@
villivateur 你要收到 DST 的回应你本地才会显示，如果 DST 禁 ping 那首先回应根本就不存在，这是一个主动行为，如果没有禁 ping 那数据包是在回应你的途中也就是回程被 GFW 吃了，这是一个被动行为。
GFW 是不是一个 DNS 服务器这件事上，按严谨的定义来说，它不是，但是生活中很多事情都这样，我们对于什么是什么的定义也主要看它的行为，比如说核酶 RNA 曾经被认为是纯信息分子，但是后来发现 RNA 也能催化反应，病毒也曾被认为只是毒素，后来也被发现它是带有遗传信息的颗粒实体复制子，它们外表的行为被人一半误解，实际上实现的功能确实被人类猜对了，如果你把 DNS 服务器的简单解析一下，就是 Client ?A
www.google.com -> Server
www.google.com A = x.x.x.x -> Client ，GFW 的作用就是中间人，在 Server -> Client 这个过程中劫持了这个响应，然后伪造了虚假的 DNS 数据包，以前 GFW 算力不够，在目标回答后再被动劫持经常会漏包，于是改为了主动劫持，结果还没加判断方向，导致外来请求也会被劫持，现在加了判断方向，只有来自内地的流量出去才会被篡改，来自海外的流量如果国内没有响应则不会被篡，这么说来其实伊朗整个国家都是巨大的流量放大器，而且还是双向的，如果海外来的请求会篡改然后回复，境内的请求也会篡改然后回复。
对于拥有 GFW 的国家来说，整个国家既是对于全世界的放大器，全世界也是对于整个国家的放大器。
举几个例子：
1.1.1.1 = Real dns, outside of the country, will reply
6.6.6.6 = Fake dns, outside of the country, random IP in the world, won't reply
伊朗双向：
Client IR ?A
blocked_domain.com -> GFW (e.g. 1.1.1.1) -> Client IR A = 10.10.34.35
(Real dns, will reply, but hijacked PRE-reply)
Client IR ?A
blocked_domain.com -> GFW (e.g. 6.6.6.6) -> Client IR A = 10.10.34.35
(Fake dns, won't reply, but still hijacked PRE-reply)
Client EU ?A
blocked_domain.com -> GFW (e.g. IR DNS) -> Client EU A = 10.10.34.35
(Real dns, will reply, but hijacked PRE-reply)
Client EU ?A
blocked_domain.com -> GFW (e.g. Random IR IP) -> Client EU A = 10.10.34.35
(Fake dns, won't reply, but still hijacked PRE-reply)
中国单向：
Client CN ?A
blocked_domain.com -> GFW (e.g. 1.1.1.1) -> Client CN A = 31.13.106.4
(Real dns, will reply, but hijacked PRE-reply)
Client CN ?A
blocked_domain.com -> GFW (e.g. 6.6.6.6) -> Client CN A = 31.13.106.4
(Fake dns, won't reply, but still hijacked PRE-reply)
Client EU ?A
blocked_domain.com -> GFW (e.g. CN DNS) -> Client CN A = 31.13.106.4
(Real dns, will reply, but hijacked PRE-reply)
Client EU ?A
blocked_domain.com -> GFW (e.g. Random CN IP) -> Client CN no reply
(Fake dns, won't reply, no hijacked PRE-reply)
无墙，如欧洲：
Client EU ?A
blocked_domain.com -> Router (e.g. 1.1.1.1) -> Client EU A = 1.1.1.1
(Real dns, will reply, normal reply)
Client EU ?A
blocked_domain.com -> Router (e.g. 6.6.6.6) -> Client EU A = timed out
(Fake dns, won't reply, no reply)
Client EU ?A
blocked_domain.com -> GFW (e.g. CN DNS) -> Client EU A = 31.13.106.4
(Real dns, will reply, but hijacked PRE-reply)
Client EU ?A
blocked_domain.com -> GFW (e.g. IR DNS) -> Client EU A = 10.10.34.35
(Real dns, will reply, but hijacked PRE-reply)
Client EU ?A
blocked_domain.com -> GFW (e.g. Random CN IP) -> Client EU A = timed out
(Fake dns, won't reply, no reply)
Client EU ?A
blocked_domain.com -> GFW (e.g. Random IR IP) -> Client EU A = 10.10.34.35
(Fake dns, won't reply, but still hijacked PRE-reply)