Hotspot na Pi tare da Pi-hole da VPN: ba kowace sabis aikinta
Yanke shawara wanda ya mallaki DHCP, DNS da tura fakiti kafin kun kunna mataimaka uku a Pi ɗaya. Masu biyu suna haifar da hayar gasa da madaukai na resolver.
Wayar tana haɗawa da hotspot na Pi, tana samun adireshi, amma shafin bai buɗe ba. Pi yana gudanar da mataimakin hotspot, Pi-hole da abokin ciniki na VPN, kowanne yana tunanin yana da wani ɓangare na hanya. Yawancin irin waɗannan gine-gine suna kasawa ba don wani ɓangare ya lalace ba, amma don ɓangarori biyu suna yin aiki ɗaya. Ba da mai ɗaya ga kowane aiki kafin ka daidaita ɗayansu.
Ba da mai ɗaya ga kowane aiki
A nan ayyuka huɗu ne suka fi muhimmanci, kowanne yana bukatar mai ɗaya daidai. Teburin da ke ƙasa ya ambaci aikin, mai da zai iya aiki, da abin da ke lalacewa lokacin da sabis biyu suka nemi shi.
| Function | Workable owner | Duplicate-owner symptom |
|---|---|---|
| Client addresses | One DHCP server, such as the hotspot helper | Competing offers and changing leases |
| DNS reception | Pi-hole on port 53 | Bind failure or queries answered by the wrong process |
| Forwarding and NAT | One firewall manager | Double translation and broken return paths |
| VPN routing | One client configuration | Route flapping and traffic escaping outside the tunnel |
Haɗuwa takan zo fakiti ɗaya a lokaci. Mataimakin hotspot yana girka nasa dnsmasq, Pi-hole yana son tashar 53, kuma abokin ciniki na VPN yana ƙara hanyoyi. Kowane mataki yana da kyau shi kaɗai, amma tare suna yin na'ura da sabis na biyu da ya fara ke canza halin na farko a hankali.
Rubuta masu mallakar kafin ka kunna wani abu. Ƙaramin teburi a cikin bayanan gini yana hana girke-girke na gaba ya karɓi aikin da yake da mai.
Zaɓi yanki ɗaya ka nisanta shi daga rami
Zaɓi yankin hotspot, adireshin Pi a cikinsa, tafkin DHCP da resolver da abokan ciniki suke samu. Ka ware wannan yankin daga LAN na sama da yankin ramin VPN, domin yankunan da suka haɗu suna mai da matsalar turawa aikin fassarar adireshi. Yankin da ya haɗu da rami yana mai da Pi na'urar turawa ba da gangan ba tsakanin prefixes guda biyu iri ɗaya. Rubuta yankin da tafkin cikin saitin hotspot maimakon barin su ga tsoho.
Idan yanayin rabo na NetworkManager ne ya mallaki hotspot, duba haɗin da ke aiki kafin ƙara uwar garken DHCP. Yanayin rabo yana tayar da nasa mataimaka kuma yana kunna turawa, don haka shi ne mai tsarin adireshi na wannan mu'amala. Ƙara uwar garken biyu don kawai akwai shi yana haifar da tayi masu gasa maimakon ajiya.
Yanke shawara kan IPv6 da gangan. Sanarwar na'urar turawa da DHCPv6 a yawancin saituna suna zuwa daga wani mataimaki daban da DHCPv4, kuma barin IPv6 a kunne yayin da manufar VPN ta shafi IPv4 kawai yana ba abokan ciniki hanyar da ta tsallake ramin. Ko dai ka tsara bangaren IPv6 ko ka kashe shi a mu'amalar hotspot da rubutaccen dalili.
Wanene a zahiri yake amsa a tashar 53
Lissafa kowane tsari da ke sauraron tashar 53 kafin ka canza saiti. A Pi da ke gudanar da stub na resolver na gida, Pi-hole da mataimakin rabo, jerin masu sauraro shine kawai taswirar tabbatacciyar wanda ke amsa tambayoyi:
sudo ss -lunpt '( sport = :53 )'
ip -4 addr show
ip routeJagorar mu'amala ta Pi-hole ta bayyana cewa yanayin karɓa da aka iyakance ga mu'amala ɗaya na iya yin amfani da soket na wildcard kuma ya watsar da abin da ya zo wani wuri. Wannan ba daidai yake da ɗaure ga zaɓaɓɓun mu'amaloli kawai ba, wanda shine tsarin da ake nufi lokacin da wani sabis na DNS dole ya raba na'urar.
Tsari biyu yawanci ba za su iya ɗaure adireshi da tasha ɗaya ba, ko da SO_REUSEPORT na iya sa ɗaure na rabo ya yi nasara; har yanzu mai sauraro na wildcard na iya ɗaukar abin da aka nufa ga sabis mafi ƙunci. Zaɓi yanayin da aka rubuta ga rawar da kake so kuma sake kunna sabis ɗin a tsarin da aka nufa.
Ka ware shafin gudanarwa na Pi-hole daga cibiyar sadarwar hotspot. Abokan ciniki suna bukatar resolver, ba ingantaccen shafi ko API da zai iya canza saitin resolver ba.
Ƙafafun DNS biyu, kowanne da manufa ɗaya
Tambayar abokin ciniki tana tafiya daga wayar zuwa Pi, wata tambayar dabam tana tafiya daga Pi zuwa resolver na sama. Dokar turawa da ta dace da zirga-zirgar hotspot da aka tura ba ta aiki kai tsaye ga ƙafa ta biyu, domin Pi yana ƙirƙirar wannan zirga-zirgar a cikin gida. Idan VPN ya kamata ya ɗauki DNS, hanyar cikin gida tana bukatar nata manufar.
Yi hankali da madauki. Juya resolver na sama na Pi-hole zuwa adireshin da Pi da kansa ke bayarwa, kai tsaye ko ta hanyar tashar turawa, yana haifar da tambayoyin da suke juyawa har su ƙare. Ba shi ainihin resolver na sama ko mai tura na sharadi ga yankunan da ba zai iya amsawa ba.
Yanke shawara abin da ke faruwa idan ramin ya faɗi. Komawa ga resolver na gida yana rayar da bincike amma zai iya zubar da sunaye zuwa wajen VPN; toshewa yana kiyaye manufar kuma yana mai da rashin aiki ya zama kuskure da ake gani. Dukan zaɓuɓɓukan suna da hujja, amma dole a zaɓa su ba a gado su daga tsoho ba.
Tabbatar da hanya da halin lokacin rashin aiki
Gwada da yadudduka: abokin ciniki ya sami adireshi, ya warware suna ta Pi, Pi ya warware ta hanyar da aka nufa ta sama, kuma manhaja ta kammala buƙata. Ping mai nasara ba ya ce komai game da DNS, kuma bincike mai nasara ba ya ce komai game da turawa.
dig @192.168.70.1 example.com
curl -sS -o /dev/null -w '%{http_code}\n' https://example.com/
ip -4 route get 1.1.1.1Sannan ka tsayar da ramin ka maimaita. Halin da aka nufa ya kamata ya bayyana cikin 'yan daƙiƙa, ba bayan sake kunna Pi-hole ko sabis na hotspot da hannu ba. Duba saitin resolver na abokin ciniki yayin rashin aikin, domin resolver na jama'a na biyu zai ci gaba da amsawa ko da manufar tana tsammanin gazawa.
Ka riƙe mai ɗaya ga turawa da NAT kuma ka tabbatar da shi daga abokin ciniki, ba daga Pi da kansa ba. Buƙatar da ta bar Pi cikin nasara ana iya watsar da ita a hanyar dawowa, kuma abokin ciniki shine kawai wurin da ake ganin dukan hanyar.