Si VPN-ga gurigaaga u siiyo diiwaannada DNS ee u gaar ah nas.home.arpa
Daabac hal magac oo ka yimid dnsmasq, u mari resolver-ka WireGuard, ka dibna dooro inta u dhaxaysa in DNS loo riixo dhammaan macmiilka iyo split-DNS oo kaliya home.arpa.
Marka tunnel-ku sarreeyo, tallaabada ugu dambeysa badanaa waa magac shaqeeya halkii cinwaan aad ku dhejiso calaamad. Diiwaanka martigeliyaha dnsmasq iyo cinwaanka resolver-ka ee macmiilku gaari karo waxay taas ku sameeyaan laba fayl iyo multicast la'aan. Go'aanka run ahaantii u baahan fikirka ayaa ka cidhiidhi ah: macmiilku ma u diraa dhammaan DNS-ka resolver-ka guriga, mise kaliya magacyada hoos yimaada home.arpa? Wax kasta oo hoos ku qoran waxay u maleynayaan habaynta WireGuard la ansixiyay oo leh macmiil Linux iyo resolver shaybaadh oo maamulaha gurigu horey u maamulo.
Saddex siyaabood oo macmiilka loogu siiyo resolver
| Approach | Scope | Cost |
|---|---|---|
DNS = in the wg-quick interface | the client's general DNS while the tunnel is up | every name in the house now depends on the tunnel |
Platform split-DNS for home.arpa | only that suffix | more configuration per client platform |
Manual dig @resolver | one query at a time | fine for testing, useless for applications |
Laptop-ka marmar ku biira tunnel-ka, split-DNS waa caadada wanaagsan: waxay magacyada internet-ka caadiga ah ku hayaan resolver-ka ay mishiinku horey u aaminto. Mishiinka u jira inuu gaaro adeegyada guriga, riixidda resolver-ka ayaa fudud oo kharashka baaxadda ma quseeyo.
Ku daabac diiwaanka resolver-ka leh aagga
Kala sooc doorarka ka hor intaadan qorin habaynta: cinwaanka macmiilka VPN, resolver-ka iyo adeegga waa saddex martigeliye oo kala duwan oo leh saddex shaqo oo kala duwan. Shaybaadhkan waxay yihiin 10.77.0.2 macmiilka, 192.168.50.53 dnsmasq iyo 192.168.50.20 NAS, tunnel-kuna wuxuu maraa LAN-ga guriga.
listen-address=127.0.0.1,192.168.50.53
bind-interfaces
local=/home.arpa/
host-record=nas.home.arpa,192.168.50.20Sadarka host-record wuxuu bixiyaa cinwaanka, sadarka local= na waxa uu su'aalaha home.arpa ee aan la aqoon ku hayaa resolver-kan gudihiisa halkii uu kor u gudbin lahaa. Marka hore akhri habayntaada jirta oo isku waafaji wax kasta oo horey u qeexa server, interface ama isla domain maxalli ah; dusha ka sarraysiinta qayb korka mid iska soo horjeeda waxay soo saartaa resolver si farxad leh u raranta oo si khaldan uga jawaaba. Buugga dnsmasq wuxuu qeexaa labada tilmaamood iyo kontoroolka dhegeysiga.
Kadib xaqiiji adeegga socda, ma aha faylka. Imtixaanka habaynta iyo dib u bilaabista waa ugu yaraan, jawaabta dhabta ahna waa waxa su'aalu soo celiso.
Mari resolver-ka, ma aha oo kaliya bogga webka
AllowedIPs ee WireGuard wuxuu go'aamiyaa meelaha gelaya tunnel-ka. Haddii cinwaanka resolver-ku ka baxo, su'aashu waxay u baxdaa wadada caadiga ah oo waligeed ma gaadho dnsmasq, inkastoo NAS laftiisu la gaari karo. Ku dar cinwaanka resolver-ka, ama prefix-ka LAN ee ku jira, oo hubi siyaasadda gudbinta gateway-ga dhinaca kale.
U oggolow UDP iyo TCP port 53 laga bilaabo baaxadda tunnel-ka la oggolaaday, iyadoo leh waddo ku noqota cinwaanka tunnel-ka macmiilka. Ha ka gudbin port 53 WAN-ka si aad u fududayso imtixaanka: resolver recursive ah oo furan oo ku yaal xiriirka guriga ayaa la helaa saacado gudahood. Ku xirnaanta interface ma aha siyaasad gelitaan lafteeda.
Hubi jawaabta ka hor application-ka
Marka hore si toos ah u weydii resolver-ka, kadib nidaamka, kadib application-ka. Tallaabo kastaa waxay go'doomisaa hal xiriir oo silsiladda ah, farqiga u dhexeeyaana waa cudur-sidaha.
dig @192.168.50.53 nas.home.arpa. A
dig +tcp @192.168.50.53 nas.home.arpa. A
getent ahostsv4 nas.home.arpa
curl -sS --max-time 5 http://nas.home.arpa/ -o /dev/null -w '%{http_code}\n'Waa mudan in la ordiyo su'aasha TCP sababtoo ah jawaabta UDP ee la jaray waxay ku qasabtaa isku day kale, siyaasadda tuurta TCP 53 waxay soo saartaa guuldarrooyin u muuqda kuwo goos-goos ah. Tallaabada getent waxay muujineysaa waxa habaynta resolver-ka mishiinku dhab ahaan sameyso, taas oo aan had iyo jeer ahayn wixii aad riixday.
Go'aanso waxa dhaca marka tunnel-ku hooseeyo
Haddii DNS-ka guud ee macmiilka u tilmaamo 192.168.50.53, furfurista magacyada oo dhan way joogsataa marka tunnel-ku aanu sarreyn. Taasi waa la aqbali karaa mishiin kaliya faa'iido leh tunnel-ka, mana aqbali karo laptop sidoo kale isticmaala Wi-Fi kafeega. Split-DNS gebi ahaanba wuu ka fogaadaa su'aasha, sababtoo ah kaliya raadinta home.arpa ayaa ku tiirsan resolver-ka guriga.
Xusuuso waxa magacu yahay: home.arpa waxaa loo kaydiyay shabakadaha degganaanshaha mana aha mid caalami ah oo gaar ah, sidaas darteed shabakad kale waxay si sharci ah u isticmaali kartaa isla magaca. Waa fududaan maxalli ah, ma aha aqoonsi lagu kalsoonaan karo. Diiwaanka ku hay mid cusub marka adeeggu guuro, oo ka saar siyaasadda resolver-ka marka shaybaadhka la fariisiyo halkii aad ka tagi lahayd laptop u tilmaamaya cinwaan uu kaliya ku gaari karo tunnel aan hadda jirin.