Обход блокировок GEOIP с помощью DNS spoofing + sniproxy

Xunlei · July 23, 2025, 7:59am

В GOST, например, тоже можно сделать:

gost.yml

services:
# HTTP Reverse Proxy
- name: service-HTTP-Reverse-Proxy
  loggers:
  - logger-std
  - logger-reverse
  addr: "адрес:80"
  bypass: bypass-domains-80
  resolver: resolver-local-4-only
  limiter: limiter-0
  rlimiter: rlimiter-0
  climiter: climiter-0
  handler:
    type: tcp
    metadata:
      sniffing: true
  listener:
    type: tcp
  metadata:
    limiter.refreshInterval: 30s
    limiter.scope: service
# HTTPS Reverse Proxy
- name: service-HTTPS-Reverse-Proxy
  loggers:
  - logger-std
  - logger-reverse
  addr: "адрес:443"
  bypass: bypass-domains-443
  resolver: resolver-local-4-only
  limiter: limiter-0
  rlimiter: rlimiter-0
  climiter: climiter-0
  handler:
    type: tcp
    metadata:
      sniffing: true
  listener:
    type: tcp
  metadata:
    limiter.refreshInterval: 30s
    limiter.scope: service

# DNS resolver
resolvers:
- name: resolver-local
  nameservers:
  - addr: "udp://[::1]:53"
    ttl: -1
- name: resolver-local-4-only
  nameservers:
  - addr: "udp://[::1]:53"
    ttl: -1
    only: ipv4
- name: resolver-local-6
  nameservers:
  - addr: "udp://[::1]:53"
    ttl: -1
    prefer: ipv6
- name: resolver-local-6-only
  nameservers:
  - addr: "udp://[::1]:53"
    ttl: -1
    only: ipv6

bypasses:
- name: bypass-domains-80
  whitelist: true
  matchers:
  - example.com:80
- name: bypass-domains-443
  whitelist: true
  matchers:
  - example.com:443

limiters:
- name: limiter-0
  limits:
  - '$ 10MB 10MB'
  - '$$ 1MB'

rlimiters:
- name: rlimiter-0
  limits:
  - '$ 100'
  - '$$ 10'

climiters:
- name: climiter-0
  limits:
  - '$ 1000'
  - '$$ 100'

# Logging
loggers:
- name: logger-std
  log:
    level: warn
    format: text
    output: stderr
    rotation:
      localTime: false
- name: logger-reverse
  log:
    level: info
    format: text
    output: /var/log/gost/log-reverse.txt
    rotation:
      maxSize: 10
      maxAge: 7
      maxBackups: 4
      localTime: false
      compress: true

Чтобы пользователи, которые не хотят устанавливать дополнительное ПО могли прописать скроку в файл hosts и восстановить доступ к ресурсу на заблокированной подсети хостера.