DNS na VPN yana ɗaukar kowace tambaya: gyara dns-priority a NetworkManager

Haɗa VPN na ofis kuma ba zato ba tsammani kowace tambayar suna tana zuwa ga resolver na kamfani. Sunaye na jama'a har yanzu suna warwarewa, don haka babu abin da ya bayyana a karye har sai sunan firinta na gida ya kasa ko rikodin split-horizon ya dawo da adireshin ofis. A wasu saitin Fedora akasin haka yake faruwa: resolver na mai ba da sabis yana ci gaba da amsawa bayan an tayar da rami. Dukansu tambaya ɗaya ce — wane resolver ne ya mallaki wannan tambaya — kuma a tsarin NetworkManager amsar tana zaune a cikin kaddarorin DNS na kowace haɗi.

Haɗi biyu, resolver ɗaya mai nasara

Kowace haɗi tana bayyana fifikon DNS. Haɗin talakawa suna kan 50 bisa tsoho kuma haɗin VPN suna kan 0, kuma ƙaramin daraja ne ke cin nasara. Wannan tsohon saiti ne dalilin da yasa haɗin VPN ke wuce hanyar waya a ɓoye ga kowane yanki da yake da'awa: sifili yana doke hamsin ba tare da kowa ya zaɓe shi ba.

Fifiko yana tsara yan takara. Ba ya iyakance abin da ake tambayar mai nasara. Haɗin VPN mara yankin bincike yana da'awar komai, don haka fifita shi yana aika tambayoyin jama'a zuwa cikin rami kuma, a tsarin rabe-raben rami, zuwa inda resolver na kamfani yake turawa.

Fifiko yana ƙayyade tsari, jerin bincike yana ƙayyade mallaka

nmcli -f connection.id,ipv4.dns,ipv4.dns-search,ipv4.dns-priority con show "Corp VPN"
resolvectl status
readlink -f /etc/resolv.conf

Jerin bincike shine sanarwar mallaka. Wani yanki tsirara kamar corp.example yana zama ƙarin bincike da yankin turawa. Siffar kawai don turawa ~corp.example tana aika bincike a ƙarƙashin wannan ƙari zuwa wannan haɗi ba tare da ƙara yankin ga gajerun sunaye ba. Wannan tilde shine bambanci tsakanin «tambayi wannan uwar garke» da «tambayi wannan uwar garke kuma ka gama rubutu na».

Yi amfani da duka siffofin lokacin da masu amfani suke rubuta gajerun sunayen host kuma ana magance rikodin da cikakkun sunaye ma. Yi amfani da siffar turawa kawai lokacin da kake son rabuwa ba tare da canza yadda resolver ke cika suna tsirara ba.

Sannan ka bayyana fifikon a fili kuma ka sake kunnawa:

nmcli con modify "Corp VPN" ipv4.dns-priority -100
nmcli con modify "Corp VPN" ipv6.dns-priority -100
nmcli con modify "Corp VPN" ipv4.dns-search "~corp.example,corp.example"
nmcli con up "Corp VPN"

Fifiko mara kyau ita ce hanyar da aka rubuta don cewa «fifita wannan haɗin», kuma saita duka iyalan adireshi yana kiyaye ɗabi'ar daidaito a host mai haɗin IPv6. Canza kadara ba tare da sake kunnawa haɗin ba ya canza kome daga abin da ke gudana yanzu, shine dalilin da yasa jerin ke ƙarewa da bayyanannen umarnin up.

Bari systemd-resolved ya riƙe rabuwar

Ƙarin dnsmasq na tsoho yana tattara tambayoyi cikin resolver ɗaya na gida, don haka rabuwa ta kowace hanyar haɗi tana zama mara kyau. systemd-resolved yana nuna rabuwar ga kowace hanyar haɗi, kuma resolvectl query yana ambaton hanyar da ta amsa.

systemctl enable --now systemd-resolved
ln -sf /run/systemd/resolve/stub-resolv.conf /etc/resolv.conf
systemctl restart systemd-resolved NetworkManager
resolvectl query build.corp.example

Bayan haka hanyar haɗin kamfani tana ɗauke da corp.example kuma resolver na jama'a yana hidimar sauran. Lokacin da tambaya ta isa hanyar da ba daidai ba, umarnin yana ambaton hanyar da ta amsa ta, kuma sanin hakan ya fi sanin adireshin kawai.

Daidaita ƙirar DNS da nau'in rami

Ƙirar sirri da ke aika komai ta cikin rami bai kamata su ɗauki jerin rabuwa ba, domin zai mayar da sunayen jama'a ga resolver na gida kuma ya rushe manufar. Ƙirar rabe-raben rami tana buƙatar ɗaya: ba tare da shi resolver na kamfani yana ganin kowace tambaya ta jama'a, kuma saitin yana karyewa a daidai lokacin da rami ya faɗi.

Sannan akwai kill switch wanda ke toshe DNS a wajen rami. Sunaye suna warwarewa ga yankunan rami kuma suna kasawa a ko'ina inda kuma yayin da haɗin yake cikakke lafiya. Amsoshin da za su iya aiki sune bayyanannen izini ga resolver na LAN ko ajiyar gida da ke turawa yankin kamfani kawai, kuma kowanne daga cikinsu keɓe ne da ke da mai shi, ba aibi ba a cikin rami.

Bayanan da ke sake rubuta saitin resolver lokacin da fuskar sadarwa ta fara yana yin kusan haka: da zarar resolver na gida ya kasa isarsa, za a warware sunayen da rami ya sani kawai. Ko wane tsari ya shafi, rubuta waɗanne sunaye ya kamata su yi aiki a kowace yanayi, kuma ka ba da wannan jerin ga wanda ke kula da rahotanni.

Tabbatar da kowace hanya, sannan kuma bayan sake haɗawa

Tambayi suna ɗaya na ciki da ɗaya na jama'a, kuma duba inda tambayar take zuwa da gaske. Shafin duba ɓarkewa yana gaya miki wane resolver ya amsa, ba wace hanya tsarin ya zaɓa ba, don haka ba ya cewa komai game da tsarin da kuka saita yanzu.

Sake gudanar da tambayoyin biyu bayan cire haɗi da sake haɗawa. Ana sake amfani da fifiko lokacin da haɗi ya kunna, kuma tsohuwar hanyar alama tana iya tsira daga haɓakawa da babu wanda ya tuna. Abin da kuke so a rubuta a ƙarshe shine wane resolver ne ya mallaki wace ƙari, tare da dubawa da zai ci gaba da aiki gobe.