StrongSwan yana aika adireshin DNS da Mac ba zai iya isa ba

Komai yana aiki har sai wani ya buɗe MacBook. Tumbin yana kafuwa, rundunonin ciki suna amsa da adireshi, kuma warware sunaye ya mutu. A iPhone wannan bayanin yana yin haka, yayin da abokan cinikin Windows da Linux suna lafiya. Yawanci sifar DNS da aka tura ita ce mai laifi: uwar garken tana raba adireshin fuskarta na jama'a, kuma abokin ciniki na IKEv2 na Apple ba ya aika tambayoyi zuwa can ta cikin tumbi. Matsar da mai warwarewa cikin tafkin kuma alamar za ta ɓace ba tare da taɓa abokin ciniki ba.

Alamar tana nuni ga adireshin da aka tura

Lokacin da wasu dandamali kawai suka kasa, tumbi da shaidar shiga suna da kyau kusan tabbas, domin an raba su. Abin da ya bambanta shi ne yadda kowane abokin ciniki ke amfani da kayan aikin da ya karɓa, ciki har da uwar garken DNS na ciki. Abokin ciniki da ya karɓi adireshin amma ya juya tambayoyi a kewayen tumbi yana ƙarewa da mai warwarewa da yake gani kuma ba zai iya amfani da shi ba.

Adireshin jama'a shine zaɓin da aka saba domin shine wanda mai gudanarwa ya riga ya sani. Shi ne kuma kadai adireshin da aka tabbatar yana wajen prefix na tumbi da kansa, kuma wannan sifar ce take karya abokan cinikin Apple.

Duba darajar kafin ka canza komai. Idan mai warwarewar da aka tura shine adireshin WAN na uwar garken, ka sami siffar matsalar kuma za ka iya tsallake sauran hasashe. Kwatanta shi da prefix na tafkin kuma, domin adireshin da ke cikin tafkin amma wajen kewayon haya shine ainihin yadda gyaran zai kasance. Minti biyu da tsarin sun fi yini a kan abokin ciniki wajen kama fakiti.

Yanke mai warwarewa daga kewayon haya

Ba tumbi tsarin adireshi inda mai warwarewa yake memba na subnet na tafkin kansa, sannan ka tanadi wannan adireshin domin ba za a taɓa ba wani abokin ciniki haya ba. A wannan misali tafkin shine 10.180.7.0/24, uwar garken tana riƙe 10.180.7.1, kuma haya yana farawa daga 10.180.7.2.

rightsourceip=10.180.7.2/24
rightdns=10.180.7.1

Prefix na tafkin da mai warwarewa suna raba subnet ɗaya, don haka hanyar da take ɗaukar zirga-zirgar tumbi tana ɗaukar tambayoyin kuma. Wannan sifa ɗaya ce take sa gyaran ya iya motsi tsakanin abokan ciniki. A cikin tsarin swanctl waɗannan gaskiyoyi biyu suna bayyana a matsayin ma'anar tafki da saitin DNS akan haɗin maimakon a cikin rubutun ipsec.conf.

Uwar garken ba ta buƙatar sabuwar fuskar jiki don wannan. Ƙara 10.180.7.1 zuwa fuskar loopback ya isa mai warwarewa ya ɗaure ya amsa, domin abokan ciniki suna isa gare shi ta hanyar hanyar tafkin da ta riga ta wanzu. Ka riƙe adireshin wajen kewayon haya domin babu abokin ciniki da zai kwace shi bisa kuskure. Idan sabis na DHCP ko RADIUS na waje ne ke sarrafa tafkin, tanadi adireshin a can kuma, in ba haka ba abokin ciniki na farko da ya tambaya zai ɗauke shi.

Daure mai warwarewa ka rufe tashar 53

Ba da adireshi ba ɗaya ba ne da saurare a kansa. Mai warwarewa da ke saurare a adireshin LAN kawai zai ƙi ko watsi da tambayoyin da aka aika zuwa adireshin tafkin, kuma abokin ciniki yana ganin ƙarewar lokaci mai kama da gazawar hanya.

interface: 10.180.7.1
access-control: 10.180.7.0/24 allow
access-control: 0.0.0.0/0 refuse

Wannan guntun unbound yana karɓar tambayoyi daga tafkin tumbi kuma yana ƙin komai, wanda shine manufar da yawancin masu warwarewa na kamfani suke so. Idan wannan misalin yana amsa abokan cinikin LAN kuma, ƙara prefix na LAN a fili maimakon faɗaɗa mai saurare zuwa duk tushe.

Sannan dokokin wutar bango dole su yarda da kulawar shiga na mai warwarewa. Karɓi tashar 53 daga tafkin, kuma ka watsar da ita a ko'ina, amma ka fara duba tsarin sarkar.

iptables -A INPUT -p udp --dport 53 -s 10.180.7.0/24 -j ACCEPT
iptables -A INPUT -p tcp --dport 53 -s 10.180.7.0/24 -j ACCEPT
iptables -A INPUT -p udp --dport 53 -j DROP
iptables -A INPUT -p tcp --dport 53 -j DROP

Dokar karɓa ta baya kuma mafi faɗi tana mai da waɗannan layuka biyu na ƙarshe ado, kuma mai warwarewa yana kasancewa ana iya isa gare shi daga intanet. Karanta saitin dokokin da ke aiki tare da masu ƙidaya maimakon dogaro da tsarin da kuka yi niyya. Manufar madadin, tura adireshin jama'a da ba da izinin tambayoyi daga kowace tushe, tana aiki ga abokan ciniki da yawa, amma tana sanya mai warwarewa a intanet kuma yana buƙatar iyakance saurinsa da sa ido.

Tabbatar da abin da abokin ciniki ya karɓa da gaske

Fara duba ra'ayin uwar garken, sannan na abokin ciniki, domin su biyu suna sabani ta hanyoyin bayanai. Jerin tafki yana nuna wane adireshi aka ba haya, kuma jerin ƙungiyoyin tsaro yana nuna ko haɗin yana aiki da asalin da ake tsammani.

swanctl --list-sas
swanctl --list-pools
dig +short @10.180.7.1 intranet.plant.example

Tambayar kai tsaye tana tabbatar mai warwarewa yana amsa a adireshin tafkin daga mai masaukin da zai iya isa gare shi. Ba ta tabbatar Mac ya zaɓi wannan uwar garken ba. A macOS scutil --dns yana jera masu warwarewa ga kowace sabis da aka iyakance kuma ya fi kwamitin taƙaitawa bayani; a Windows Get-DnsClientServerAddress yana nuna ko adaftar tumbi ta karɓi darajar da aka tura.

Idan abokin ciniki yana nuna adireshin tafkin kuma tambayoyi har yanzu suna ƙarewa, hanyar tumbi ko sarkar wutar bango ce ke da laifi. Abokin ciniki da ba ya bayar da rahoton kowane mai warwarewa yana nufin kayan aikin bai taɓa isowa ba, don haka duba yadda wannan dandali ke amfani da saitunan da aka tura maimakon cibiyar sadarwa. Rubuta wanne daga cikin waɗannan biyun ka gani kafin ka canza wani abu. Waɗannan gazawa biyu suna kama da juna a tikitin tallafi kuma suna kai ga gyare-gyare masu sabani.