2

DNS server blocked in China

Please see the test result of greatfire.org

https://blocky.greatfire.org/detail/450314/https%3A%2F%2Fdns.nextdns.io

`DNS poisoning`? No.

Domestic DNS servers returned correct reply.

 

```

steering.nextdns.io.

103.127.124.46 [Asia]

92.38.166.121 [Korea]

```

 

Detect SNI? Yes.

Any IP using this SNI to establish an HTTPS connection will be subject to TCP reset attacks by Great Firewall and remain disconnected for a period of time.

 

IP blocking(using routing blackhole)? Yes.

`103.127.124.46` and `92.38.166.121 ` is not accessible on any port including 443,853, whenever.

16replies Oldest first
  • Oldest first
  • Newest first
  • Active threads
  • Popular
  • 今天下午被墙了吗?我现在nextdns一直在报I/O timeout,时断时续。

    最担心的一天终于来了。

    Like
  • However, the following querying works.

    ```

    curl -vk 'https://nextdns.io/?name=example.com&type=A' -H "Host: dns.nextdns.io"

    ```

     

    ```

    curl -vk 'https:///45.90.28.102/?name=example.com&type=A' -H "Host: dns.nextdns.io"

    ```

    Like
  • https://gitlab.com/NickCao/experiments/-/blob/master/workers/r.js

    I deployed this reverse proxy on Cloudflare workers.

    Now using following as DoH url `https://xxx.workers.dev/https://dns.nextdns.io/114514/devicename` 

    Like
  • Carrot eggs

    GFW 看起来只检测 SNI dns.nextdns.io

    将 URL 写为

    https://devicename-114514.dns.nextdns.io

    仍然可用

    Like
  • 楼上的方法也不行。虽然起来只检测 SNI dns.nextdns.io但仍然无法访问诸如xxx.apple.dns.nextdns.io,

    xxx.dns.nextdns.io,apple.dns.nextdns.io/xxxxx,等所有个性化dns

    Like
      • Yogas Kung
      • Yogas_Kung
      • 2 mths ago
      • Reported - view

      小熊2 xxx.apple.dns.nextdns.io 这个域名是不存在的

      注意:DoH 服务器的证书 CN 是 *.dns.nextdns.io

      如果使用 DoH, NextDNS 会按照 PATH 判断用户,和 SNI 无关

      https://nmsl.dns.nextdns.io/xxxxxx

      nmsl 可以替换为任意内容, 但是 xxxxxx 必须是您的 id

      Like
  • 可以试试用 hosts 绑定域名的方式,反正 nextdns 是泛域名证书

    Like
      • inkflaw
      • inkflaw
      • 2 mths ago
      • Reported - view

      inkflaw 

      Like
  • 已经能访问了

    Like
    • 小熊2 我在深圳移动网络下,目前还是不能使用。直接pingIP和域名都能ping通,就是不能使用。

      客户端是centos8上nextdns cli 1.11.0

      Fetching PoP name for ultra low latency primary IPv4 (ipv4.dns1.nextdns.io)
      Fetch error: Get "https://dns.nextdns.io/info": read tcp 192.168.50.2:36548->37.252.249.233:443: read: connection reset by peer
      Fetching PoP name for ultra low latency secondary IPv4 (ipv4.dns2.nextdns.io)
      Fetch error: Get "https://dns.nextdns.io/info": dial tcp 84.17.37.186:443: connect: connection timed out
      Fetching PoP name for anycast primary IPv4 (45.90.28.0)
      Fetch error: Get "https://dns.nextdns.io/info": read tcp 192.168.50.2:59000->45.90.28.0:443: read: connection reset by peer
      Fetching PoP name for anycast secondary IPv4 (45.90.30.0)
      Fetch error: Get "https://dns.nextdns.io/info": read tcp 192.168.50.2:57286->45.90.30.0:443: read: connection reset by peer

      Like
    • 小熊2 联通LTE IPv6下能够使用。

      Like
  • 楼上大佬能说中文吗 告诉我几楼的方法能成啊?

    Like
  • 大佬快想想办法?我现在想通过ios描述文件实现hosts功能,本地屏蔽网址

    Like
Like2 Follow
  • 2 Likes
  • 1 mth agoLast active
  • 16Replies
  • 476Views
  • 4 Following