Juya abokan cinikin OpenVPN zuwa mai warwarewar Pi-hole a wani mai masauki

Saka adireshin Pi-hole a cikin bayanin OpenVPN ba ya ƙirƙirar hanya zuwa gare shi, ba ya ba da izinin tambayarsa, kuma ba ya tabbatar da cewa abokin ciniki zai yi amfani da shi. Lokacin da Pi-hole ke kan wata na'ura ta LAN daban, abubuwa huɗu dole su daidaita: hanyar daga abokin ciniki, turawa daga ƙofar, hanyar dawowa zuwa tafkin, da manufar karɓa a kan Pi-hole da kansa. Kowane gazawa yana bayyana daban a cikin tarihi. Yin maganinsu a wannan tsari ya fi gyara na ƙarshe da farko sauri. Hanyar gajeriyar da aka saba, buɗe maimaitawa ga kowace tushen, tana musanya ƙaramin matsala da ta dindindin.

Abin da zaɓin DNS da aka tura yake yi da abin da ba ya yi

Uwar garken tana sanar da mai warwarewa da umarnin da ke ƙasa, tana ɗaukan cewa 192.168.50.53 shine mai masaukin Pi-hole. Abokin ciniki yana karɓar zaɓin kuma, gwargwadon dandamali da haɗin mai warwarewa , yana amfani da shi a kan muƙamin rami ko yana watsi da shi don neman stub na gida. Layin hanya yana da mahimmanci kamar layin DNS, domin mai warwarewar da abokin ciniki ba zai iya isa ba ba mai warwarewa ba ne kwata-kwata. Babu ɗaya daga cikin waɗannan da ake gani daga gefen uwar garke.

server 10.90.0.0 255.255.255.0
push "dhcp-option DNS 192.168.50.53"
push "route 192.168.50.0 255.255.255.0"

Karɓar zaɓi ba daidai yake da amfani da shi ba. Abokin cinikin Linux mai mai kula da mai warwarewa na iya karɓar uwar garken da aka tura kuma ya aika masa wasu yankuna kawai; abokin cinikin da ke kula da DNS da kansa na iya rubuta kan saitin gaba ɗaya. Hanyoyin da aka tura ma suna da iyaka a wasu dandamali, wanda ke barin mai warwarewar ba za a iya isa ba ko da an karɓi zaɓin. Bincika a kan abokin ciniki wace uwar garke ce ke amsawa, ba a kan uwar garke abin da aka aika ba.

Zaɓin kuma bai ce komai ba game da gefen uwar garke. Har yanzu zirga-zirgar DNS dole ta tashi daga abokin ciniki zuwa ƙofar kuma daga ƙofar zuwa Pi-hole kafin kowane zaɓi ya yi ma'ana. Hanyar da ta ɓace da tambayar da aka ƙi suna kama da juna daga abokin ciniki, don haka fara tabbatar da turawa a ƙofar.

Hanyar dawowa daga Pi-hole zuwa tafkin

Idan an kiyaye adireshin tushen abokin ciniki, Pi-hole yana amsa zuwa adireshin da ke cikin tafkin VPN. Kila jadawalin hanyarsa mai yiwuwa bai san komai ba game da wannan tafkin, don haka amsar tana zuwa ƙofarsa ta asali kuma ta ɓace. Tarihin tambayoyi yana nuna buƙata ba tare da amsa da ta dace ba, wanda ke da sauƙin ɗauka a matsayin matsalar bangon wuta.

Ba wa na'urar tafiyar da LAN hanyar tsaye don tafkin tare da ƙofar OpenVPN a matsayin tsalle na gaba, ko fassara tushen a ƙofar kafin turawa zuwa Pi-hole. Na farko yana kiyaye adireshin kowane abokin ciniki a bayyane a cikin tarihin tambayoyin Pi-hole. Na biyu yana cire buƙatar hanyar dawowa amma yana sa kowace tambaya ta yi kama da ta fito daga ƙofar. Babu ɗaya da ke kuskure; suna amsa tambayoyi daban-daban.

Idan rahoto ko manufar kowane abokin ciniki yana da mahimmanci, hanyar tsaye ita ce mafi kyawun musanya. Idan wani ne ke kula da LAN kuma babu hanya, fassara ita ce zaɓi mai amfani, tare da rubuta asarar shaidar abokin ciniki. Rubuta wacce ka zaɓa, domin kowace tambaya ta tarihi daga baya ta dogara da ita.

Yanayin saurare na Pi-hole ga abokan cinikin da aka tura hanya

Jerin zaɓi na yanayin saurare na muƙamai a shafin saiti a ƙarƙashin DNS yana ƙayyade waɗanne tushe Pi-hole ke amsawa. Mafi tsananin zaɓi yana karɓar abokan cinikin da ke kan cibiyoyin da aka haɗa kai tsaye kawai; zaɓin da ke ba da izinin na'urori a nesa mafi yawa tsalle ɗaya yana faɗaɗa hakan zuwa ƙananan cibiyoyin da ke bayan na'urar tafiyar da ke kusa, kuma abokin cinikin VPN da aka tura hanya yana kama da haka daidai. Fakitin yana isa muƙamin LAN da gaske, amma adireshin tushensa na wani ƙaramin cibiyar ne. Wannan ƙin yarda ne bisa manufa, ba gazawar hanya ba, kuma bambancin yana da mahimmanci lokacin karanta tarihi.

Jagorar saurare ta Pi-hole tana raba tushen da aka haɗa a gida da asalin da aka tura hanya, kuma muƙamin isowa ba shine ma'auni ba. Zaɓi yanayin da ke ba da izinin tafkin VPN ba tare da ba da izinin intanet gaba ɗaya ba, sannan haɗa shi da ƙa'idar bangon wuta da ke karɓar DNS daga tafkin kawai.

Buɗe maimaitawa ga duk asalin don tambaya ta farko ta yi aiki shine gyara mara kyau. Yana mai da mai warwarewa na sirri ya zama buɗaɗɗe, kuma gyaran shine izini mai iyaka, ba na duniya ba.

Daidaita amsa da tarihin tambayoyi

Tambayi abokin ciniki, sannan duba uwar garke kuma kwatanta duka biyun. A kan abokin cinikin systemd-resolved umarnin da ke ƙasa suna bayar da rahoton wane mai warwarewa ya samar da amsa da waɗanne uwar garke aka saita ga kowace hanyar haɗi. Yi amfani da sunan da Pi-hole kaɗai ya sani, domin tambaya kai tsaye zuwa adireshin Pi-hole tana tabbatar da isarsa, ba saiti ba.

resolvectl query intranet.example.lan
resolvectl dns

Amsar da ake tsammani tana ambaton 192.168.50.53 a matsayin uwar garke kuma tana mayar da adireshin da wannan mai warwarewar kaɗai zai sani. Sannan duba ra'ayin Pi-hole da kansa: pihole -t yana bin tarihin tambayoyi kai tsaye, kuma kowane layi yana ɗauke da adireshin tushe. Idan tushen adireshin ramin abokin ciniki ne, hanyar tafkin tana lafiya. Idan adireshin LAN na ƙofar ne, fassarar tushe tana gudana kuma adireshin abokin ciniki da kansa ba zai taɓa bayyana ba.

Idan babu abin da ya bayyana a tarihi kwata-kwata, tambayar ba ta taɓa isa Pi-hole ba kuma abu na gaba da za a duba shine turawa a ƙofar. Idan tambayar ta bayyana amma babu amsa da ta dawo, matsalar ita ce hanyar dawowa, wato sashen da ya gabata. Rarraba gazawar haka yana hana kuskuren hanya ɗauka a matsayin ƙa'idar bangon wuta.

Duba ƙa'idar turawa ta ƙofar

Ƙofar dole ta tura fakitin DNS na abokin ciniki zuwa ga Pi-hole, kuma ƙa'idar da ke yin hakan ta cancanci karantawa maimakon ɗauka. Umarnin da ke ƙasa suna lissafa ƙa'idodin da suka taɓa tashar 53 tare da masu ƙididdigewa, a kan mai masaukin nftables da kuma mai masaukin iptables. Ƙa'idar da ta wanzu amma tana nuna sifili na daidaito alama ce cewa ana jefar da zirga-zirga kafin a fassara ta.

sudo nft list ruleset | grep -A3 'dport 53'
sudo iptables -t nat -L POSTROUTING -n -v | grep 53

Karanta masu ƙididdigewa, ba ƙa'idodi kawai ba. Ƙa'idar da ba ta taɓa daidaitawa tana nufin fakitin yana fita ta wani muƙami, ko abokin ciniki bai taɓa aika shi ba. Ƙa'idar da ta dace a kowace tambaya tana nufin turawa tana aiki kuma matsalar tana gaba a kan hanya.

Duk wani kayan aiki da mai masaukin ya yi amfani da shi, riƙe binciken kunkuntar: tafkin a matsayin tushe, tashar 53 a matsayin manufa da Pi-hole a matsayin makasudin da aka yarda da shi kaɗai. Faɗin ƙa'idar turawa da ke ba da izinin tashar 80 ma wata matsala ce da ke jiran faruwa.