Me ya sa sunayen masauki na ciki ke warwarewa a dig amma suna kasawa a curl a kan VPN

Kwamfutar tafi-da-gidanka tana kan VPN, dig service.internal.example yana amsawa da adireshin 10.x, kuma curl yana fitowa da Could not resolve host har yanzu. Ramin ba shi ne matsalar ba: ya ɗauki tambayar dig ba tare da korafi ba. Bambanci shi ne wanda ke yin tambayar. dig yana aika tambaya ɗaya zuwa uwar garke ɗaya da ka ambata, yayin da curl ke wucewa ta sarkar bincike ta tsarin aiki, kuma wannan sarkar tana da nata ƙa’idoji game da wace uwar garke ake tambaya.

Bincike biyu don suna ɗaya

dig nasa stub resolver ne. Yana karanta /etc/resolv.conf, ya zaɓi uwar garken sunaye, ya aika tambaya ɗaya ta A ko AAAA sannan ya buga amsar. Yana tsallake nsswitch gaba ɗaya kuma bai san kome ba game da yanayin kowane haɗi da systemd-resolved ko NetworkManager ke ajiyewa a wajen wancan fayil, shi ya sa amsar dig na iya zama daidai amma har yanzu ba ta gaya maka kome ba game da abin da manhajarka za ta gani.

Manhajoji suna kiran getaddrinfo, kuma getaddrinfo yana wucewa ta doguwar sarkar: tsarin modulolin nsswitch, sannan modulin da ke kula da sunan, kuma a ƙarshe resolver da aka gina daga tsarin haɗin na yanzu. A kan na’urar systemd tambayar tana zuwa 127.0.0.53 kuma systemd-resolved yana zaɓar uwar garke ta sama ga kowane haɗi bisa ga yankin tuƙi da ke manne da muƙamin tun.

Umarni biyu suna raba waɗannan matakan ba tare da yin hasashe ba:

getent ahosts service.internal.example
resolvectl query service.internal.example

getent yana amfani da hanya ɗaya da curl, saboda haka gazawar getent kusa da dig mai aiki tana nuna kuskure a cikin manufar bincike ba a cikin tuƙin fakiti ba. resolvectl query kuma yana buga muƙamin da uwar garken da suka bayar da amsar, wanda ke nuna ko haɗin ramin ne ya yi nasara ko haɗin jiki.

Karanta resolver ɗin da manhajar ke amfani da shi a zahiri

Ana ƙirƙirar /etc/resolv.conf a yawancin kwamfutocin tebur, kuma abokin ciniki na VPN yana da hanyoyi uku na mu’amala da shi: ya saka uwar garken sunaye a gaba, ya rubuta a kan fayil ɗin, ko ya ba da nasa uwar garken ga NetworkManager ya bar daemon ya sake rubuta shi. Tsarin na uku ne kawai ke kiyaye DNS na kowane haɗi, domin uwar garken suna nan manne da muƙami maimakon a daidaita su zuwa jerin duniya ɗaya.

A tsarin NetworkManager sakamakon ya dogara da backend ɗin da ke cikin /etc/NetworkManager/NetworkManager.conf:

[main]
dns=systemd-resolved

Da dns=default ana haɗa uwar garken abokin ciniki cikin resolv.conf bisa ga tsarin da ya yi nasara, kuma bincike na sirri har yanzu ana iya aika shi ga resolver na jama’a. Da backend da ke fahimtar haɗe-haɗe, systemd-resolved ko dnsmasq, uwar garken ramin suna nan a tsare cikin ramin kuma sunayen da suka dace da yankin tuƙinsa ne kawai ke zuwa wurin. Wannan tsarewa ita ce ma’anar split DNS a aikace, kuma ita ce sashin da ya fi yawan ɓacewa lokacin da abokin ciniki ya ce yana goyon bayansa.

Karanta yanayin kafin ka canza wani abu:

resolvectl status
resolvectl dns tun0

Kana son ganin muƙamin tun an jera shi da uwar garken DNS da yankin tuƙi don ƙarin sirri, an nuna shi a matsayin ~internal.example. Rashin uwar garke a haɗin yana nufin abokin ciniki bai aika kome ba. Uwar garke marar yanki tana nufin binciken ko dai duka suna zuwa wurin ko babu ɗaya, dangane da abokin ciniki, kuma babu ɗaya daga cikin su da ke split DNS.

Inda nsswitch ke ƙarasa bincike da wuri

Layin tebur na yau da kullum yana kama da haka:

hosts: files mdns4_minimal [NOTFOUND=return] resolve [!UNAVAIL=return] dns myhostname

mdns4_minimal yana kula da multicast DNS kuma yana da’awar kowane suna da ya ƙare da .local. Sabis ɗin Kubernetes kamar api.infra.svc.cluster.local shi ma yana ƙarewa da .local. Lokacin da modulin mDNS ya ba da rahoton NOTFOUND, aikin [NOTFOUND=return] yana kawo ƙarshen dukan binciken maimakon ci gaba zuwa modulin dns, saboda haka ba a taɓa aika sunan ga resolver ɗin VPN ba. dig yana ƙetare fayil ɗin gaba ɗaya, kuma shi ya sa kayan aikin biyu ba su yarda ba.

Wannan shi ne bambanci mafi tsanani a cikin wannan matsala, kuma ya danganta da kalma ɗaya a cikin fayil ɗin tsari da ya tsufa fiye da VPN ɗinka. Canza aikin zuwa [NOTFOUND=continue] yana kiyaye mDNS ga firintoci da na’urori na gida yayin da yake barin DNS ya ga sunan. Maye gurbin layin da hosts: files dns shi ma yana aiki kuma ya fi ƙazanta: yana watsi da warwarewar .local ga firintar da kake amfani da ita a zahiri.

Sunayen da ke rayuwa a cikin hanyar sadarwa ɗaya kawai

Yankuna na sirri suna da iko a wuri ɗaya kawai. Sunan AWS kamar ip-10-0-4-31.eu-west-1.compute.internal ana amsa shi ta hanyar resolver ɗin VPC na wancan yankin, kuma kawai muddin ƙarshen VPN ɗinka yana cikin yankin da albarkar take. Haɗa zuwa ƙarshen Frankfurt, tambayi sunan compute.internal daga Ireland, kuma babu wani tsari na gida da zai taimaka: yankin da ke riƙe da rikodin ba ya isa daga nan.

Yankunan bincike suna haifar da siffar madubi. service tsirara ana cika shi da ƙarin da resolver ke ganin ya dace, kuma da haɗin VPN yankin gida na iya cin nasara a kan na kamfani. Tambaya da aya a ƙarshe don cire hasashe, getent ahosts service.internal.example., kuma idan hakan ya yi aiki yayin da gajeren sunan ya kasa, gyaran shine yankin bincike a kan ramin, ba adireshin uwar garke ba.

Abokan cinikin da ake sarrafawa suna ƙara mataki na uku a kan resolver ɗin tsarin. Bayanin VPN na Windows na iya ɗaukar manufarsa ta warware sunaye, ƙa’idoji ga kowace manhaja da teburin NRPT wanda ke aiki ko da ramin yana a kwance. Manhajojin da ke da ajiyar DNS nasu, waɗanda suka zama ruwan dare a cikin .NET da Java, suna riƙe da gazawar da ta tsufa dadewa bayan an gyara sarkar. Abokan cinikin Apple suna saita split DNS ta yankunan da suka dace a cikin saitunan DNS maimakon ta resolv.conf, kuma Chromium ko Firefox a yanayin DNS mai aminci na iya tsallake resolver ɗin tsarin don sunayen jama’a. Littafin jagora na Microsoft game da warware sunayen VPN yana bayanin ɓangaren Windows na wannan matakin manufa.

Yanke shawara wace mataki za a gyara

Aiki daga alamar zuwa matakin maimakon gwada gyare-gyare a jere:

Layi biyu ne ke ɗaukar mafi yawan nauyi. Ƙarewar lokaci matsala ce ta isa: resolver ɗin sirri ba ya amsawa ta ramin, don haka duba hanyar zuwa adireshinsa da kuma ko uwar garken DNS a haɗin ita ce da kake tsammani. NXDOMAIN matsala ce ta iko: wani abu ya amsa kuma bai san sunan ba, wanda ke nuni ga yankin, yankin ko resolver ɗin da bai kamata ya karɓi tambayar ba.

Layin ƙarshe shi ne wanda mutane ke watsi da shi domin duka rabi biyu suna kama da nasara. Gajeren sunan da ke warwarewa daban da FQDN rashin daidaituwar ƙari ne, kuma sake haɗa ramin ba zai canza wane ƙari abokin ciniki ke aikawa ba.

Yi rikodin yanayin kafin ka gyara fayil ɗin tsari, domin ka iya cewa ko gyaran ya yi wani abu:

resolvectl status > before.txt
getent ahosts service.internal.example >> before.txt

Gudanar da gwaje-gwajen a wannan tsari kuma ka tsaya a farkon wanda ya kasa. getent da resolvectl query dole su yarda; idan getent ya kasa yayin da dig ke amsawa, ka tsaya cikin sarkar bincike kuma kada ka taɓa tuƙi. resolvectl status dole ya nuna uwar garken DNS da yankin tuƙi a muƙamin tun. nsswitch kada ya dawo da wuri da NOTFOUND ga ƙarin da ake gwadawa. Sunan dole ya kasance mai iko a cikin hanyar sadarwar da ƙarshenka ke da alaƙa da ita, an gwada shi da aya a ƙarshe. Manhajar kada ta riƙe ajiyarta ko maye gurbin DNS mai aminci.

Gyara matakin farko da ya kasa kawai, sannan sake gudanar da waɗannan umarnin. Canje-canje biyu a lokaci ɗaya suna hana ka cewa wanne ne ya yi muhimmanci, kuma matsala ta gaba za ta fara bincike daga sifili.