Hagaajinta DNS-ka martida libvirt oo uu xannibay firewall VPN ku salaysan calaamad

Martida ku jirta shabakada caadiga ah ee libvirt waxay magacyada si fiican u xalliyaan ilaa interface-ka WireGuard uu soo bato, ka dibna raadin kastaa wuxuu istaagaa isla meel. dnsmasq wali wuxuu dhagaysanayaa 192.168.122.1:53, martidu wali waxay haysataa ciwaankaas resolver ahaan, weydiintuna wali way timaaddaa. Waxa isbeddelay ayaa ah in weydiinta sare ee hostiga laftiisa, ama jawaabta lagu bixiyo, hadda uu tuurayo sharci la qiimeeyo ka hor silsilad shaandho kasta oo aad u malayn lahayd inaad wax ka beddesho. Banaanka ayaa ah calaamad la dhigay goor hore ku filan, xidhiidh ay jawaabtu dhaxalto.

Martidu waxay lumiyaan DNS isla markii tunnel-ku soo baxo

Xaqiiji qaabka ka hor intaadan wax beddelin. Soo deji tunnel-ka, socodsii dig @192.168.122.1 example.com marti ka mid ah oo daawo isagoo jawaabaya. Kor u qaad tunnel-ka, ku celi, oo daawo isagoo waqtiga dhaafaya. Labadaa natiijo waxay hal tallaabo ku reebaan shabakad libvirt ah oo xun, ciwaan resolver ah oo khaldan, iyo dnsmasq dhintay.

Kadib eeg dhinaca hostiga. Haddii dnsmasq uu diiwaangeliyaa weydiinta iyo gudbinta sare, baakaddu way timid oo guuldarradu waxay ku taal bixidda. Haddii dnsmasq aanu waxba diiwaangelin, weydiinta martidu waxaa lagu tuurayaa soo-gelinta oo ka reebban yahay hook ka duwan kan maqaalkani calaamadeeyo.

Sababta sharci accept oo ku jira silsilad dambe uusan waligiis shaqayn

Firewall VPN ku salaysan calaamad wuxuu go'aan ka gaaraa isagoo eegaya calaamadda baakadda ama calaamadda xidhiidhka, ma aha ciwaankaaga isha. Wax kasta oo yimaada interface-ka jireed isagoo aan lahayn calaamadda la filayay waa la diidayaa, diidmadaasuna waxay ku dhacdaa qawaaniinta haysta imtixaanka calaamadda. ip saddr 192.168.122.0/24 accept sadar lagu daray silsilad dambe mid kasta waligiis looma tixgeliyo baakaddaas, sidaas darteed sharciga muuqda wuxuu u eg yahay mid sax ah oo waxba ma beddelo.

Ballaarintiisa ilaa wax shaqeeyo waa dabin labaad. Aqbalidda dhammaan subnet-ka libvirt ee jidka soo-gelinta hostiga waxay martida u furaysaa adeeg kasta oo hostiga, marka baahida dhabta ahi ay tahay hal deked.

Habka suurtogeliya ka-reebban yar waa la-socodka xidhiidhka. Marka aad baakad ku dhigto ct mark, qiimaha waxaa lagu kaydiyaa gelinta conntrack oo aan ku kaydin baakadda oo keliya, sidaas darteed baakad kasta oo xidhiidhkaas ka mid ah ayaa qaata kadib, oo ay ku jirto jawaabta hostiga dib ugu noqota martida. Taasi waa tabta oo dhan: calaamadee codsiga hal mar, jidka soo-noqoshadana horey ayaa loo calaamadeeyay.

Calaamadee weydiinta ka hor inta aanu shaxda VPN arkine

Ka-reebanka geli shaxdiisa u gaar ah si akhristaha dambe uu u helo isagoo aan falanqayn qawaaniinta VPN:

table inet allowedLocal {
  chain guest_dns {
    type filter hook input priority mangle; policy accept;
    ip saddr 192.168.122.0/24 meta l4proto { tcp, udp } \
      th dport 53 ct mark set 0x00000f41
  }
}

priority mangle waa taban, taasoo silsiladdan hor dhigta silsiladaha shaandhada caadiga ah ee xidhmada VPN ku rakibto mudnaanta eber. Nidaamka hook-ka ayaa sharciga waxtar u leh; isla sharcigaas oo ku jira silsilad ka dambeeya silsiladda VPN waa qurxin uun.

Lambarka calaamadda laftiisa lama qaadi karo. Qaado qiimaha ay qawaaniinta VPN ee rakiban u aqbalaan taraafikooda u gaar ah, ka akhri qawaaniinta nool, oo isticmaal taas. Calaamad khaldan waxay soo saartaa sharci si nadiif ah u raraya, la mid ah weydiin kasta, oo waxba aan soo gelin.

Sanbabka ku hay ballaca dekedda 53

Sida qoran, tani waxay u ogolaataa DNS ka imanaya subnet-ka libvirt ilaa hostiga iyada oo maraysa TCP ama UDP dekedda 53 oo wax kale ma aha. Ma u ogolaato martida inay gaaraan internet-ka banaan tunnel-ka, mana u ogolaato hostiga inuu xidhiidhyo u furo dhanka martida. Haddii marti dambe u baahdo adeeg kale oo hostiga, ku dar sharci gooni ah oo magacaabaya dekeddaas loo socdo halkii aad ka dabci lahayd kan.

Daacad ka ahow waxa aad beddeshayso. Marti gaari karta resolver waxay sidoo kale tunnel-gelin kartaa xog kasta iyada oo maraysa weydiimaha DNS, ka-reebankani waa dalool ula kac ah oo ku yaal xadka VPN ee ma aha odhaah sheegaysa in shabakadda maxalliga ah la aamini karo. Xaddidka isha ilaa 192.168.122.0/24 waxay daloolka ka fogaynaysaa subnet kasta oo maxalli ah, tirinta weydiimaha ishaasna waa jaban haddii khatartu kugu habboon tahay.

Ka dhig mid ka badbaada dib-u-kicinta oo caddee labada qaybood

Sharci lagu qoray shell-ka wuu luntayaa kicinta xigta, sharciga la raro ka dib markii interface-ka VPN horey u gudbinayo taraafikuna wuxuu ku guuldareystaa tartanka xidhiidhka koowaad. Shaxda geli qaabeynta nftables ee joogtada ah ee hostiga, ama unug lagu habeeyay adeegga VPN ka hor, oo hubi nidaamka halkii aad ka malayn lahayd.

Xaqiijintu waxay u baahan tahay saddex jawaab oo gooni ah. Xaqiiji in silsiladda la raray oo marka hore la habeeyay, xaqiiji in gelinta conntrack ay calaamadda muujinayso labada jiho, oo xaqiiji in raadinta martidu ay ciwaan soo celiso. Kadib xaqiiji qaybta kale: taraafikada webka caadiga ah ee martida ee hostiga dadweynaha wali way guuldareysataa inta tunnel-ku hoos yahay ama xannibayo. Haddii DNS shaqeeyo oo wax kasta oo kale daadanayaan, sharcigaagu wuu ka ballaaran yahay kan sare.

Haddii raadintu wali guuldareysato ka dib markii calaamadda la dhigay, ka horjoogsadee damaca ballaarinta isha. Hubi halka dnsmasq u gudbinayo, haddii resolver-ka martidu u jeedo 192.168.122.1 ama ciwaan dadweyne oo qof qoray, iyo haddii weydiintu hostiga gaarto. Calaamadayntu waxay soo gelisaa baakadda oo wax kale ma aha, sidaas darteed sare-xun ama shabakad mala-awaal ah oo xun way sii ahaanayaan xun iyadoo aan loo eegin inta sharci ee aad ku darto.