DNS-ka OpenVPN ee gateway-ga: dnsmasq iyo baaxadda firewall-ka

Macaamiisha tunnel-ka ku jira waxay gaaraan gateway-ga, gateway-gana wuxuu gaaraa resolver-ka gudaha, sidaas darteed DNS waa inuu shaqeeyaa. Laakiin ma shaqeeyo, sababtoo ah kuwani waa laba oggolaansho oo kala duwan, adeegga DNS ee shaqeeyaana waa shay saddexaad. Dhageystuhu waa inuu ku jiraa ciwaan ay macaamiishu gaaraan, firewall-ku waa inuu u oggolaadaa weydiimaha ciwaankaas, macmiilkaana waa in loo sheegaa inuu isticmaalo. Furitaanka tunnel-ka labada dhinac wuxuu si shil ah u xalliyaa labada hore oo wuxuu ka tagaa saddexaad mid aan dhammaystirnayn.

Dhageystuhu waa adeeg maxalli ah oo leh laba jiho

Gudaha, macmiilku wuxuu weydiin u diraa ciwaanka tunnel-ka gateway-ga dekedda 53. Dibadda, daemon-ku wuxuu weydiintaas u gudbiyaa upstream-kiisa la habeeyay. Labada qaybood waa inay shaqeeyaan, waxayna ku guuldareystaan siyaabo kala duwan.

Waqtiga dhammaadka ee macmiilku soo sheego iyo waqtiga dhammaadka ee gateway-ga laga arko isku cillad maaha.

Xir ciwaanka tunnel-ka, ma aha ciwaan kasta

Isticmaalka dnsmasq oo gaar u ah shaqadan wuxuu u baahan yahay ciwaan dhegeysi cad, qaab xirid oo u dulqaata soo bixidda tunnel-ka ka dib bilowga, iyo hal upstream oo cad. Kani waa nooca ugu yar ee aan isticmaalo:

listen-address=127.0.0.1,10.90.0.1
bind-dynamic
no-resolv
no-hosts
server=192.168.50.53

bind-dynamic wuxuu xiraa ciwaannada gaarka ah oo wuxuu la qabsadaa marka tun0 uu soo baxo mar dambe, taas oo muhiim ku ah host-ka adeegga VPN uu dib u bilaabmo. Liisitaanka loopback waxay hayaan qalabka maxalliga ah mid shaqeeya iyada oo aan lagu darin dhageyste dadweyne. no-resolv wuxuu ka hortagaa daemon-ka inuu ka dhaxlo upstream-yada habeynta resolver-ka host-ka, iyo no-hosts wuxuu ka hortagaa isticmaalkan inuu daabaco faylka hosts ee gateway-ga. Midkoodna doorashooyinkan ma siiyo qof fasax uu adeegga ku weydiiyo.

Hubi inuu jiro dhageyste hore u jiray dekedda 53 ka hor inta aadan bilaabin daemon labaad, oo isticmaal milkiilaha habeynta qaybinta halkii aad ka isticmaali lahayd fayl ku lumay galka khaldan.

U oggolow gelinta DNS, ma aha gudbinta tunnel-ka

Xeerarka firewall-ka ee tan shaqeeya waa xeerar gelin maxalli ah oo ku xaddidan interface-ka tunnel-ka, kooxda macaamiisha, ciwaanka gateway-ga iyo dekedda 53. Laba xeer, mid kasta oo borotokool ah, waa ku filan yihiin:

sudo ufw allow in on tun0 proto udp from 10.90.0.0/24 to 10.90.0.1 port 53
sudo ufw allow in on tun0 proto tcp from 10.90.0.0/24 to 10.90.0.1 port 53

DNS wuxuu ku socdaa TCP sida UDP, sidaas darteed xeerka UDP kaliya wuxuu ka tagaa jawaabaha waaweyn inay ku guuldareystaan si u ekaanaysa mid goos-goos ah. Kuwani ma aha ufw route oggolaanshaha, mana noqon karaan oggolaansho ballaaran oo ku saabsan tun0. Nidaamku wuxuu muhiim u yahay sida nuxurka: xeer hore oo tuura gelinta oo dhan ka timid tun0 ayaa weli guuleysta, oo ku darista oggolaansho hoos tuurista ugu dambeysa waxba ma abuurto.

Haddii DNS-ka gateway-ga uu hadda qayb ka yahay naqshadda, si ula kac ah dib u eeg siyaasaddaas hore oo qor sababta.

Qaybta upstream-ka waa waddo gaar ah

Weydiimuhu waxay ka baxaan gateway-ga ciwaankiisa u gaar ah iyagoo u jeedda resolver-ka upstream-ka, sidaas darteed waddada gateway-ga iyo siyaasadda bixinta ee resolver-kaas waa inay oggolaadaan isweydaarsiga. Kani waa xeer ka duwan kan u oggolaada macaamiisha inay gaaraan dhageystaha, wuxuuna ku guuldareystaa calaamad kale.

Ha ku darin bixinta tunnel-ka oo aan xaddidnayn si jawaabahu u shaqeeyaan; jawaabaha la raadraaco uma baahna.

Riix doorashada, kadib hubi gudbinta

Server-ku wuxuu ku dhawaaqi karaa resolver-ka macaamiisha iyada oo la isticmaalayo doorasho la riixay. Taasi waa doorasho, ma aha amar ay nidaamka hawlgalku qasab ku tahay inuu maqlo:

push "dhcp-option DNS 10.90.0.1"

Macmiil Linux oo khadka amarka ah wuxuu u baahan karaa isku-dhafka resolver-ka ee maareeyaha xiriirkiisa, qalab la maareeyo na wuxuu u baahan karaa profile maamul oo la cusbooneysiiyay. Xiriirka ka dib xaqiiji resolver-ka firfircoon ee macmiilka halkii aad ka malayn lahayd in riixista la dabaqay. Marka laba habab ay isku mar wax ka beddelaan DNS, waxaad helaysaa tartan u muuqda sida xallin gariiran.

Hadafku waa hal milkiile oo habeynta resolver-ka macmiilka, riixistuna inta badan waa milkiilahaas kaliya marka madal macmiilku ogolaato.

Tijaabi waxa aad dhab ahaan dhistay

Weydii hal magac gaar ah oo si buuxda u qalma iyo hal magac dibadeed oo la oggolaaday si toos ah ciwaanka tunnel-ka, iyada oo loo marayo UDP iyo TCP. Kadib ku celi waddada raadinta caadiga ah ee app-ka.

Haddii weydiimaha tooska ahi shaqeeyaan oo app-ku wali guuldareysto, cilladdu waxay ku jirtaa gudbinta ee ma aha server-ka:

• Macmiilku waligiis ma dabaqin doorashada la riixay.
• Resolver kale ayaa dambe la dhigay oo guuleystay tartanka.
• App-ku wuxuu isticmaalaa maktabadda resolver-kiisa ama jawaab kaydsan.

Ku dhammee xaqiijinta in isha ka baxsan waddada VPN ee la ansixiyay aysan haba yaraatee isticmaali karin dhageystaha. Xallinta guuleysata ma awoodiso ciwaanka ay soo celisay, sidaas darteed labadan su'aalood kala sooc.