Pi-hole ba ya toshe tallace-tallace bayan VPN ya haɗu: dubawa biyar

Tallace-tallace na ci gaba da bayyana a kan abokin ciniki, Pi-hole yana cewa yana cikin lafiya, kuma ramin yana aiki, don haka tunanin shine a tura zirga-zirgar wannan abokin ciniki ta Pi. Wannan shine karkataccen juyi. Tacewa na buƙatar tambayoyin, ba fakiti ba, kuma abokin ciniki da tambayoyinsa ke zuwa ga mai warwarewar ISP yana zama ba a tace shi ba ko'ina zirga-zirgarsa ta gudana. Bi wannan jerin a jere kuma tsaya a matakin farko da ya kasa, domin mataki na gaba ba zai iya gaya mika komai ba yayin da na baya ya lalace.

1. Karanta mai warwarewar da abokin ciniki yake amfani da shi a zahiri

Tambayi abokin ciniki, ba router ba. A Linux resolvectl status yana buga sabar DNS ta kowace hanyar haɗi da wacce hanyar ke cin nasara; /etc/resolv.conf shi kaɗai yawanci stub ne da ke nuni zuwa 127.0.0.53. A Windows ipconfig /all yana lissafta sabobin da DHCP ya bayar ta kowace adafta, kuma a macOS scutil --dns yana nuna irin wannan ta kowane yanki. Idan amsar ba adireshin Pi-hole ba ce, kana da matsalar rabo kuma mataki 2 shine inda take.

Abubuwa biyu suna kayar da mai warwarewar tsarin ko da an saita shi daidai. Masu bincike da ke da nasu DNS mai tsaro (zaɓin “Use secure DNS” na Chrome, network.trr.mode na Firefox) suna aika tambayoyi ta HTTPS zuwa mai warwarewar jama'a kuma ba sa taɓa buɗe tashar 53. Kuma abokin cinikin VPN a kan abokin ciniki da kansa na iya sanya sabar DNS a kan muƙamin raminsa da yankin tafiyar ~., wanda ke sa wannan hanyar ta zama mai iko ga kowace suna.

Gwada hanyar da manhajoji ke bi, ba hanyar da kayan aikin gyara ke bi ba. resolvectl query example.com yana nuna wacce hanyar ta amsa, kuma getent hosts example.com yana bi ta hanyar NSS ɗaya da manhaja ke bi; a macOS dscacheutil -q host -a name example.com yana karanta masu warwarewar yanki da scutil --dns ke lissafawa. dig tsirara ba ya yin haka: yana karanta /etc/resolv.conf kuma yana tsallake zaɓin kowace hanyar, don haka zai iya amsa daga Pi-hole yayin da kowace manhaja ke amfani da mai warwarewar da aka tura, kuma wannan shine ainihin gazawar da wannan jerin ya wanzu domin kamawa. Ka riƙe dig @192.168.1.53 don gwada wata sabar ta musamman.

2. Tabbatar da wanda ke rarraba amsar

Rabo yana zuwa daga duk abin da ke amsa DHCP. A dnsmasq wannan layi ɗaya ne, dhcp-option=6,192.168.1.53; a cikin UI na gidan yanar gizo na router shine filin DNS a sashen DHCP na LAN. Abokan ciniki dole ne su sabunta kafin su gan shi. Na'urar da ta yi kwanaki tana aiki tana riƙe da tsohon hayar, kuma na'urar da aka rubuta mata mai warwarewa da hannu tana riƙe shi har abada. Sabunta a kan abokin cinikin gwaji maimakon ɗaukan yaduwa.

IPv6 shine rabin da ake mantawa. Sanarwar router na iya ɗaukar sabar DNS nasu (RDNSS), kuma a OpenWrt wannan shine zaɓin ra_dns na odhcpd; abokin ciniki da ya fi son IPv6 yana amfani da wannan sabar yayin da zaɓin DHCPv4 da ka saita yanzu ya kasance ba a amfani da shi. Idan ba ka shirye don ba da DNS ta IPv6 ba, share sanarwar DNS kawai: ra_dns a cikin odhcpd, ko zaɓin RDNSS a cikin duk abin da ke amsa sanarwar router. Kashe dukan sanarwar kuma yana cire adireshin IPv6 daga LAN, wanda shine babban canji fiye da wanda ka yi niyya, yayin da share zaɓin DNS kawai yana kiyaye adireshin daidai kuma yana sa RDNSS da ya ɓace ya zama bayyananne a cikin ɗaukar fakiti.

3. Tabbatar cewa tambayar ta isa Pi-hole

Tambaya daga Pi ba ta tabbatar da komai game da hanyar cibiyar sadarwa ba. Gudanar da ita daga abokin ciniki kuma karanta lambar amsa:

dig @192.168.1.53 example.com
dig @192.168.1.53 doubleclick.net

Ƙarewar lokaci yana nuni ga tacewa ko hanyar tafiya; REFUSED yana nuni ga ka'idar shiga; SERVFAIL yana nuni ga mai warwarewar sama a bayan Pi-hole; amsar daidai da ba ta taɓa bayyana a tarihin tambaya tana nufin abokin ciniki ya tambayi wani abu daban. Duba UDP da TCP 53, domin manyan amsoshi da wasu masu warwarewa suna komawa TCP, kuma buga duka biyu idan Pi-hole yana aiki a cikin kwano. Taswirar da ke rufe UDP kawai tana haifar da gazawa lokaci-lokaci waɗanda suke kama da asarar fakiti.

Sannan yanayin sauraren Pi-hole yana yanke shawara ko yana amsawa kwata-kwata. A yanayin na gida kawai dnsmasq yana watsi da tambayoyi daga tushen da ba su kan subnet da aka haɗa kai tsaye ba, kuma haka abokin ciniki da ke bayan wani router ko wanda ke zuwa ta rami yake kama: abokin cinikin ya ƙare lokaci kuma tambayar ba ta taɓa isa tarihin ba. Tambayar da ta bayyana a matsayin REFUSED an ƙi ta da lissafin shiga ko ka'idar firewall. Ba da izini ga dukan tushe shine gyaran da aka saba, tare da ka'idar firewall da ke iyakance tashar 53 ga subnets naka.

4. Duba ko ramin ya maye gurbin amsar ko ya haɗiye ta

Wannan shine yanayin da alamomin biyu ke ɓoye a ciki. Lokacin da router da kansa abokin cinikin VPN ne, zaɓin DNS da aka tura zai iya wuce saitin LAN a daidai lokacin da ramin ya tashi: sabobin OpenVPN suna tura dhcp-option DNS, kuma bayanan WireGuard suna ɗauke da nasu shigarwar DNS. Karanta mai warwarewar router mai tasiri yayin da ramin yake aiki, ba kafin haka ba, kuma yi watsi da abin da shafin LAN ke iƙirari.

Sauran kuskuren shine isa, ba maye gurbi ba. Idan prefixes da aka yarda na ramin sun haɗa da subnet ɗin LAN naka, router yana da hanyar da ke aika tambayoyin 192.168.1.53 cikin ramin, kuma ɗayan gefen ba shi da hanyar dawowa: tambayoyin suna ƙarewa lokaci ko da ramin yana cikin lafiya. Akasin hakan yana faruwa sa'ad da Pi-hole yake a cikin subnet ɗin da ramin ba ya ɗaukarsa. Kwatanta adireshin da prefixes ɗin da aka yarda na ramin da teburin tafiyar router kafin ka sake taɓa DNS.

Zaɓi gyara ɗaya, ba duka biyu ba. Ko ka nisanta ramin daga DNS — da pull-filter ignore “dhcp-option DNS” a OpenVPN kuma babu prefix na LAN a AllowedIPs a WireGuard —, ko ka yarda da mai warwarewar da aka tura kuma ka bar tacewar gida ga abokan ciniki da ke bayan wannan router. Duk abin da ka zaɓa, rubuta shi kusa da bayanin, domin mutumin da zai gyara shi na gaba zai juya shawarar da gangan ba da gangan ba.

5. Maimaita gwajin bayan sake haɗi

Yi tambaya daga abokin ciniki, tabbatar da cewa wannan abokin ciniki ya bayyana a tarihin Pi-hole, sannan warware yankin da ya kamata a toshe kuma duba cewa kana samun amsar toshewa maimakon ta ainihi. Sake haɗa ramin kuma gudanar da tambayoyin biyu ɗin, domin saitin mai warwarewa wanda ke dawwama kawai har zuwa haɗi na gaba shine sakamakon da aka saba na gyaran da aka yi a matakin da bai dace ba.

Ka bar hanyar mai warwarewa ta biyu wadda ba ta dogara da ramin ba, domin rashin Pi-hole ya ragu zuwa bincike ba tare da tacewa ba maimakon babu bincike kwata-kwata. Riƙe tsoffin ƙimar DHCP da mai warwarewa har gwajin ya wuce sau biyu; canjin da ya karya intanet ɗin gida a lokacin abincin dare ya fi wahalar gyarawa fiye da wanda za ka iya dawo da shi cikin minti ɗaya.