Ba VPN ɗin gidanka nasa rikodin DNS don nas.home.arpa

Da zarar ramin ya tashi, mataki na ƙarshe yawanci suna ne da ke aiki maimakon adireshin da kake manna a alamar shafi. Rikodin mai masaukin dnsmasq tare da adireshin resolver da abokin ciniki zai iya isa suna yin haka da fayiloli biyu kuma ba tare da multicast ba. Shawarar da ke buƙatar tunani da gaske ita ce mafi ƙunci: shin abokin ciniki yana aika duk DNS ta resolver ɗin gida, ko sunayen da ke ƙarƙashin home.arpa kawai? Duk abin da ke ƙasa yana ɗaukan ingantaccen saitin WireGuard tare da abokin ciniki na Linux da resolver na ɗakin gwaji wanda mai kula da gida ya riga ya sarrafa.

Hanyoyi uku na ba abokin ciniki resolver

Ga kwamfutar tafi-da-gidanka da ke shiga ramin lokaci-lokaci, split-DNS shine mafi kyawun tsoho: yana riƙe sunayen intanet na yau da kullum a resolver ɗin da injin ya riga ya amince da shi. Ga injin da ya wanzu don isa ayyukan gida, tura resolver ya fi sauƙi kuma kuɗin iyaka ba shi da mahimmanci.

Buga rikodin a resolver ɗin da ya mallaki yankin

Ka raba matsayi kafin rubuta saiti: adireshin abokin ciniki na VPN, resolver da sabis maziyarta uku daban-daban da ayyuka uku daban-daban ne. A wannan ɗakin gwaji su ne 10.77.0.2 ga abokin ciniki, 192.168.50.53 ga dnsmasq da 192.168.50.20 ga NAS, yayin da ramin ke bin hanyar LAN ta gida.

listen-address=127.0.0.1,192.168.50.53
bind-interfaces
local=/home.arpa/
host-record=nas.home.arpa,192.168.50.20

Layin host-record yana ba da adireshin kuma layin local= yana riƙe tambayoyin home.arpa da ba a sani ba a cikin wannan resolver maimakon tura su zuwa sama. Ka fara karanta saitin da kake da shi ka daidaita duk abin da ya riga ya ayyana uwar garke, mu'amala ko wannan yankin gida ɗaya; tara guntun a kan wani mai saɓani yana haifar da resolver da ke lodawa cikin farin ciki kuma yana amsa ba daidai ba. Littafin dnsmasq ya ayyana duka umarnin biyu da sarrafa sauraro.

Sannan ka tabbatar da sabis ɗin da ke gudana, ba fayil ɗin ba. Gwajin saiti tare da sake kunnawa shine mafi ƙaranci, kuma amsar da ta dace ita ce abin da tambaya ke mayarwa.

Bi hanyar resolver, ba shafin yanar gizo kawai ba

AllowedIPs na WireGuard yana ƙayyade waɗanne wurare ke shiga ramin. Idan adireshin resolver ya faɗi a waje, tambaya tana fita ta hanyar yau da kullum kuma ba ta taɓa isa dnsmasq ba, duk da cewa NAS ɗin kansa yana isa. Ka haɗa adireshin resolver, ko ƙayyadaddun LAN da ya ƙunsa, ka duba manufar tura ta ƙofar a wancan gefen.

Ka ba da izinin UDP da TCP a tashar 53 daga kewayon ramin da aka ba da izini, tare da hanyar dawowa zuwa adireshin ramin abokin ciniki. Kada ka tura tashar 53 daga WAN don sauƙaƙe gwaji: ana samun buɗaɗɗen resolver mai maimaitawa a haɗin gida cikin sa'o'i. Daurewa da mu'amala ba manufar shiga ba ce da kanta.

Duba amsar kafin aikace-aikacen

Ka fara tambayar resolver kai tsaye, sannan tsarin, sannan aikace-aikacen. Kowane mataki yana ware ɗaya daga cikin sarkar, kuma bambanci tsakaninsu shine ganewar asali.

dig @192.168.50.53 nas.home.arpa. A
dig +tcp @192.168.50.53 nas.home.arpa. A
getent ahostsv4 nas.home.arpa
curl -sS --max-time 5 http://nas.home.arpa/ -o /dev/null -w '%{http_code}\n'

Ya cancanci gudanar da tambayar TCP saboda yanke amsar UDP yana tilasta sake gwadawa, kuma manufar da ke jefar da TCP 53 tana haifar da gazawa da ke kama da lokaci-lokaci. Matakin getent yana nuna abin da saitin resolver na injin ke yi a zahiri, wanda ba koyaushe shine abin da ka tura ba.

Yanke shawara abin da ke faruwa idan ramin ya faɗi

Idan babban DNS na abokin ciniki ya nuna 192.168.50.53, duk warwarewar suna yana daina aiki idan ramin bai tashi ba. Wannan abin karɓa ne a kan injin da ke da amfani kawai da ramin, kuma ba abin karɓa ba ne a kan kwamfutar tafi-da-gidanka da ke amfani da Wi-Fi na kafe kuma. Split-DNS yana guje wa tambayar gaba ɗaya, domin neman home.arpa kawai ya dogara da resolver ɗin gida.

Ka tuna menene sunan: home.arpa an tanadar da shi don cibiyoyin sadarwar mazauni kuma ba shi da bambanci a duniya, don haka wata cibiyar sadarwa na iya amfani da sunan guda bisa doka. Sauƙi ne na gida, ba mai gane abin dogaro ba. Ka riƙe rikodin a sabunta idan sabis ɗin ya ƙaura, kuma ka cire manufar resolver idan an daina amfani da ɗakin gwajin, maimakon barin kwamfutar tafi-da-gidanka tana nuni ga adireshin da ba za ta iya isa ba sai ta ramin da babu shi yanzu.