WireGuard ba ya tura DNS: hidimar yankin BIND na sirri

Kun tayar da WireGuard, ramin yana wuce da zirga-zirga, kuma sunan cikin gida har yanzu ba ya warware. Mataki na gaba yawanci shine neman saitin DNS a cikin ƙirar WireGuard, kamar abokin tafiya zai iya tura mai warwarewa kamar yadda wasu VPN suke yi. Ba zai iya ba. Musafaha yana ɗauke da maɓalli, adiresoshin mu'amala da IP da aka yarda, kuma ba shi da fili don sabar DNS ko yankunan bincike. Manufar mai warwarewa tana zaune a kan abokin ciniki, kuma a nan ne gyaran ya kamata ya kasance.

Ramin da mai warwarewa yarjejeniya biyu ne daban

WireGuard ƙanƙane ne da gangan. Yana motsa fakiti don adiresoshin da kuka jera kuma yana tabbatar da abokan tafiya; duk abin da ke sama da wannan matakin naku ne. OpenVPN na iya tura dhcp-option DNS saboda tashar sarrafa shi tana ɗauke da ƙira, kuma wannan bambancin yana tuntuɓe mutanen da ke motsawa tsakanin su biyu.

Don haka ramin da ke aiki ba ya gaya muku komai game da warware sunaye. Abokin ciniki na iya samun hanya mara aibu zuwa 10.90.0.1 kuma har yanzu yana aika tambayoyinsa zuwa mai warwarewa na jama'a, shi ya sa alamar ta ke kama da “VPN ɗin ya karya DNS” alhali ba a taɓa nuna DNS zuwa VPN ba.

Ku hidima yankin ba tare da zama mai warwarewa mai maimaitawa ba

Bangaren sabar yanki ne ƙarami mai iko, ba babban mai warwarewa ba. A wannan misali ƙofar ita ce 10.90.0.1, abokan ciniki sune 10.90.0.0/24, kuma aikace-aikacen da kuke damu da shi yana amsa akan 10.60.0.20.

Ku haɗa waɗannan saiti cikin block ɗin options da ke akwai maimakon ƙirƙirar na biyu:

options {
    listen-on { 127.0.0.1; 10.90.0.1; };
    listen-on-v6 { none; };
    allow-query { 127.0.0.1; 10.90.0.0/24; };
    allow-transfer { none; };
    recursion no;
};

Sannan ku ayyana yankin da fayil ɗinsa:

zone "corp.example" {
    type primary;
    file "/etc/bind/db.corp.example";
};

$TTL 300
@ IN SOA ns.corp.example. hostmaster.corp.example. ( 1 3600 600 604800 300 )
@      IN NS ns.corp.example.
ns     IN A  10.90.0.1
portal IN A  10.60.0.20

Ku tabbatar kafin sake lodawa, domin kuskuren rubutu a lokacin lodawa yana rushe dukan sabar ga kowane yankin da take hidima:

named-checkconf
named-checkzone corp.example /etc/bind/db.corp.example

Ku buɗe UDP da TCP 53 a mu'amalar VPN kawai. Wallafa wata hukuma ta sirri a mu'amalar jama'a yana gayyatar tambayoyi da ƙidaya duka, kuma allow-transfer ya kamata ya kasance a rufe sai idan wani na biyu yana buƙatarsa da gaske.

Ku nuna abokin ciniki gare ta, kowace mahada

Ku ɗauka cewa NetworkManager ya mallaki haɗin, kuma systemd-resolved shine mai warwarewa. Ku fara karanta manufar da ke akwai, musamman duk wani yankin tafiyar da tushe, domin shigarwar ~. za ta wuce abin da kuke shirin ƙarawa.

nmcli connection modify wg-office +ipv4.dns 10.90.0.1
nmcli connection modify wg-office +ipv4.dns-search '~corp.example'

Tilde ita ce babbar haruffa. Tana nuna yankin a matsayin hanya kawai: sunaye ƙarƙashin corp.example suna zuwa sabar DNS ta wannan mahada, kuma ba a ƙara yankin a matsayin ƙari na binciken gajeren suna. Ba tare da ita ba, buga portal zai fara warware portal.corp.example, wanda yake da sauƙi gare ku kuma abin mamaki ga kowa. Ku riƙe tilde a cikin alamomin ambato, domin wanda ba shi da ambato faɗaɗawar shell ce da ke jira ta nuna zuwa babban fayil ɗin gidanku.

Ku aiwatar da canjin ta hanyar mai sarrafa da ya mallaki mu'amalar, sannan ku sake haɗa haɗin. Kada ku fara wata kwafin wg-quick ta biyu don wannan mu'amar; masu biyu za su yi faɗa kan hanyoyi kuma ɗayansu zai yi nasara a mummunan lokaci.

Ku tabbatar da hanya kafin suna

Ku tambayi sunan daga abokin ciniki kuma ku tabbatar da amsar da sabar da ta samar da ita:

resolvectl query portal.corp.example

Idan hakan ya dawo 10.60.0.20, yarjejeniyar DNS ta cika. Idan lokaci ya ƙare, ku duba hanyar zuwa 10.90.0.1 da farko, sannan ka'idar wutar bango, sannan allow-query a sabar. Rashin warware sunaye a wannan tsarin kusan koyaushe wadata ce ko ACL, ba fayil ɗin yankin ba. Ku yi aiki daga abokin ciniki zuwa waje, domin sabar ba za ta iya gaya muku dalilin da ya sa tambaya ba ta taɓa isowa ba.

Ku tuna aikace-aikacen har yanzu yana buƙatar hanyarsa da izininsa na sabis. Sunan da aka warware wanda ke nuna adireshin da ba za a iya isa ba wata gazawa ce daban cikin tufafi ɗaya.

Abin da har yanzu ba ya atomatik

Aikace-aikacen da ke da nasu dabarun warwarewa suna watsi da mai warwarewar tsarin gaba ɗaya, kuma kowane adadin nmcli ba ya canza hakan. Wuraren da ke tabbatar da DNSSEC suna buƙatar ƙirar anka ta amincewa bayyananne ga yankin sirri; amsar ba umarni gama gari ba ce na kashe tabbatarwa. Ku gwada da aikin abokin ciniki ɗaya da masu amfani da ku ke gudanarwa, ba da kayan aiki da ya ke amfani da mai warwarewar tsarin kwatsam ba. Tazarar da ke tsakanin su biyun ita ce dukan rahoton kuskure.

Tawuloli na iya sarrafa wannan manufar abokin ciniki ta tsarin samar da su ta atomatik, amma manufar ta kasance wani abu dabam mai mai shi. Bayanin BIND 9 yana rufe ikon saurara da tambaya da aka yi amfani da su a sama, kuma ita ce wurin da ya dace don tabbatar da hali ga sigar da kuka shigar.

Mataki na gaba: ku ƙara haɓakar jerin lambar yankin da umarnin dubawa cikin hanyar canjin ku, ta yadda gyaran rikodin ba zai iya isa samarwa ba tare da dubawa ba.