WireGuard DNS DNAT: ci gaba da aikin hanyar amsa

DNAT yana sake rubuta inda aka nufa, ba inda aka fito ba. Yanke shawara kan yadda mai warwarewar DNS na sama zai iya amsawa kafin ka ƙara dokar, kuma ka riƙe kowace daidaitawa a taƙaice.

Mayar da tambayar DNS ta abokin ciniki na WireGuard zuwa wani mai warwarewa yana kama da doka ɗaya amma yana aiki kamar shawarwari uku. Dole a sake rubuta inda aka nufa, dole a tura fakitin, kuma dole amsar ta sami hanyar dawowa ta cikin yanayin fassarar da ƙofar ta ƙirƙira. Idan ka tsallake na uku, tambayar tana fita lafiya yayin da abokin ciniki ke jira har abada.

Ɗauki misalin abokan ciniki da aka ba su izini a cikin 10.77.0.0/24 waɗanda ke zuwa ta wg0, suna tambayar adireshin da aka sanar 10.77.0.1 kuma suna buƙatar mai warwarewa a 203.0.113.53. Adireshin sama wuri ne na ajiya don takardu, ba sabis mai aiki ba.

Juya tambaya yana canza inda aka nufa ne kawai

Dokar NAT ta inda aka nufa a cikin PREROUTING tana sake rubuta adireshin kafin a yanke shawarar hanya, don haka sai a bi fakitin zuwa sabuwar manufa maimakon tsohuwar. Ba a taɓa adireshin tushen abokin ciniki da wannan aikin. Shi ya sa dokar da ta yi kama da cikakke za ta iya haifar da shiru: buƙatar yanzu tana tafiya zuwa mai warwarewa wanda bai taɓa jin labarin keɓaɓɓen kewayon abokin ciniki ba. Ƙofar ta fassara fili ɗaya kuma ta gaji matsala ta biyu.

Duk hanyoyin DNS guda biyu suna buƙatar dokoki masu dacewa, domin abokin ciniki yana komawa TCP idan an yanke amsa.

Dokokin da ke ƙasa suna zaɓar hanyar shiga ɗaya, kewayon abokin ciniki ɗaya da adireshin manufa na asali ɗaya. Babu wani abu a ƙofar da abin ya shafa, kuma tambaya daga ƙofar kanta ba ta dace da komai.

sysctl -w net.ipv4.ip_forward=1
iptables -t nat -A PREROUTING -i wg0 -s 10.77.0.0/24 -d 10.77.0.1 -p udp --dport 53 -j DNAT --to-destination 203.0.113.53:53
iptables -t nat -A PREROUTING -i wg0 -s 10.77.0.0/24 -d 10.77.0.1 -p tcp --dport 53 -j DNAT --to-destination 203.0.113.53:53

Hanyar amsa shawara ce ta dabam

Shirye-shirye biyu suna barin amsa ta dawo, kuma zaɓar ɗaya da wuri yana ceton zaman gyara. Ko dai mai warwarewar sama yana da hanya ta komawa 10.77.0.0/24 ta wannan ƙofar, ko kuma ƙofar tana fassara tushe a fita domin amsar ta isa adireshin da na sama ya riga ya sani. Dukansu suna aiki; ɗaya ne kawai ya dace da ikon da kake da shi a kan na sama.

Hanya ta cancanci gwaji na farko, domin tana riƙe adireshin abokin ciniki a bayyane ga mai warwarewa kuma tana guje wa wani rufin fassara na biyu. Lokacin da na sama ya ke wajen ikonka, fassarar tushe a takamaiman hanyar fita ita ce zaɓi mai amfani.

Ka iyakance wannan fassarar da ƙarfi kamar juya hanya, in ba haka ba dokar za ta zama NAT ta gabaɗaya ga duk abin da ya dace da ita:

iptables -t nat -A POSTROUTING -s 10.77.0.0/24 -d 203.0.113.53 -o eth0 -p udp --dport 53 -j MASQUERADE
iptables -t nat -A POSTROUTING -s 10.77.0.0/24 -d 203.0.113.53 -o eth0 -p tcp --dport 53 -j MASQUERADE

Bin diddigin haɗi yana riƙe taswirar a haɗe, don haka ana sake rubuta amsar zuwa ainihin tuple na abokin ciniki idan tana dawowa. Ba tare da dokar fita ba, mai warwarewa yana aika amsarsa zuwa keɓaɓɓen adireshin da ba zai iya isa ba, kuma abokin ciniki yana ganin ƙarewar lokaci maimakon kuskure.

Ka rubuta dokokin sun fi yadda aikin ya yi kama ƙunci

Izinin turawa yana cikin wannan ɓangaren. Ka ba da izinin kwararar daga abokin ciniki zuwa mai warwarewa da zirga-zirgar dawowa da conntrack ya riga ya gane, maimakon karɓar kowace haɗin DNAT a na'urar. Karɓar gaba ɗaya kuma yana ba da izinin tura tashar jiragen ruwa da ba su da alaƙa da DNS.

Mai warwarewar ƙofar kanta wata hanya ce ta code dabam. Tambayar da aka fitar a gida tana wucewa ta OUTPUT, don haka gwaji daga shell ɗin ƙofar ba ya horar da dokar PREROUTING ko manufar turawa. Shi ya sa gwajin gida zai iya wucewa yayin da kowane abokin ciniki ke kasawa, kuma akasin haka yana da yawa.

Babu wani abu a nan da ya shafi DNS a kan HTTPS a tashar 443 ko DNS a kan TLS a tashar 853, kuma babu abin da ya shafi IPv6. Abokin ciniki da aka saita masa mai warwarewar IPv6 zai yi watsi da dukan shirin cikin farin ciki.

Menene sabuwar tambaya ke tabbatarwa

Bin diddigin haɗi yana tuna taswirar da suka gabata, don haka tambayar da aka aika kafin canjin doka za a iya amsa ta daga tsohon yanayi kuma ta sa sabuwar dokar ta yi kama da karyayya. Fara da sabuwar tashar tushe kuma, inda abokin ciniki ke ajiye amsoshi, da sabon suna.

dig @10.77.0.1 example.com A +short
conntrack -L -p udp --dport 53 | head

Umarni na farko yana nuna ko hanyar abokin ciniki tana warwarewa kwata-kwata, na biyu kuma yana nuna fassarar da ƙofar ta shigar da gaske, haɗe da dukkan alkiblar tuple. Taswirar da ke nuni ga daidai mai warwarewa tare da ma'aunin amsa da ya makale a sifili matsala ce ta hanyar dawowa ba matsalar tacewa ba.

Tabbatar mai warwarewa ya san sunayen da kuke tsammani kafin ka juya komai. Madadin da ke amsa sunayen jama'a amma ba yankinka na keɓe ba yana juya bincike mai aiki zuwa NXDOMAIN wanda ya yi kama da karyayyen rami. Gwada mai warwarewa kai tsaye, daga ƙofar, kafin hanyar abokin ciniki ta shiga. Kuma bayanin ƙarin kayan iptables yana rubuta ma'anar DNAT da masquerade da waɗannan dokoki suka dogara da su.

Labarai masu alaƙa