如何实现 OpenDNS 风格的网络流量代理
我有一个我认为可能不可能的要求，并想与该社区的专家确认这一点。
客户希望我们配置 DNS 服务器，将所有非白名单域指向互联网上服务器的 IP 地址。该服务器应尽可能准确地将所有非 http 流量转发/重定向到与真实 DNS 记录关联的 IP 地址。但是，对于所有端口 80 流量，它应该拦截流量并转发到 Web 代理。理论上，如果我们拥有大量公共 IP 地址，可以根据发件人的 IP 智能地路由到正确的目的地，那么这在理论上是可能的，但需要工程工作来保持 DNS 请求和对同一域的后续请求同步将是巨大的。更不用说我们从并发角度来看会受到限制。这可能类似于 OpenDNS 的 DNS+代理方式，但他们似乎只为 google.com 这样做。这需要适用于任意一组域（可能是所有域）。
上述方法可行吗？如果没有，是否有其他方法可以解决这个问题而不需要专门的网关硬件？
理想情况下，系统将最大限度地减少带宽使用和带宽使用。除了 DNS 或防火墙配置之外，无需进行任何操作，即可减少非 http 流量的延迟。我意识到我们可以在防火墙级别转发所有 http 流量，但客户端希望避免向 CDN 或媒体密集型站点发出 http 请求，并最大限度地减少跨不同网络配置的部署工作。
I have a requirement that I believe may be impossible and wanted to confirm this with experts in this community.
A client wants us to configure a DNS server to point all non-whitelisted domains to an IP address of a server on the internet. This server should forward / redirect all non-http traffic to an IP address associated with the real DNS record as accurately as possible. However, for all port 80 traffic, it should intercept the traffic and forward to a web proxy. This could in theory be possible if we had a large block of public IP addresses that could intelligently route based on the sender's IP to the proper destination, but the engineering effort required there to keep the DNS request and subsequent requests to that same domain in sync would be immense. Not to mention we would be limited from a concurrency perspective.This is probably similar to how OpenDNS does their DNS+Proxying, but they only seem to do it for google.com. This needs to work for an arbitrary set of domains (potentially all of them).
Is the above approach feasible? If not, are there other ways this problem can be approached short of requiring specialized gateway hardware?
Ideally the system will minimize bandwidth usage & latency for non-http traffic without requiring anything besides DNS or firewall configuration. I realize we can forward all http traffic at the firewall level, but the client wants to avoid http requests to CDNs or media heavy sites as well as minimize deployment effort across disparate network configurations.
如果你对这篇内容有疑问，欢迎到本站社区发帖提问 参与讨论，获取更多帮助，或者扫码二维码加入 Web 技术交流群。
绑定邮箱获取回复消息
由于您还没有绑定你的真实邮箱，如果其他用户或者作者回复了您的评论，将不能在第一时间通知您！
发布评论
评论（3）
OpenDNS 通过黑名单而不是白名单来工作
当主机被列入黑名单时，openDNS 会将名称解析为其 IP 地址，从而阻止客户端访问真实 IP。
在您的情况下，看起来您需要透明代理，您可以将所有 HTTP 流量路由到代理服务器：
请参阅：
OpenDNS works by blacklisting instead of whitelisting
When a host is blacklisted, openDNS will resolve the name into their IP address, which in turn prevent the client from accessing the real IP.
In your case, looks like you need transparent proxy where you can route all HTTP traffic to your proxy server:
See :
这可能不完全是您正在寻找的内容，但请查看我的文章“如何设置透明内容过滤代理”，其中我利用了 OpenDNS 的黑名单功能。
This might not be exactly what you are looking for but take a look at my article "How To Setup A Transparent Content Filtering Proxy" in which I utilize OpenDNS's blacklisting capabilities.
您可以使用两部分来完成此操作：
You can do it using two pieces: