DNS ma xallin karo marka kill switch-ka VPN uu xiro port 53
Kill switch wuxuu si ula kac ah u xiri karaa DNS. Isbarbar dhig xallinta tunnelka gudihiisa oo kaliya iyo ka-tagista resolver maxalli ah, ka dibna go'aanso lakabka dhab ahaan ku guuldareystay.
Marka kill switch-ku tuuno tunnelka, wuxuu la tagaa waddada DNS, resolver-ka hadhana marar dhif ah ma aha kan aad filayso. Laba naqshadood ayaa waqtigaas si aad u kala duwan u maareeya: in la xiro kasta packet DNS oo aan tunnelka gudihiisa ahayn, ama in resolver kaliya looga tago sidii ka-tagis. Labaduba waa la difaaci karaa. Bogga browser-ka calaamaduhu waxay u muuqdaan isku mid, sidaas darteed shaqada koowaad waa in la ogaado naqshadda aad dhab ahaan ku shaqeysay.
Farqigaas waxaan hortaaganahay maxaa yeelay hagaajintu way ka duwan tahay labada xaaladood. Hal naqshad waxay u baahan tahay ka-tagis ballaaran, tan kalena mid cidhiidhi ah. Qiyaasidda waxay ku kacaysaa ama asturnaanta ama duhurnimo.
Laba naqshadood oo DNS ah isla cilad
Naqshadda A waxay resolver-ka u tixgelisaa sida adeeg kale oo ka dambeeya tunnelka. Xeerarka firewall-ku waxay u oggolaadaan UDP iyo TCP 53 kaliya interface-ka tunnelka, cinwaanka macmiilka la siiyana waa resolver gudaha tunnelka. Marka tunnelku dhaco, raadintu way istaagtaa, waana natiijada la doonayay, ma aha cilad.
Naqshadda B waxay resolver ku haysaa mid la gaari karo shabakadda maxalliga ah, badanaa router-ka 192.168.1.1 ama stub-ka nidaamka hawlgalka 127.0.0.53, iyadoo lagu sababeeyay in xallinta magacyadu aysan la dhiman karin tunnelka. Waa ku habboon LAN guri halkaas oo routerku u xalliyo guriga oo dhan. Wi-Fi hotel ama garoon diyaaradeed isla ka-tagistaa waxay tilmaantaa server qof kale, magac kasta oo aad qorto waa la muujiyaa, inkastoo traffickaaga web-ka uu xiran yahay.
Xadku waa yaa leh resolver-ka. Haddii aad aaminto kan maxalliga ah, ka-tagistu waa dalool yar oo daacad ah. Haddii aadan aaminin, naqshadda tunnel-keliya ayaa ah tan kaliya ee taagan, qiimahana waa in tunnel dhacay uu la qaato magacyada oo dhan.
Sababta raadinta macmiilka VPN laftiisu ay wali u shaqeyso
Macmiilku waa inuu xalliyo magaca martigeliyaha gateway-ga ka hor inta uusan tunnel jirin, sidaas darteed xannibaad adag waa inaysan daboolin waddada bilowga macmiilka. Inta badan macmiilladu waxay kaydiyaan cinwaanka endpoint-ka ama waxay bixiyaan ka-tagis bilow ah oo dokumentaysan oo loogu talagalay hal martigeliye. Haddii xeerarkaagu xiraan raadintaas, tunnelku waligiis ma soo noqon doono oo diiwaannadu waxay muujinayaan macmiil aan gaari karin serverkiisa, taas oo ah cilad siyaasad ah oo aan ahayn DNS.
DNS qaybsan ayaa ah meesha labaad ee tan ka muuqata. Macmiilku wuxuu zon gudaha ah u riixaa resolver gaar ah wuxuuna u reebaa wax kasta oo kale resolver-ka nidaamka. Dhac ka dib magacyada dadweynuhu weli way xallin karaan halka kuwa gudaha ah ay waqti ka dhammaadaan, maxaa yeelay zon gaarku ma laha waddo. Isticmaalaha waxay u tahay "VPN-ku wuxuu jebiyay internetka"; diiwaanka resolver-ka waa su'aal aan waligeed iman.
systemd-resolved hoostiisa waxaad si toos ah u arki kartaa qaybinta. resolvectl status wuxuu taxaa server-yada DNS ee link kasta iyo domain-yada marin-u-jiidka, tunnelku markuu hoos u dhaco domainka gudaha ahi wuxuu weli tilmaamaa server ku yaal link aan jirin. Stub-ka 127.0.0.53 weli wuu aqbalaa su'aasha, ka dibna wuxuu sugayaa upstream aan jawaabi doonin, taasina waa sababta guuldarradu u qaadato ilbiriqsiyo halkii ay isla markiiba ku soo noqon lahayd.
DNS sir ah ma dhaafo filter packet
DNS over HTTPS iyo DNS over TLS waxay maraan 443 iyo 853, sidaas darteed xeerka xira port 53 waxba kama uusan sheegin. In "DNS" lagu xiro port ahaan waa siyaasad ku saabsan port, ma aha xallinta magacyada. Haddii kill switch-kaagu xiro dhammaan trafficka tunnelka dibadiisa, DoH si shil ah ayaa lagu daboolay. Haddii aad u samaysatay ka-tagis captive portal ama resolver dadweyne, lama daboolin.
Kontaroolka dhinaca macmiilka ayaa ah ulka ka jaban. Firefox wuxuu ka tanaasulaa resolver-ka DoH marka magaca canary use-application-dns.net aan la xallin, taasina waa sababta shabakadaha la maamulo ay u daabacaan domainkaas sida NXDOMAIN; siyaasadda shirkaduna waxay kaloo ku xiri kartaa dabaysan. Android Private DNS iyo DNS-ka ammaan ee Chrome waxay leeyihiin furahooda iyo caadadooda. In la damiyo ayaa ka badan lagu kalsoonaan karaa in la daba galo cinwaannada resolver-ka, maxaa yeelay liiska cinwaannadu wuu is beddelaa xeerarkaaguna ma beddelmo.
Waxaa jira nooc tan ah oo aan haba yaraatee ku saabsanayn daadinta. App leh resolver la dhejiyay wali waxay u baahan tahay waddo shabakadeed si ay u gaarto. Siruhu waxay beddelaan cidda akhrin karta su'aasha, ma aha in packetku ka bixi karo mishiinka, sidaas darteed xannibaad qalabka oo dhan ayaa ka adkaata dejinta iyada oo aan taaban.
Calaamadda ku habboon lakabka
Inta badan warbixinnadu waxay yimaadaan hal jumlad, jumladaasna badanaa waxay hore u magacawdaa lakabka. Shaxda hoose waa waxa aan dhex maro ka hor inta aan taaban xeer, ujeeddadu waa in la go'aamiyo haddii su'aasha la xannibay, si khaldan loo jiheeyay, ama aan waligeed la dirin.
| Symptom | Likely layer | First check |
|---|---|---|
| Every name fails at once, instantly | Resolver answering with a refusal | Query the resolver by address, not by name |
| Lookups hang for seconds, then time out | Packets dropped with no response | Watch port 53 on the physical link |
| Public names resolve, internal ones do not | Split-DNS routing domain | Per-link DNS servers on the tunnel |
| Names resolve, the page still fails | Not DNS: routing or MTU | Connect to the IP directly |
| Only one application fails | Pinned resolver or cached answer | Check that app's DNS setting |
Laba safka ugu horreeya ayaa ah kuwa dadku si khaldan u ogaada. Dhac aamusan iyo diidmo labaduba waxay browser-ka uga muuqdaan sida "DNS wuu jabay", laakiin mid keliya ayaa macnaheedu yahay kill switch-kaagu shaqadiisa wuu qabanayaa. Diidmo macneheedu waa wax baa jawaabay, sidaas darteed xannibaaddu ma aha meesha aad u malaynayso.
Soo celi siyaasadda resolver-ka, ka dibna caddee
Hagaaji naqshadda, ma aha calaamadda. Xallinta tunnel-keliya, u oggolow 53 interface-ka tunnelka, riix resolver-ka gudaha oo la socda habaynta tunnelka, oo ka tag xiriirka jireed isagoo aan lahayn wax fasax DNS ah. wg-quick dhexdiisa khadka DNS = ayaa qora resolver-ka habaynta interface-ka, sidaas darteed tunnelka seegaa wuxuu meesha ku reebaa resolver-kii hore oo su'aal kastaa waxay maraysaa waddo khaldan. buug-gacmeedka wg-quick wuxuu dokumenteeyaa dhaqankaas platform kasta.
Ka dib hubi sidan. Linux resolvectl status wuxuu muujinayaa xiriirka firfircoon, dig +short example.com wuxuu tijaabiyaa magac dadweyne, dig @10.8.0.1 internal.example.com wuxuu tijaabiyaa kan gaarka ah, iyo sudo tcpdump -ni any port 53 wuxuu muujinayaa interface-ka packets-ku isticmaalaan inta aad labadaba waddo. Windows Get-DnsClientServerAddress -AddressFamily IPv4 iyo Resolve-DnsName example.com waxay bixiyaan labada xaqiiqo ee isku mid ah: yaa habaysan iyo yaa jawaabaya.
Ku dhammee tijaabada taban. Ka jar tunnelka, xaqiiji in magac dadweyne cusub uu guuldareysto, xaqiiji in magaca gaarka ahi uu guuldareysto, iyo xaqiiji in aanay jirin packet port 53 oo ka baxay adapterka jireed. Xannibaad ku taagan oo kaliya jawaabaha kaydsan waligeed ma taagna.
Liiska hubinta ka hor inta aan la xirin ticket-ka:
- Resolver-ka la isticmaalay inta ciladdu socotay waa kii siyaasaddu ula jeedo.
- Raadinta endpoint-ka macmiilka laftiisu wali waa la oggol yahay, kayd ama ka-tagis.
- DoH iyo DoT waxay ku jiraan xannibaadda ama siyaasad ayaa damisay.
- Zonno gaar ah waxay ku guuldareystaan xiran, ma aha furan, marka tunnelku tago.