DNS da OpenVPN ke turawa ana watsi da shi: wace sashe ke aiwatar da shi

Log ɗin yana nuna zaɓin da sabar ta tura, ramin yana aiki, amma sunayen ciki har yanzu suna kasawa. Tambaya kai tsaye ga mai warwarewa tana amsa, don haka sabar tana lafiya, duk da haka kowace manhaja tana ci gaba da tambayar na'urar turawa ta gida. Abin da ya isa abokin ciniki tayi ne, ba canji a mai warwarewa ba, kuma sashen da ya mallaki warware sunaye ya bambanta a Linux, Windows da macOS. Da zarar ka raba zaɓin daga mai shi, kurakurai huɗu suna rufe kusan kowane rahoto: babu hook, hook biyu masu gasa, DNS raba-da-raba yana aiki kamar yadda aka tsara, ko gajeren suna da ke bukatar ƙari maimakon sabar.

Zaɓin da aka tura tayi ne, ba shigarwa ba

A sabar, umarni biyu suna bayyana niyya, ba sakamako ba:

push "dhcp-option DNS 10.8.0.1"
push "dhcp-option DOMAIN corp.example"

Abokin ciniki ba ya samun mai warwarewa da aka saita. Yana samun canje-canjen muhalli, foreign_option_1 da sauran, ɗaya ga kowace layin da aka tura, kuma wani abu na gida dole ya karanta su ya sake rubuta yanayin mai warwarewa na tsarin aiki. A Linux babu abin da ke yin haka ta misali, shi ya sa ingantaccen sabar da abokin ciniki da aka haɗa har yanzu suna iya warware sunaye ta LAN.

Matakai uku suna tsakanin ƙarshen biyu: tura dole ya yi tafiya, abokin ciniki dole ya bayyana shi, kuma hook dole ya aiwatar da shi. Karanta matsakaicin mataki a log ɗin abokin ciniki da na ƙarshe a yanayin mai warwarewa, ba wai akasin haka ba, domin layin log yana tabbatar da biyun farko kawai.

Tabbatar tura ya isa kuma nemo mai shi

Fara da ambaton mai ƙaddamarwa: umarni openvpn tsirara, kwafin systemd, NetworkManager ko abokin ciniki na mai siyarwa. Wannan yana ƙayyade inda hook zai iya zama. A kan mai masauki mai systemd-resolved, resolvectl status yana lissafa kowace hanyar haɗi da sabar DNS da yankunan bincike da take amfani da su a haƙiƙa, kuma ba koyaushe ake kiran hanyar haɗin rami tun0 ba.

Idan adireshin da aka tura ya bayyana a log amma a kan wata hanyar haɗi babu, haɗin gwiwar ba ya nan. Idan ya bayyana a kan hanyar haɗin amma tambayoyin har yanzu suna fita wani wuri, matsalar ita ce waɗanne tambayoyi suke zaɓar wannan hanyar haɗin. NetworkManager dns=dnsmasq a cikin fayil ɗin /etc/NetworkManager/NetworkManager.conf yana gudanar da mai tura gaba na gida wanda ke aiwatar da DNS raba-da-raba da gangan: sunayen cikin yankin VPN suna zuwa ga mai warwarewa na VPN, duk sauran suna riƙe hanyarsu ta baya. Wannan ɗabi'a tana kama da kuskure lokacin da ka yi tsammanin duk zirga-zirgar za ta ƙaura; duba saitunan kowace haɗi da nmcli connection show "My VPN", inda ipv4.dns da ipv4.dns-search ke riƙe da ƙimar da ke bayan abin da na'urar ke bayarwa, kafin ka kira shi karyayye. Idan kowace tambaya da gaske ya kamata ta isa mai warwarewa na VPN, cire dns=dnsmasq daga NetworkManager.conf sannan sake ƙaddamar da NetworkManager, wanda ke mayar da warware sunaye ga saitunan haɗin; in ba haka ba ka riƙe DNS raba-da-raba ka gyara jerin yankunan da aka tura.

Linux: ba da zaɓuɓɓukan ga mai warwarewa

Fakitin rarrabawa suna kawo hook don wannan, kuma dole a ba abokin ciniki izinin gudanar da shi. Tsari na yau da kullum a kan mai masauki ba tare da systemd-resolved ba:

script-security 2
up /etc/openvpn/update-resolv-conf
down /etc/openvpn/update-resolv-conf

Da systemd-resolved tsohon rubutun resolv.conf na iya rashin canza wani abu mai muhimmanci, domin stub mai warwarewa yana riƙe yanayi ga kowace hanyar haɗi. update-systemd-resolved mai taimako yana rubuta wani nau'i na hook da ke amfani da up-restart da down-pre, wanda ke da muhimmanci lokacin da wata fuska ta wuce ƙoƙarin haɗi ɗaya. Duk abin da ka zaɓa, sashe ɗaya dole ya mallaki yanayin. Ƙara hook mara alaƙa kusa da NetworkManager yana ba hanyar haɗi ɗaya marubuta biyu, kuma sakamakon yana dogara da tsari maimakon saitinka.

Akwai kuma yanayin da NetworkManager ya yi watsi da zaɓin da aka tura gaba ɗaya har sai an shigar da adireshin sabar a cikin saitunan IPv4 na haɗin, sannan yanayin mai warwarewa ya nuna ana amfani da shi. Ya cancanci gwadawa kafin ka sake rubuta rubutun, domin yana motsa matsalar daga hook na shell zuwa bayanin martabar haɗin da ke ɗauke da rami tuni.

Windows da macOS suna aiwatar da sassa daban-daban

Abokin ciniki na Windows yana saita sabar DNS na adaftan VPN, amma Windows har yanzu yana zaɓar fuska ta ma'auni kuma har yanzu yana bukatar ƙari don faɗaɗa gajeren suna. Tabbatar da yanayin adaftan ba bayanin martaba ba:

Get-DnsClientServerAddress -InterfaceAlias "My VPN"
Get-DnsClientNrptPolicy

Idan adireshin ba ya nan, saita shi da Set-DnsClientServerAddress -InterfaceAlias "My VPN" -ServerAddresses 10.8.0.1, sannan ƙara ƙarin zuwa kaddarorin IPv4 na adaftan domin fileserver ya zama fileserver.corp.example. Darajar SearchList ta dukan na'urar a ƙarƙashin Tcpip\Parameters tana yin haka. Inda dogon suna ke warwarewa kuma gajeren ba ya warwarewa, mai warwarewa ya riga ya yi daidai kuma jerin bincike ne ke da laifi. Gyare-gyaren a jere: tura DOMAIN domin abokin ciniki ya koyi ƙarin, ƙara wannan ƙarin zuwa jerin binciken adaftan ko haɗin, kuma a matsayin ma'aunin wucin gadi ka liƙa sunan a cikin hosts, ko LMHOSTS a Windows; binciken NetBIOS ba ya wuce na'urar turawa, don haka watsawar da ke samun gajeren suna a LAN na ofis ba ta taɓa isa ga abokin ciniki na rami ba.

block-outside-dns block-outside-dns ɗabi'ar abokin ciniki na Windows ce, ba layin bayanin martaba mai ɗaukuwa ba, kuma kwafa shi zuwa bayanin martabar Linux ko macOS ba ya sake haifar da shi a can. Idan sunayen jama'a suna aiki kuma na ciki suna kasawa a Windows, kwatanta tsarin adafta a ƙarƙashin Manyan saituna da ipconfig /all. A macOS tsarin masu warwarewa ga kowace sabis na tsarin ne, don haka yi amfani da scutil --dns don ganin wane mai warwarewa ake tambaya ga wace yanki, kuma ɗauki kowane gyare-gyaren bayanin martaba da aka bayar a matsayin mai dogaro da abokin ciniki ba na gama-gari ba.

Na'urar kama-da-wane a kan wannan kwamfutar tafi-da-gidanka ba ta gaji kome daga wannan. Ba wa baƙo shigarwar mai warwarewa ta kansa ga yankin ciki, ko bar NAT na hypervisor ya tura tambayoyinsa ta hanyar mai masauki, wanda daidai ne kawai yayin da ramin mai masauki yana aiki.

Tarihi shine dalili na uku. Sabar DNS ko saitunan ƙari na wani bayanin martaba na baya na iya tsira daga sake haɗi, don haka idan adaftan ya yi kama da daidai kuma bincike har yanzu yana kasawa, kwatanta adaftan mai rai da Get-VpnConnection sannan share ko sake rubuta tsohuwar shigarwa kafin ka taɓa sabar.

Tabbatar inda tambayar ta tafi

Ɗaukar hoto yayin bincike ɗaya yana warware gardama: tcpdump -ni eth0 port 53 yana nuna tambayoyi a kan fuskar zahiri, wato suna fita wajen rami kuma ba a taɓa sauya mai warwarewa ba. dig @10.8.0.1 name.corp.example sannan ya raba sauran yanayi biyu. Idan tambayar kai tsaye ta amsa, mai warwarewa yana aiki kuma abokin ciniki ba ya amfani da shi; idan lokaci ya ƙare, mai warwarewa ba ya isa ta rami kuma babu wani canji na gida da zai taimaka.

Idan mai warwarewar da har yanzu ake amfani da shi shine wanda mai bayarwa ya raba, ramin yana ɓoye zirga-zirgar yayin da sunayen ke kasancewa a bayyane ga wannan mai bayarwa. Tambaya ce ta ɓoyewa ba ta aiki ba, kuma wannan ɗaukar hoto yana amsa ta: tambaya a kan fuskar zahiri tana zuwa ga wani a wajen rami.

Isarwa ta haɗa da firewall a kan mai masaukin VPN, wanda dole ya ba da izinin UDP da TCP 53 daga tafkin. Rufaffen tashar jiragen ruwa yana kama da karyayyen tura daidai, haka ma mai warwarewa da ke amsa daga cikin cibiyar sadarwar rami kawai. Sake ɗaukar hoton bayan ka cire haɗi ka sake haɗawa sau ɗaya, domin saitunan da suke bayyana a haɗin farko kuma suka ɓace a na biyu kuskure ne na zagayowar rayuwa a cikin hook, ba zaɓi da ya ɓace ba.

Riƙe mai shi ɗaya ka tabbatar a jere

Rubutun da ke sake rubuta DNS na adaftan bisa yanayin rami da aka yi hasashe yana kwafin saitin da bayanin martaba ya riga ya ɗauka, kuma yana kasawa cikin shiru a karon farko da hasashen ya yi kuskure. Fi son saitunan DNS na haɗin kansa ko hook ɗaya da aka rubuta, kuma rubuta wanda ka zaɓa domin na gaba kada ya ƙara na biyu.

Rufe da'irar da dubawa huɗu: adireshin da aka tura yana nan a hanyar haɗin rami, sunan ciki yana warwarewa a matsayin cikakken suna, wannan sunan yana warwarewa ba tare da ƙarin ba, kuma duka biyun har yanzu gaskiya ne bayan sake haɗi ɗaya. Ɗaukar hoto ɗaya yana gaya maka wanne daga huɗun ya gaza. Jagorar OpenVPN 2.6 tana lissafa dhcp-option da umarnin rubutun tare da bayaninsu na dandamali.