Me ya sa Pi-hole v6 ke watsi da tambayoyin DNS daga abokan cinikin WireGuard

Pi-hole v6 yana karɓar tambayar DNS a tashar 53 sannan ya yanke shawara ko an yarda a amsa fakitin da ya iso. A kan masaukin WireGuard, wannan shawara ta biyu ita ce yawanci dalilin da ya sa abokin ciniki ke samun ƙarewar lokaci yayin da mai warwarewa ke kama da lafiya daga LAN. Tashar a buɗe take, FTL yana gudana, amma duk da haka babu abin da ke dawowa daga 10.90.0.1. Abubuwa uku suna yin mu’amala kafin amsa ta fita: dns.interface, dns.listeningMode da bangon wuta a gaban duka biyun.

Soket ɗin saurare ba ya yanke shawara wanda zai sami amsa

FTL yana buɗe masu sauraren UDP da TCP a tashar 53. A tsarin da aka saba, soket ɗin yakan kasance wildcard, don haka ss -lunp | grep :53 yana nuna 0.0.0.0:53 da [::]:53 ko ana hidimar abokan cinikin VPN ko ba a yi ba. Soket ɗin wildcard yana karɓar fakitin, sannan FTL yana amfani da ƙa’idodinsa na muƙami da tushe kafin ya amsa. Shi ya sa "tashar tana saurare" ba ta tabbatar da komai game da abokin cinikin rami.

Karanta tsarin da ke gudana maimakon fayil ɗin da kake tsammanin yana aiki. pihole-FTL --config dns.interface da pihole-FTL --config dns.listeningMode suna buga ainihin ƙimomin, kuma suna iya bambanta da fayil ɗin masauki lokacin da kwano, canjin muhalli ko manajan turawa ya mallaki saitin. Jagorar tsarin Pi-hole FTL yana lissafa yanayin kuma wanne ne ya dogara da muƙamin.

LOCAL yana tambaya wace cibiyar sadarwa, SINGLE yana tambaya wane muƙami

LOCAL, wanda aka saba, yana amsa tambayoyin da adireshin tushensu ke cikin wata cibiyar sadarwa da aka saita a ɗaya daga cikin muƙaman masaukin. wg0 mai sauƙi da 10.90.0.1/24 yana wuce wannan gwajin, domin abokin ciniki a 10.90.0.2 yana cikin cibiyar sadarwar ramin. Abokin ciniki mai hanya a wancan gefen abokin tarayya, ko wanda ke ɓoye a bayan NAT a wani fanni na daban, bai wuce ba duk da cewa fakitin ya isa wg0, kuma babu tambaya da ta bayyana a rubutun.

SINGLE yana canza tambayar. Yana karɓar tambayoyin da suka iso a muƙamin da aka ambata a dns.interface, tare da haɗa loopback, kuma yana watsi da cibiyar sadarwar tushe. Wannan shine yanayin da ke tsira a cikin tsarin VPN mai sarƙa ko mai hanya. Saita duka maɓallan tare, domin yanayi ba tare da muƙamin da aka ambata ba ba cikakkiyar umarni ba ce:

sudo pihole-FTL --config dns.interface "wg0"
sudo pihole-FTL --config dns.listeningMode "SINGLE"

BIND yana canza soket ɗin, kuma hakan yana da farashi

BIND ba ya tace soket ɗin wildcard; yana ɗaure tashar 53 ga adiresoshin da ke wanzu a muƙamin da aka ambata kawai, don haka kernel yana ƙin fakitin da suka iso wani wuri. Ya fi SINGLE tsanani kuma ba ma’aninsa ɗaya ba ne. Farashin yana bayyana a lokacin tashi: idan wg0 ba ya aiki lokacin da FTL ya fara, ƙila babu adireshin da za a ɗaure, kuma mai warwarewa na iya gudana ba tare da mai saurare ba har sai muƙamin ya bayyana kuma FTL ya sake farawa.

Zaɓi BIND lokacin da kake sarrafa tsarin farawa, misali na'urar systemd da aka jera bayan muƙamin WireGuard, kuma lokacin da kake son kernel ya jefar da fakitin da suka ɓace kafin FTL ya gan su. Zaɓi SINGLE lokacin da ramin yana zuwa da tafiya, ko lokacin da wata kayan aiki da ke farawa bayan FTL ta ƙirƙiri muƙamin.

Bangon wuta shine ƙofar ta biyu

Madaidaicin yanayin FTL har yanzu yana kasawa idan bangon wutar masauki ya jefar da tashar 53 a kan wg0. Ba da izinin kewayon tushen VPN don duka ka'idoji biyu kuma ka kiyaye gefen Intanet a rufe. A cikin nftables, tare da sarkar input da ke akwai a teburin inet filter, ƙa'idodin suna kama da haka:

sudo nft add rule inet filter input iifname "wg0" ip saddr 10.90.0.0/24 udp dport 53 accept
sudo nft add rule inet filter input iifname "wg0" ip saddr 10.90.0.0/24 tcp dport 53 accept

Ƙara ƙa'idodin IPv6 masu dacewa idan ramin yana ɗauke da IPv6, kuma saka su gaban manufar drop na sarkar. Idan masaukin yana amfani da ufw ko firewalld, bayyana wannan daidaituwa a cikin wannan manajan maimakon haɗa kayan aiki. Kada ka tura tashar 53 daga na'urar sadarwar Intanet; abokan ciniki yakamata su isa adireshin VPN na mai warwarewa ta hanyar ramin.

Hanyoyi biyu sun kasance daban. Tambayoyin abokan ciniki suna ƙarewa a FTL. Binciken FTL na sama yana fita bisa ga teburin hanya na masauki, wanda zai iya ko ba zai iya amfani da ramin ba, don haka mai warwarewa da ke amsa amma ba ya mayar da wani abu mai amfani matsala ce ta sama. Gudanarwar yanar gizo da API suna saurare a tashoshinsu kuma suna buƙatar nasu ƙuntatawa.

Tabbatar da amsa da ƙin yarda

Daga abokin cinikin VPN, tambayi adireshin mai warwarewa ta duka ka'idoji biyu: dig @10.90.0.1 example.com da dig +tcp @10.90.0.1 example.com. Sannan duba rubutun tambayoyi a muƙamin gudanarwa don tabbatar da cewa FTL ya rubuta tambayar. Ƙarewar lokacin abokin ciniki ba tare da shigarwa a rubutu ba yana nuni ga bangon wuta ko tacewar muƙami; shigarwa a rubutu ba tare da amsa ba tana nuni ga warwarewa ta sama.

Gwada hanyar da ba ta dace ba daga masaukin da ke wajen VPN. dig @10.90.0.1 example.com yakamata ya ƙare, kuma ss -lunp a kan mai warwarewa bai kamata ya nuna tashar 53 an ɗaure ga adireshin jama'a ba. Sake farawa da sabis sau ɗaya, sannan sake tayar da masauki kuma tabbatar da cewa mai warwarewa har yanzu yana amsa bayan wg0 ya sake bayyana. Tambayar da ke aiki kawai har zuwa sake farawa na gaba ba canji ne da aka gama ba.