AdGuard Home Yana Amsa Abokan Ciniki na WireGuard Daga Adireshin LAN ɗinku

Ramin yana kunna, bangon wuta yana ba da izinin tashar 53, AdGuard Home yana aiki, kuma sunaye har yanzu ba su warware wa abokin ciniki na WireGuard ba. Tambayar tana zuwa kamar yadda aka saba kuma amsa tana fita kamar yadda aka saba, don haka mai kirga fakiti a kan mai warware sunaye yana da kyau kuma sabis ɗin yana bayyana ba laifi. Abin da ke faruwa daidai shi ne adireshin tushe a wannan amsar: yana fita daga wani adireshin na gida da abokin ciniki bai taɓa tambaya ba, kuma mai warware na ɗan gajeren lokaci na abokin ciniki yana yarwa. Wani jerin a cikin saitin AdGuard Home yana yanke wannan shawarar, kuma tsoffin zaɓinsa yawanci yana mika shawarar zuwa kernel.

Tambayar tana zuwa, amsa tana fita daga wani wuri daban

Abokin ciniki wanda aka saita tare da 10.6.0.1 a matsayin mai warwarewa yana aika tambaya ta UDP zuwa 10.6.0.1 tashar jiragen ruwa 53. Wannan fakiti yana wucewa ta rami kuma ya sauka a kan mai masauki, kuma AdGuard Home yana amsawa. A kan waya, duk da haka, amsar sabon fakiti ne wanda adireshin tushe aka zaɓa daga fakitin mai masauki, ba daga tsammanin abokin ciniki ba.

Lokacin da mai warwarewa na abokin ciniki ya kasance madaidaicin soket, wanda shine abin da systemd-resolved, dnsmasq da yawancin masu warwarewa masu tsari suke amfani da shi, yana karɓar amsoshi ne kawai daga adireshin da aka aiko da shi. Amsar da ta fito daga 192.168.1.10 zuwa tambaya da aka aiko zuwa 10.6.0.1 ana zubar da ita kafin a fara kowane nazari. Mai warwarewa yana yin rajista na amsa mai nasara, abokin ciniki yana yin rajista na karewar lokaci, kuma dukkansu suna gaya gaskiya.

Don haka masu ƙidaya ba sa ƙarya kuma abokin ciniki ma ba ya ƙarya. Shaidun da kake buƙata suna wurare uku, a wannan tsari: adireshin da mai sauraro ya rataya, hanya da kernel zai yi amfani da ita don komawa ga abokin ciniki, da adireshin tushen a kan ainihin fakitin amsa.

Yadda kernel ke zaɓar tushen amsa

Wani rami na UDP da aka rataya ga0.0.0.0ba shi da adireshin tushensa na kansa, don haka kowane amsa da ke fita yana haifar da binciken hanya zuwa wurin da aka nufa. Kernel ɗin zai ɗauki tushen daga wannan hanyar: adireshin da hanyar ta daure, ko adireshin farko na hanyar da ke fita. Babu wani abu game da adireshin wurin da aka nema da ake tunawa.

A kan kwamfuta guda ɗaya mai gida, wannan ba a gani, saboda akwai amsa ɗaya kawai da zai yiwu. A kan na'ura da ke riƙe da adireshin LAN, adireshin WireGuard da adireshin gudanarwa, amsoshi da yawa suna yiwuwa, kuma wanda ya ci nasara yana dogara ne akan teburin hanyar a wannan lokacin. Ƙara wata hanya ta ƙari, adireshin na biyu a kan wannan layin, tura NAT a gaban mai warwarewa, ko gudanar da AdGuard a cikin kwandon ajiya tare da nasa sunan sarari, kuma tushen da aka zaɓa zai iya bambanta da wanda abokin ciniki ya nema.

ss -lunp | grep :53yana nuna wane wasa kake ciki. Mai sauraro a0.0.0.0:53shi ne yanayin alamar tauraro; mai sauraro a10.6.0.1:53riga ya kulle amsar. Karanta socket yana da sauri fiye da karanta YAML, kuma yana nuna abin da a zahiri ke gudana maimakon abin da aka adana a ƙarshe.

Abin da bind_hosts a zahiri ke sarrafawa

na AdGuard Homedns.bind_hostsshine jerin adireshin gida da mai sauraron DNS ke amfani da su. Tsarin da aka kawo na asali shine alamomi na *wildcard*, wanda ke nufin amincewa a kowane adireshin gida kuma barin kernel ya zaɓi tushe bisa kowane amsa. Sauya alamomin *wildcard* da adireshin da abokan ciniki ke tambaya yana canza soket, tare da shi adireshin tushe a kowane amsa.

Jerin yana daukar fiye da guda ɗaya, wanda ke da mahimmanci ga mai warwarewa da ke yi wa hanyoyi biyu aiki. Listing10.6.0.1da192.168.1.10yana bada soket biyu da aka daure, kuma kowace tambaya da ta zo a ɗaya daga cikinsu ana amsawa da adireshin da ta zo daga gare shi. Wannan shine halin da yawancin mutane ke zaton alamomin *wildcard* riga suna bayarwa.

YAML yana da sauki, kuma adireshin da ke ciki shine wanda abokan cinikin tafiye-tafiye da aka gaya musu su yi amfani da shi, ba adireshin babba na mai masaukin ba:

dns:
  bind_hosts:
    - 10.6.0.1
  port: 53

Dalilin da yasa shigarwa biyu na mai warwarewa guda ɗaya ke kin jituwa

Ana nufin mai sarrafa plugin, a wannan yanayin, cewa an girka mai warwarewa kuma wani shiri ne ke kula da shi: kunshin firmware na router, kunshin NAS, ko ƙarin na'urar sarrafa gida. Wannan kunshin yawanci yana dauke da nasa kwafin YAML na AdGuard Home kuma yana farfado da tsarin bisa jadawalin sa, yayin da kawai na'ura mai zaman kanta shine binary na mai siyarwa ko kwantena da kake saita kanka. Duk yadda yake, kana kallon tsari biyu masu zaman kansu tare da fayilolin saiti daban-daban da zaɓuɓɓukan bind daban-daban, ko da lokacin da duka biyun suke karanta list ɗin sama ɗaya da jerin filt ɗin ɗaya. ɗaya zai iya ɗaure adireshin tasha na musamman yayin da ɗayan ke gado da wildcard, kuma fuskar yanar gizo tana kama daga dukkan bangarorin.

Shi ya sa “mai warware ɗaya yake aiki kafin canja wurin” bai tabbatar da kome game da haɗin yanzu ba. Duba soket ɗin, sannan duba fayil ɗin saitin da tsarin da ke aiki ya ɗora da gaske. Kwafi tsoho a wani babban fayil yana daga cikin dalilan gama gari da yasa gyara bai yi tasiri ba.

Lulla shi, sannan gwada daga bangaren rami

Canjabind_hostszuwa adireshin rami, sake kunna sabis, sannan tabbatar da soket ɗin ya motsa:ss -lunp | grep :53yanzu yakamata ya nuna10.6.0.1:53ba tare da wani shigarwar alamar banza ba. Idan har yanzu yana nuna0.0.0.0,tsarin da ke aiki baya karanta fayil ɗin da ka gyara.

Sannan gwada daga abokin ciniki, domin wannan ne kawai bangaren da yake da muhimmanci. Tambaya tare dadig @10.6.0.1 example.comtana gwada hanyar da mai amfani yake bi, kuma kama bayanai a kan mai masaukin tare datcpdump -ni wg0 udp port 53yana nuna adireshin asalin amsa a kan waya. Kwatanta shi da adireshin a cikin saitin warwarewar abokin ciniki; lokacin da suka yi daidai, lokaci na tsayawa yana daina zama sirri.

ip route get 10.6.0.2yana bayyana kowace karin al'ada da ta rage, saboda yana buga dubawa da asalin da mai watsa baki zai yi amfani da shi zuwa ga abokin ciniki. Idan wannan fitarwa ya nuna sunan dubawar LAN, canjin haɗin ba shine cikakken gyara ba kuma teburin hanyoyin shine abu na gaba da za a karanta.

Abin da saitin haɗin ba zai iya gyarawa ba

Danganta mai sauraro baya gyara jerin izinin da ke kaucewa rukunin ramin tuntu, dokar firewall da ke ba da izinin bincike amma ba amsa ba, ko hanyar da ta ɓace zuwa rukunin WireGuard. Wadannan sun gaza a baya ko daga bisani fiye da adireshin asali, kuma kowanne yana da mai shi daban.

Hakanan baya canzawacce hanyar sama mai warwarewa ke turawa, ko kariyar rebinding ta ƙi amsar sirri ga suna na sirri, ko yadda abokin ciniki yake amfani da kansa yankunan bincike. Wadannan sarrafawa daban ne. Canja adireshin bind idan tushen amsar ba daidai bane, kuma canza wani abu idan ba haka bane.