BIND VPN-ka korkiisa: gudbin shuruudaysan mise aag stub?

Resolver-ka xafiiskaaga wax walba ka jawaabaa marka laga reebo hal meel magacyo shirkadeed, server-ka DNS-ka shirkadda ee yaqaanna wuxuu ku yaal VPN gadaashiisa. BIND wuxuu aaggaas keliya u gudbin karaa upstream saddex dariiqo oo kala duwan, wayna kala duwan yihiin sida ay u guuldaraystaan. Gudbinta shuruudaysan waa ballanqaadka ugu yar, aagga stub wuxuu hayaa xogta wakiilka, secondary-na wuxuu hayaa nuqul buuxa. Dooro waxa upstream u oggolaan doono iyo waxa aad rabto in resolver-kaagu hayo, ma aha sida snippet-ka aad marka hore heshay.

Saddex hab oo hal meel magacyo

Gudbin shuruudaysan: ballanqaadka ugu yar

Ka soo qaad resolver xafiis oo ku yaal 192.168.10.53 iyo server shirkadeed oo ku yaal 10.40.0.53 oo laga gaari karo tunnel la ansixiyay. Bayaanku waa saddex sadar, tan xiisaha lehna waa forward only, sababtoo ah waxay beddelaysaa hab-dhaqanka guuldarrada, ma aha dariiqa.

zone "corp.example" {
    type forward;
    forward only;
    forwarders { 10.40.0.53; };
};

Iyada oo forward only leh, upstream aan la gaari karin wuxuu aaggan u soo saaraa SERVFAIL halkii uu ku laaban lahaa xallin soo noqnoqota. Tan ayaa badanaa loo baahan yahay meel magacyo gaar ah, sababtoo ah dib u laabashadu waxay magacyo gaar ah u diri lahayd resolver dadweyne oo internetka ka soo celin lahayd jawaab aan faa'iido lahayn. Tixraaca BIND wuxuu diiwaangeliyaa labada siyaasadood, farqiina wuu ka muhiimsan yahay inta snippet-ku tilmaamayo. Ku dar aagga habaynta jirta halkii aad beddeli lahayd aag hore ugu jiray isla magacaas.

Stub ama secondary: marka wakiilku muhiim yahay

Aag stub wuxuu server-ka shirkadda waydiistaa diiwaannada NS ee aagga ka dibna si toos ah u waydiistaa serverrada awoodda leh. Dooro marka gobolka upstream uu weyn yahay ama qaybsan yahay oo aad rabto in resolver-kaagu raaco wakiilka halkii wax walba ku dhejin lahaa hal ciwaan. Qiimuhu waa ku tiirsanaanta in xogta NS ay cusub tahay, iyo in server kasta oo magac ah oo liiska ku jira laga gaari karo ciwaanka isha resolver-kaaga.

zone "corp.example" {
    type stub;
    masters { 10.40.0.53; };
};

zone "corp.example" {
    type secondary;
    primaries { 10.40.0.53; };
    file "corp.example.db";
};

Secondary wuxuu ka jawaabaa xog gudaha ah wuuna ka gudbaa hakad upstream, taasina waa sababta loo aqbalo ku tiirsanaanta wareejinta. Waxay kaloo macnaheedu tahay in resolver-kaagu hadda hayo nuqul aag uusan lahayn, sidaas darteed dariiqa faylka, ACL-ka wareejinta ee ku yaal asaasiga iyo timarada cusboonaysiinta dhammaantood waxay noqdaan qayb ka mid ah dushiisa hawleed.

Hubinta dhexmarta go'aanka

BIND wuxuu isagu abuuraa weydiintiisa baxa, markaa su'aashu ma aha in laptop-ku gaari karo 10.40.0.53, laakiin in host-ka resolver-ku gaari karo ciwaanka isha ee server-ka shirkaddu arki doono. Weydii kernel-ka, ka dib weydii server-ka, isla nidaamkaas.

ip route get 10.40.0.53
named-checkconf
rndc reload corp.example
dig @10.40.0.53 corp.example NS +norecurse
dig @192.168.10.53 portal.corp.example

U oggolow UDP iyo TCP dariiqa: jawaab la jarjaray waxay ku qasabtaa TCP, siyaasadna oggolaata UDP oo keliya waxay abuurtaa guuldarrooyin goosgoos ah oo u eg lumista baakadaha. Dhinaca shirkaddu wuxuu u baahan yahay qaynuun aqbalid oo loogu talagalay isha resolver-kaaga iyo dariiq ku-noqosho oo xaggeeda ah labadaba; ishaas waxay noqon kartaa ciwaanka la maroojiyay ee resolver-ka ama mid si cad loo turjumay, waxayna naadir tahay inuu yahay ciwaan barkada macmiilka. Haddii weydiinta NS guuldarraysto, aag stub ma shaqayn karo, si kasta oo aagga forward u dhaqmo.

Xaqiiji jawaabta, ma aha tunnel-ka

Weydii resolver-ka xafiiska magac aadan waligaa weydiin, oo eeg qaybta authority ee jawaabta si aad u aragto haddii ay ka timid aagga shirkadda. Jawaab ku jirta cache waxba kama caddaynayso dariiqa hadda, weydiin toos ah oo guulaysatay oo upstream-ka ahna ma caddaynayso in resolver-kaagu doortay aaggaas. Ku celi isla weydiintaas TCP si aad u xaqiijiso in dariiqa uu ka gudbo jarista.

Macmiilka ku hay resolver-ka xafiiska u jeedda, oo hubinta DNSSEC ha ku sii furnaato. Browser lagu habeeyay resolver sir ah oo madax bannaan ayaa gabi ahaanba dhaafa habkan, daminta hubintana si jawaab lama filaan ah ugu ekaato mid sax ah waxay beddelaysaa guuldarro la arki karo mid aan la arki karin.

Qor saddexda nooc midkaad dooratay iyo sababta. Qofka xiga ee arka aagga oo guuldarraysta wuxuu u baahan doonaa jumladaas in ka badan faylka habaynta.