OpenVPN dekedda 53: saddex wada-hadal oo dadku qaldaan
Xallinta magaca bartamaha, gaadiidka sirta ah iyo DNS-ka tunnel-ka kadib waa saddex wada-hadal oo kala duwan. Go'aanso tallaabada sidee u guuldareysatay ka hor intaadan beddelin deked ama xalliye.
Warbixinnada sheegaya in VPN-ku ku xanniban yahay dekedda 53 waxay isku daraan saddex indho-indheyn oo ku guuldareysta sababo kala duwan. Xallinta magaca bartamaha waxay dhacdaa ka hor inta uusan jirin tunnel, gaadiidka sirta ah waa wada-hadal gooni ah, iyo weydiimaha DNS ee kadib sameeya waa tan saddexaad. Mid kastaa wuxuu leeyahay calaamadiisa guuldarro, oo kaliya mid ka mid ah ayaa la xiriira DNS.
Ka hor intaadan wax beddelin, u kala saar baakadaha ujeeddadooda, sababtoo ah xallinta waxay raacdaa tallaabada.
Saddex wada-hadal, hal lambar deked
Wada-hadalka koowaad waa raadinta magac ee bartamaha: mishiinkaagu wuxuu weydiiyaa xalliyaha la habeeyey halka uu vpn.example.com yahay, jawaabtaasna waxay ku timaaddaa DNS caadi ah ka hor inta uusan macmiilka dirin hal baakad tunnel ah. Tan labaad waa gaadiidka OpenVPN laftiisa, kaas oo ku xirmaa ciwaanka raadinta soo saartay borotokoolka iyo dekedda uu borofilku sheegayo. Tan saddexaad waxay dhacdaa ka dib marka tunnel-ku kaco, marka codsiyadu magacyo weydiiyaan oo dejinta xalliyaha la diray go'aansato cidda jawaabta.
Saddexdaan mid kastaa wuu guulaysan karaa ama guuldareysan karaa si madax-bannaan. Macmiilku wuu si fiican u xallin karaa bartamihiisa haddana ku guuldareysan karaa inuu gaaro dhagaystaha, wuxuuna dhisi karaa tunnel inta raadinta magac kasta oo gudaha ah ku guuldareysanayso sababtoo ah dejinta DNS waligeed ma iman.
| Conversation | When it happens | What has to be true |
|---|---|---|
| Endpoint lookup | Before the client contacts a hostname | An underlying resolver path can answer for the endpoint name |
| OpenVPN transport | During tunnel establishment | The gateway listens on its configured transport, address and port, and nothing filters it |
| Application DNS | During or after the protected session | A resolver the client can reach, plus routing that carries its queries |
Shaxda u akhri sida liis hubin oo aan ahayn sida sharraxaad. Haddii magaca bartamaha aan la xallin, wax dambe ma shaqeyn karo, tunnel-kuna waligiis ma bilaabmo.
Lambarka dekeddu ma magacaabo codsiga
Dekedda 53 waxay qaaddaa DNS caado ahaan, oo hawlwadeenka OpenVPN ayaa waliba ku faafin kara dhagayste, taasina waa sababta lambarkan u yahay aqoonsi liita. Fadhi OpenVPN oo ku yaal UDP 53 wali waa fadhi OpenVPN, iyo weydiin DNS ah oo loo diro server ku yaal dekedda 53 waxba kama sheegto haddii tunnel la oggol yahay. Sadarrada proto iyo remote ee borofilku waxay qeexaan bartamaha dibadda; lambarka dekeddu iskiis waxba ma qeexo.
Marka la baarayo tan labada dhinac bay goysaa: baaritaan UDP caadi ah oo dekedda 53 ah wuxuu caddeeyaa in deked jawaabto, ma aha in adeegga VPN jawaabo. Ku tijaabi macmiilka dhabta ah iyo borofilka dhabta ah, sababtoo ah kaliya taas ayaa tababarta gacan-qaadista ay adeeggu filayo.
Caddee dhagaystaha ka hor intaadan shabakadda eedeyn
Serverka, hubi waxa ku xidhan ss -lunp | grep 53 oo la barbardhig borotokoolka iyo dekedda borofilka. Shabakadda macmiilka, ku orod macmiilka faahfaahin badan si log-ku u muujiyo ciwaanka iyo gaadiidka uu isku dayay. Haddii serverku dhagaysanayo oo baakadaha macmiilku aanay imanayn, waddada ama siyaasaddu way diidaysaa, taasina waa wada-hadal lala yeesho milkiilaha shabakadda ee ma aha sabab lagu beddelo dekedda.
Deked kale waxay caawisaa kaliya marka adeeggu dhab ahaan halkaas dhagaysanayo oo baahintu ogolaato. U rar dhagaystaha si looga baxo shaandhaynta shabakad maamulan waa go'aan siyaasadeed, ma aha tallaabo xallinta dhibaatooyinka. Weydii milkiilaha shabakadda waxa la oggol yahay ka hor intaadan beddelin adeegga, sababtoo ah waddo-mar ka leexanaysa siyaasadda ayaa haddana dambe la xiraa. Qor jawaabtaas borofilka agtiisa si qofka xiga aanu codsiga ku celin.
Hubi DNS tunnel-ka kadib, gooni ahaan
Marka tunnel-ku kaco, baadh xaaladda xalliyaha ee interface-ka VPN oo weydii hal magac gudaha ah iyo hal magac dadweyne ah. Haddii magacyada gudaha ku guuldareystaan inta tunnel-ku qaadayo hawada, dejinta DNS la diray lama dabaqin, taas oo ah su'aal ku saabsan isku-xirka macmiilka ee ma aha gaadiidka. Haddii magacyada dadweynuhu ku guuldareystaan oo magacyada guduhu shaqeeyaan, siyaasadda tunnel-ka qaybsan waxay samaynaysaa waxa loo habeeyey.
Ka tag beddelka DNS milkiilaha xalliyaha. Ku qoraan korka habaynta xalliyaha la maamulo si hal tijaabo u gudubto waxay jabin kartaa magacyo gaar ah wax kasta oo kale oo mishiinka ku jira. Haddii tunnel-ku diraa xalliye oo macmiilku iska indhatiro, hagaaji isku-xirka macmiilka halkii aad meel kale ku dari lahayd galin taagan. Galinta taagan waxay qarinaysaa guuldarrada ilaa qof beddelo shabakadda. Qor xalliyaha loo doonayo inuu ka jawaabo meel kasta oo magac ah.