -s 8.8.8.8/16 -m ttl --ttl-gt 63 -j DROP

# ip6tables -t mangle -I PREROUTING -s 2001:4860:4860::8844/112 -m hl --hl-gt 52 -j DROP

2 条评论:

Unknown 说...: 又开始更新了?; 22/12/15 13:28
linuxyz 说...: IPv4 TTL should be less than 50 in CERNET.; 30/8/16 22:44

订阅：博文评论 (Atom)