VPN waa xiran yahay laakiin magacyadu way guul-darraystaan: halka DNS dhab ahaan ku jabto

Tunnel-ku wuu kacsan yahay, calaamaddu cagaar tahay, oo tab kasta oo browser-ka ah waxay soo sheegaysaa guul-darro xallinta magacyada. Saddex hab oo kala duwan ayaa sawirkan abuura: resolver-ku waa laga yaabaa in aan la gaari karin, macmiilku waxaa laga yaabaa inuu weydiiyo resolver aadan filayn, ama waxaa laga yaabaa in kaliya magacyada gaarka ah guul-darraystaan. Kala sooc iyaga ka hor intaadan wax ka beddelin borotokoolka tunnel-ka, sababtoo ah mid kastaa meel kale ayaa lagu hagaajiyaa. Nidaamka hoose wuxuu ka bilaabmaa indho-indhaynta kala soocda saddexda.

Waxa raadin dhab ahaan u baahan tahay

Raadin waxay u baahan tahay saddex shay: cinwaanka resolver-ka, marin u socda cinwaankaas, iyo jawaab u dhigma su'aasha. Mid kastaa keligiis wuu guul-darraystaa, calaamadda muuqatana waa isla bogga aan soo raran. Sidaas darteed bogga khaladka wax badan kuma sheegayo ilaa aad ogaato midka saddexda ah ee jabay.

Macmiilku wuxuu resolver-kiisa ka bartaa borofaylka VPN, DHCP-ga tunnel-ka, ama hagaajintiisa u gaar ah, oo isha kee guulaysata waxay ku xiran tahay madal. Windows-ka, ipconfig /all waxay daabacdaa server-yada DNS adapter kasta, sidaas darteed waad arki kartaa haddii qiimaha la diray dhab ahaan yimid. Qiimaha la diray oo aan waligiis gaarin nidaamka hawlgalka waa guul-darro aamusan oo caadi ah. Akhri qiimaha la hagaajiyay ka hor intaadan taaban borofaylka.

Linux iyo macOS waxay isla su'aashaas ku jawaabaan amarar kala duwan, jawaabtuna waxay mudan tahay isla akhrintaas: resolvectl status iyo scutil --dns labaduba waxay liis-gareeyaan server-yada interface kasta. Isbarbardhig liiskaas iyo cinwaanka borofaylku sheeganayo inuu diro. Isma-aaf-la'aan halkan waxay sharraxaysaa wax kasta oo hoos yimaada, sidaas darteed xalli ka hor intaadan tijaabin magacyada.

Tijaabi hal magac dadweyne iyo hal magac gaar ah

Weydii magac martigeliye dadweyne caadi ah iyo magaca martigeliye gaar ah ee la diiwaangeliyay isla mishiinka, oo qor server kee ayaa jawaabay mid kasta. Haddii labaduba guul-darraystaan, resolver-ka ama marinkiisu waa jabay. Haddii kaliya magaca gaarku guul-darraysto, resolver-ku wuu jawaabay oo su'aashu waxay noqotaa aagga ama marin-u-jiidka. Socodsii labada weydiin hal daqiiqad gudahood midba midka kale, si isbeddel marin uusan u sharraxi karin farqiga.

Magacyada gudaha ka fogee shaashad-qabadyada dadweynaha iyo resolver-yada dadweynaha. Waqti-dhammaad iyo jawaab ku saabsan domain aan jirin waa indho-indhayn kala duwan: midda koowaad waxay sheegaysaa in aan waxba soo noqon, midda labaad waxay sheegaysaa in awood jawaabtay in magacu aanu jirin. In labadaba loo qaato hal khalad ayaa kuu horseedaysa lakab khaldan, digniinta shahaadaduna waa mar kale shay saddexaad, ma aha guul-darro DNS.

nslookup waxay daabacdaa server-ka la weydiiyay iyo jawaabta la helay labadaba, waana isla lammaanaha aad u baahan tahay. Laba jeer ku socodsii isla shell-ka oo qor cinwaanka jawaabayay agagaarka jawaab kasta.

nslookup example.com
nslookup host.corp.example 10.20.30.53

Xaqiiji in macmiilku dhab ahaan gaari karo server-kaas

Resolver gaar ah oo borofaylku diro wuxuu faa'iido leeyahay kaliya haddii macmiilku gaari karo isaga inta tunnel-ku kacsan yahay. Cinwaan si sax ah u muuqda oo aan marin lahayn wuxuu abuuraa waqti-dhammaad, xaaladda xiran ee tunnel-kuna wax kama sheegto marinkaas. Hubintu waa raadin marin oo loo jeediyay resolver-ka laftiisa, ma aha barta ugu dambeysa ee VPN.

Madal kastaa waxay taas ku jawaabtaa hal sadar, interface-ka lagu magacaabay soo-saaristana waa jawaabta oo dhan. Haddii uu tilmaamo adapter-ka jireed inta resolver-ku ka dambeeyo tunnel-ka, borofaylku ma diro prefix dabooli kara.

ip route get 10.20.30.53                      # Linux
route -n get 10.20.30.53                     # macOS
Find-NetRoute -RemoteIPAddress 10.20.30.53   # Windows PowerShell

Borofayl tunnel kala qaybsan, resolver-ku wuxuu noqon karaa meel ka baxsan marinnada la diray, taas oo ah dhibaato borofayl ee ma aha server. Isbarbardhig cinwaanka resolver-ka iyo prefix-yada la diray oo xaqiiji in midkood daboolo. Isma-aaf-la'aantaas oo kale waxay sharraxaysaa sababta DNS ugu shaqeeyo shabakad ugana guul-darraysto mid kale oo borofayl isku mid ah.

Xusuusnow in browser-yadu ay dhaafi karaan resolver-ka nidaamka

Browser leh DNS ammaan oo shidan wuxuu u diri karaa weydiimaha HTTPS via bixiye uu isagu doortay oo gabi ahaanba iska indhatiri karaa resolver-ka nidaamka hawlgalka. Markaas nidaamku wuu u muuqdaa mid sax ah inta browser-ku guul-darraysto, ama lidka. Taasi waa su'aal siyaasadeed oo browser-ka, ma aha tunnel-ka.

Hubi dejinta DNS ammaan ee browser-ka iyo siyaasad kasta oo maamulan oo xakameysa, kadibna tijaabi barnaamij ama browser labaad iyadoo tunnel-ku aan isbeddelin. Haddii kaliya hal barnaamij guul-darraysto, hagaajintu waxay ka tirsan tahay barnaamijkaas. Daaqad gaar ah ma aha isbarbardhig nadiif ah, sababtoo ah waxay laga yaabaa inay si caadi ah u damiso dhejisyada browser midka oo aan midka kale ahayn, welina ma dhaafo siyaasad maamulan. Taa beddelkeeda isticmaal borofayl browser labaad ama barnaamij kale.

Nadiifi kaydka oo mar kale tijaabi hawsha dhabta ah

Ka dib markaad hagaajiso dejinta, nadiifi kaydka resolver-ka maxalliga ah si jawaab hore uusan uga badbaadin hagaajinta. Soo-kabasho gaaban oo ay raacdo guul-darro cusub waxay ka dhigan tahay in sababtu weli jirto, ma aha in nadiifintu guul-darraysatay. Dooro sadarka u dhigma mishiinka aad ku jirto, sababtoo ah saddexda kayd waa kala duwan yihiin.

ipconfig /flushdns                 # Windows
resolvectl flush-caches            # Linux
sudo killall -HUP mDNSResponder    # macOS

Kadib ku celi hawsha asalka ah halkii raadin macmal ah, sababtoo ah hawshu waa waxa isticmaalaha danaynaya. Mar kale xiriir, si dib-u-tijaabintu u daboolto xaaladda isticmaalahu dhab ahaan ku noqon doono. Tixraaca nslookup ee Microsoft waa bogga ay mudan tahay inaad haysato doodaha weydiinta.

Haddii magacyadu guul-darraystaan kaliya ka dib goynta xiriirka, macmiilku ma soo celin hagaajintii hore, taas oo ah cillad wareegga nolosha oo la soo sheego, ma aha server DNS oo la beddelo. Raadin shaqaynaysana ma aha tijaabo daadasho, sababtoo ah waddanka bixitaanku wax kama sheegto resolver kee ayaa jawaabay.