Dakatar da hidimomin Linux biyu da ke fafatawa kan /etc/resolv.conf

DNS yana komawa zuwa tsohon yanayinsa, sake haɗa VPN yana soke gyaran da ka yi, kuma daga ƙarshe wani a ƙungiyar ya ba da shawarar a kulle fayil ɗin. Wannan jerin alama ce, ba mafita ba: abubuwa biyu duka suna ganin su ne suka mallaki /etc/resolv.conf, kuma wanda ya rubuta ƙarshe ne yake cin nasara. Kulle fayil ɗin ba ya magance rikicin mallaka, yana ɓoye shi ne kawai yayin da yake karya ɓangaren da kake so da gaske. Bi gwaje-gwajen huɗu da ke ƙasa a jere, ka gyara tsarin a matakin da ya mallaki shi, ba a fayil ɗin ba.

Gwaji 1: shin hanyar haɗi ce ta alama, kuma zuwa ina

Fara da fayil ɗin kansa, domin hanyar da kake gyara mai yiwuwa ba fayil ɗin ba ne kwata-kwata. Hanyar haɗi ta alama zuwa kundin lokacin gudanar da mai warwarewa tana yin daban da fayil na yau da kullum wanda rubutun abokin ciniki ke sake rubutawa:

ls -l /etc/resolv.conf
readlink -f /etc/resolv.conf
cat /etc/resolv.conf

Hanyar haɗi zuwa hanyar stub ta systemd-resolved yana nufin an ƙirƙiri abin da ke cikin fayil ɗin, kuma gyaran hannu za a sake rubuta shi a wani yanayi na gaba. Fayil na yau da kullum mai layukan nameserver yawanci abokin ciniki ko ƙugiyar DHCP da ke gudana lokacin haɗawa ne ke rubuta shi. Duka biyun halal ne; abin da ke da muhimmanci shi ne sanin wanne kake da shi kafin ka canza wani abu.

Gwaji 2: wane daemon ne ke gudana

Gano abin da ke aiki da gaske, ba abin da aka shigar ba. A rarraba na zamani ana iya samun masu warwarewa da yawa, kuma wanda ke riƙe tashar 53 a muƙamin loopback shi ne ke amsawa:

systemctl status systemd-resolved --no-pager
resolvectl status
ss -lunp | grep ':53'

Fitowar matsayi tana ambaton sabar DNS na kowace hanyar haɗi da yankunan turawa, wanda shine taswirar da kake buƙata don split DNS. Idan sunaye na ciki dole su tafi sabar ciki kuma duk sauran zuwa na jama'a, wannan manufar tana rayuwa a cikin yankunan kowace hanyar haɗi, kuma lallasa ta cikin jerin nameserver a tsaye a cikin fayil ɗin tana ɓata wannan bambanci a shiru.

Tsarin NetworkManager da kansa yana ƙayyade wanne daga waɗannan backends yake amfani da shi. Saitinsa na dns= a babban fayil ɗin tsari yana zaɓar tsakanin mai warwarewarsa na ciki, dnsmasq, systemd-resolved da none, kuma rarraba na iya zaɓar a madadinka. Karanta wannan saitin kafin ka yanke shawara abin da “gyara DNS” yake nufi a wannan mai masaukin.

Gwaji 3: abin da aka ba abokin ciniki VPN izinin rubutawa

Anan ne rikicin yawanci yake rayuwa. Abokin ciniki VPN da ke sake rubuta fayil ɗin mai warwarewa kai tsaye zai yi gwagwarmaya da duk wata hidima da ita ma ke kula da shi, kuma wanda ya ci nasara shi ne wanda ya fara gudana. Sabbin fitowar OpenVPN na iya ba da saitunan DNS ga systemd-resolved maimakon sake rubuta fayil ɗin, wanda shine halin haɗin kai da kake so; tsofaffin rubututtuka da ƙugiyoyin da aka rubuta da hannu sukan kira tsohon mataimaki ko kawai su sake rubuta fayil ɗin.

Yanayin WireGuard yayi kama da siffa: tsarin muƙamin da kansa ba ya kula da DNS, kayan aikin da ke kewaye da shi ne ke yin hakan, ta hanyar mataimakin mai warwarewa ko haɗin resolved. Idan an shigar da irin waɗannan mataimaka biyu, duka biyun za su yi ƙoƙarin aiwatar da ra'ayinsu na duniya lokacin haɗawa.

Karanta ƙugiyoyin sama da ƙasa na abokin ciniki maimakon yin hasashe. Wasu layukan shell a cikin /etc/openvpn/up.sh ko wani kundi makamancin haka suna bayyana halin da in ba haka ba zai yi kama da rashin tsari, kuma su ne wurin da za ka sa abokin ciniki ya haɗa kai maimakon yin fafatawa.

Gwaji 4: gyara shi wurin mai shi, ba a fayil ɗin ba

Da zarar ka san mai shi, saita DNS ta hanyar muƙamin da wannan mai shi ke tallafawa. Ga systemd-resolved hakan yana nufin saitunan kowace hanyar haɗi da yankunan turawa maimakon fayil a tsaye; ga NetworkManager yana nufin saitunan DNS na bayanin haɗin da backend ɗin da aka zaɓa; ga rarraba da ke amfani da haɗin resolvconf yana nufin rubutu ta wannan mataimaki.

Kada ka mai da fayil ɗin marar canzawa. Sifar rashin canzawa tana dakatar da sabunta DHCP na halal da sabunta VPN tare da waɗanda kake yaƙi da su, kuma tana barin tsarin cikin yanayin da sabunta fakitin na gaba ko sake haɗawa zai haifar da gazawar da babu wanda zai iya bayyana ta daga tsarin. Tana ɓoye rikicin mallaka, wanda shine ainihin abin da kake ƙoƙarin warwarewa.

Inda abubuwa biyu dole su kasance tare da gaske, ba su ayyuka daban-daban. Bari mai kula da cibiyar sadarwa ya mallaki tsarin matakin muƙami, bari abokin ciniki VPN ya ba da gudummawar DNS da yankuna na kowace hanyar haɗi ta wannan haɗin, kuma cire rubutun na uku da ke rubuta fayil ɗin kai tsaye. Takardun systemd-resolved sun bayyana hanyoyin da yake tallafawa da abin da kowanne ke bayyanawa a cikin /etc/resolv.conf. Zaɓi hanyar da ta dace da yawan manufofin da kake buƙatar kiyayewa. Idan split DNS yana da muhimmanci, tsarin stub tare da yankunan kowace hanyar haɗi yana kiyaye shi, yayin da hanyar da ke kwafa sabar upstream cikin fayil ɗin tana lallasa shi a shiru.

Tabbatar bayan sake haɗawa, ba bayan gyaran ba

Fayil da ya yi kama da daidai nan da nan bayan canjin ka ba ya tabbatar da komai, domin yanayin na gaba bai riga ya faru ba. Kunna jerin da ya saba karye shi: saukar da rami sannan ka tayar da shi, sabunta lamunin DHCP ko canza muƙamin, sannan ka sake karanta waɗannan ƙimomin.

resolvectl query build.corp.example
resolvectl query example.com
resolvectl status | head -40

Sannan tabbatar da bambancin da ke da muhimmanci: ana warware sunan ciki ta sabar ciki yayin da sunan jama'a ke ci gaba da aiki. Tsarin da ke aika komai zuwa sabar ciki yana kama da kyau har sai wani ya yi ƙoƙarin isa intanet ta rami, kuma tsarin da ke aika komai zuwa na jama'a yana fallasa sunaye na ciki.

Rubuta mai shi, backend da yanayin hanyar haɗi ta alama a cikin bayanan turawa. Wannan sakin layi ɗaya yana juya sabunta fakitin nan gaba daga lamari zuwa abin dubawa, kuma yana hana na gaba sake gano wannan rikici da umarnin chattr.