DNS ba ya warwarewa bayan kill switch na VPN ya toshe tashar 53
Kill switch na iya toshe DNS da gangan. Kwatanta warwarewa a cikin tunnel kawai da keɓancewar wani resolver na gida, sannan gano wane mataki ya gaza da gaske.
Lokacin da kill switch ya faɗo da tunnel, yana ɗaukar hanyar DNS tare da shi, kuma resolver da ya rage ba kasafai yake zama wanda kuke tsammani ba. Ƙira biyu suna fuskantar wannan lokacin daban-daban: toshe duk wani fakitin DNS da ba ya cikin tunnel, kobarin resolver ɗaya a tsaye a matsayin keɓancewa. Dukansu suna da hujja. Daga shafin burauza alamun suna kama da juna, don haka aikin farko shi ne gano wace ƙira kuka tura da gaske.
Ina riƙe wannan bambanci a gabana domin gyaran ya saba wa juna a kowane yanayi. Ƙira ɗaya na buƙatar faɗaɗɗen keɓancewa, ɗayan kuma ƴar ƙanƙanta. Yin hasashe yana ɓata maka sirri ko wata rana.
Ƙira biyu na DNS don iri ɗaya gazawa
Ƙira A na ɗaukar resolver a matsayin wata hidima a bayan tunnel. Dokokin Firewall suna ba da izinin UDP da TCP 53 a kan fuskar tunnel kawai, kuma adireshin da ake ba abokin ciniki resolver ne a cikin tunnel. Lokacin da tunnel ya faɗi, bincike yana tsayawa, kuma wannan shine sakamakon da ake so, ba laifi ba.
Ƙira B na riƙe resolver a isarsa a cikin cibiyar sadarwar gida, yawanci na'urar router a 192.168.1.1 ko stub na tsarin aiki a 127.0.0.53, bisa hujjar cewa warware sunaye bai kamata ya mutu tare da tunnel ba. Yana da sauƙi a LAN na gida inda router ke warwarewa ga dukan gidan. A Wi-Fi na otal ko filin jirgin sama wannan keɓancewar tana nuni ga uwar garken wani, kuma kowace suna da kuka rubuta ana bayyana ta, ko da yake zirga-zirgar gidan yanar gizonku na zama a toshe.
Iyakar ita ce wanene ya mallaki resolver. Idan kun amince da na gida, keɓancewa ƙaramin rami ne na gaskiya. Idan ba haka ba, ƙirar tunnel kawai ita ce kaɗai ke tsayawa, kuma farashin shi ne cewa tunnel da ya faɗi yana ɗaukar kowane suna.
Me ya sa binciken abokin ciniki VPN da kansa yake aiki har yanzu
Abokin ciniki dole ya warware sunan mai masaukin ƙofa kafin tunnel ya wanzu, don haka toshe mai tsanani bai kamata ya rufe hanyar farkon abokin ciniki ba. Yawancin abokan ciniki ko suna ajiye adireshin ƙarshen a cache ko suna ba da keɓancewar farko da aka rubuta don wannan mai masauki ɗaya. Idan tsarin dokokinku ya toshe wannan binciken, tunnel ba zai dawo ba kuma log ɗin yana nuna abokin ciniki wanda ba zai iya isa uwar garkensa ba, wanda laifin manufa ne ba na DNS ba.
DNS rabaɗɗe shine wani wuri da wannan ke bayyana. Abokin ciniki yana tura yanki na ciki zuwa resolver mai zaman kansa sannan ya bar duk sauran ga resolver na tsarin. Bayan faɗuwa, sunaye na jama'a na iya warwarewa yayin da na ciki ke ƙarewa, domin yankin mai zaman kansa ba shi da hanya. Ga mai amfani wannan shine "VPN ya karya intanet"; ga log ɗin resolver tambaya ce da ba ta taɓa isowa ba.
A ƙarƙashin systemd-resolved zaka iya ganin rabuwar kai tsaye.resolvectl statusyana lissafa uwar garken DNS na kowace hanyar haɗi da yankunan tafiyar da hanya, kuma bayan tunnel ya sauka yankin ciki yana ci gaba da nuni ga uwar garke a kan hanyar da ba ta wanzu. Stub ɗin da ke 127.0.0.53 har yanzu yana karɓar tambayar, sannan yana jiran na sama wanda ba zai amsa ba, wanda shine dalilin da gazawar ke ɗaukar daƙiƙa maimakon dawowa nan take.
DNS ɓoyayye ba ya tsallake matatar fakiti
DNS over HTTPS da DNS over TLS suna tafiya a 443 da 853, don haka dokar da ke toshe tashar 53 ba ta ce komai game da su ba. Toshe "DNS" bisa tasha manufa ce game da tasha, ba game da warware sunaye ba. Idan kill switch ɗinku yana toshe duk zirga-zirga a wajen tunnel, DoH yana cikin rufewa bisa kuskure. Idan kun ware izini ga captive portal ko resolver na jama'a, ba ya cikin rufewa.
Sarrafawa a gefen abokin ciniki shine mafi arha hannu. Firefox yana barin resolver ɗin DoH ɗinsa lokacin da sunan kanariuse-application-dns.netbai warware ba, wanda shine dalilin da cibiyoyin sadarwa da ake sarrafawa ke wallafa wannan yankin a matsayin NXDOMAIN; manufar kamfani kuma na iya daidaita shi a kashe. Android Private DNS da DNS mai tsaro na Chrome suna da nasu maɓallan da nasu tsoffin. Kashe su ya fi dogaro fiye da bin adiresoshin resolver, domin jerin adiresoshin yana canzawa kuma tsarin dokokinku ba ya canzawa.
Akwai wani salo na wannan wanda ba ya magana game da ɓarkewa kwata-kwata. Aikace-aikacen da ke da resolver da aka lika yana buƙatar hanyar sadarwa don isa gare shi. Ɓoye yana canza wanda zai iya karanta tambayar, ba ko fakitin zai iya barin na'urar ba, don haka toshewar na'urar gaba ɗaya tana kayar da saitin ba tare da taɓa shi ba.
Daidaita alamar da matakin
Yawancin rahotanni suna zuwa a matsayin jumla ɗaya, kuma wannan jumlar yawanci tana ambaton matakin tuni. Tebur ɗin da ke ƙasa shine abin da nake bita kafin in taɓa doka; manufar ita ce yanke shawara ko an toshe tambayar, an karkatar da ita, ko ba a aika ba.
| Symptom | Likely layer | First check |
|---|---|---|
| Every name fails at once, instantly | Resolver answering with a refusal | Query the resolver by address, not by name |
| Lookups hang for seconds, then time out | Packets dropped with no response | Watch port 53 on the physical link |
| Public names resolve, internal ones do not | Split-DNS routing domain | Per-link DNS servers on the tunnel |
| Names resolve, the page still fails | Not DNS: routing or MTU | Connect to the IP directly |
| Only one application fails | Pinned resolver or cached answer | Check that app's DNS setting |
Layukan farko biyu sune waɗanda mutane ke yin kuskuren bincike. Faɗuwa shiru da ƙi duk suna kama da "DNS ya lalace" a burauza, amma ɗaya ne kawai daga cikinsu ke nufin kill switch ɗinku yana yin aikinsa. Ƙi yana nufin wani abu ya amsa, don haka toshewar ba inda kuke tsammani ba.
Maido da manufar resolver, sannan tabbatar da ita
Gyara ƙirar, ba alamar ba. Don warwarewa cikin tunnel kawai, ba da izinin 53 a fuskar tunnel, tura resolver na ciki tare da tsarin tunnel, sannan bar hanyar haɗi ta jiki ba tare da wani izinin DNS ba. A wg-quick layinDNS =shine ke rubuta resolver a cikin tsarin fuska, don haka tunnel da ya bar shi yana barin tsohon resolver a wurinsa kuma kowace tambaya a kan hanyar da ba daidai ba.littafin wg-quickyana rubuta wannan ɗabi'a ga kowace dandamali.
Sannan tabbatar a wannan tsari. A Linuxresolvectl statusyana nuna hanyar da ke aiki,dig +short example.comyana gwada sunan jama'a,dig @10.8.0.1 internal.example.comyana gwada na sirri, kumasudo tcpdump -ni any port 53yana nuna wace fuska fakiti ke amfani da ita yayin da kuke gudanar da duka biyu. A WindowsGet-DnsClientServerAddress -AddressFamily IPv4daResolve-DnsName example.comsuna ba da gaskiya biyu iri ɗaya: wanene aka tsara, da wanene ke amsawa.
Kammala da gwajin mara kyau. Cire tunnel ɗin, tabbatar sabon sunan jama'a ya kasa, tabbatar sunan sirri ya kasa, kumatabbatar babu wani fakitin tashar 53 da ya bar adaftan jiki. Toshewar da ke tsayawa ga amsoshi da aka ajiye kawai ba ya tsayawa kwata-kwata.
Jerin dubawa kafin ka rufe tikitin:
- Resolver ɗin da aka yi amfani da shi a lokacin gazawar shine wanda manufar ke nufi.
- Binciken ƙarshen abokin ciniki da kansa har yanzu an yarda da shi, ta cache ko keɓancewa.
- DoH da DoT ko toshewar ta rufe su ko an kashe su da manufa.
- Yankunan sirri suna gazawa a rufe, ba a buɗe ba, da zarar tunnel ya tafi.