Sababta magacyada martigeliyaha gudaha ugu xalliyaan dig laakiin ugu guuldareystaan curl VPN
dig wuu jawaabaa, laakiin curl wuxuu sheegaa in uusan xallin karin martigeliyaha. Isbarbar dhig labada silsiladood ee raadinta, kadibna hagaaji nsswitch, DNS-ka xiriir kasta ama dabo-raac raadin oo khaldan.
Laptop-kaagu wuxuu ku jiraa VPN, dig service.internal.example wuxuu ku jawaabaa cinwaan 10.x, curl-na wali wuxuu ku soo baxaa Could not resolve host. Tunnel-ku maaha dhibaatada: wuxuu u qaaday weydiinta dig isagoo aan caban. Farqiga waa cidda su’aasha weyddiisa. dig wuxuu hal weydiin u diraa hal server oo aad magacawdo, halka curl uu maro silsiladda raadinta nidaamka hawlgalka, silsiladdaasna waxay leedahay xeerar u gaar ah oo ku saabsan serverka la weydiiyo.
Laba raadin oo isku magac ah
dig waa stub resolver u gaar ah. Wuxuu akhriyaa /etc/resolv.conf, wuxuu dooranayaa server magacyo, wuxuu diraa hal weydiin A ama AAAA oo wuxuu daabacaa jawaabta. Wuxuu si buuxda u dhaafi doonaa nsswitch mana oga wax ku saabsan xaaladda xiriir kasta oo systemd-resolved ama NetworkManager ku hayaan meel ka baxsan faylkaas, taasina waa sababta jawaabta dig ay sax noqon karto walina wax kaa sheegi karin waxa ay barnaamijkaagu arki doono.
Barnaamijyadu waxay wacaan getaddrinfo, getaddrinfono wuxuu maraa silsilad dheer: nidaamka moduulada nsswitch, ka dib moduulka magaca maareeya, ugu dambayntiina resolver-ka laga dhisay cabbirka xiriirka hadda. Mashiinka systemd weydiintu waxay tagtaa 127.0.0.53, systemd-resolvedna wuxuu dooranayaa server sare oo xiriir kasta leh iyadoo ku salaysan domain-ka marinka ee ku xiran interface-ka tun.
Laba amar ayaa kala sooca lakabyadaas iyagoo aan mala’in:
getent ahosts service.internal.example
resolvectl query service.internal.examplegetent wuxuu isticmaalaa isla jidka curl, sidaas darteed khalad getent oo ag yaal dig shaqeynaya wuxuu cilladda ku meeleeyaa siyaasadda raadinta ee ma aha marinka baakadaha. resolvectl query wuxuu kaloo daabacaa interface-ka iyo server-ka sare ee jawaabta bixiyay, taasina waxay muujinaysaa in xiriirka tunnel-ka ama xiriirka jireed uu guuleystay go’aanka.
Akhri resolver-ka ay barnaamijku dhab ahaan isticmaalaan
/etc/resolv.conf waxaa lagu soo saaraa inta badan desktop-yada, macmiilka VPN-na wuxuu leeyahay saddex siyaabood oo uu ula macaamilo: inuu server magacyo hor dhigto, inuu faylka dul qoro, ama inuu serverradiisa siiyo NetworkManager oo uu daemon-ka u oggolaado inuu dib u qoro. Kaliya qaabka saddexaad ayaa ilaaliya DNS-ka xiriir kasta, sababtoo ah serverradu waxay ku xiran yihiin interface halkii lagu simi lahaa hal liis oo caalami ah.
Nidaamyada NetworkManager natiijadu waxay ku xiran tahay backend-ka ku jira /etc/NetworkManager/NetworkManager.conf:
[main]
dns=systemd-resolveddns=default serverrada macmiilka waxaa lagu daro resolv.conf sida ay tahay, iyo weydiin gaar ah wali waxaa loo diri karaa resolver-ka guud. Backend fahma xiriirrada, systemd-resolved ama dnsmasq, serverrada tunnel-ka waxay ku ekaanayaan tunnel-ka oo kaliya magacyada u dhigma domain-ka marinkiisa ayaa halkaas taga. Xaddidnaantaas waa waxa split DNS uga dhigan tahay ficil ahaan, waana qaybta inta badan maqan marka macmiilku sheegto inuu taageero.
Akhri xaaladda ka hor inta aadan wax beddelin:
resolvectl status
resolvectl dns tun0Waxaad rabtaa inaad aragto interface-ka tun oo lagu taxay server DNS iyo domain marin oo loogu talagalay dabo-raaca gaarka ah, oo lagu muujiyay ~internal.example. Server aan ku jirin xiriirka waxay ka dhigan tahay in macmiilku waxba dirin. Server aan domain lahayn waxay ka dhigan tahay in weydiimaha ama dhammaantood halkaas tagaan ama midna tagin, iyadoo ku xiran macmiilka, labaduna maaha split DNS.
Halka nsswitch raadinta goor hore ku dhammeeyo
Sadarka caadiga ah ee desktop-ka wuxuu u eg yahay sidan:
hosts: files mdns4_minimal [NOTFOUND=return] resolve [!UNAVAIL=return] dns myhostnamemdns4_minimal wuxuu maareeyaa multicast DNS wuxuuna sheegtaa magac kasta oo ku dhammaada .local. Adeeg Kubernetes sida api.infra.svc.cluster.local ayaa sidoo kale ku dhammaada .local. Marka moduulka mDNS uu soo sheego NOTFOUND, ficilka [NOTFOUND=return] wuxuu dhammeeyaa raadinta oo dhan halkii uu u sii jeesan lahaa moduulka dns, sidaas darteed magaca marnaba looma diro resolver-ka VPN. dig wuxuu si buuxda uga gudbaa faylka, taasina waa sababta labada qalab isku raacsanayn.
Kani waa iskhilaafka ugu daran dhibaatadan, wuxuuna ku eg yahay hal eray oo ku jira fayl cabbir oo ka duqsi weyn VPN-kaaga. Beddelka ficilka oo loo beddelo [NOTFOUND=continue] waxay ilaalisaa mDNS daabacadaha iyo aaladaha maxalliga ah halka DNS uu magaca arki karo. Beddelka sadarka oo lagu beddelo hosts: files dns ayaa sidoo kale shaqeeya waana ka qallafsan: waxay tuftaa xallinta .local ee daabacaha aad dhab ahaan isticmaasho.
Magacyo ku nool hal shabakad oo keliya
Aagagga gaarka ah waxay awood ku leeyihiin hal meel oo keliya. Magac AWS sida ip-10-0-4-31.eu-west-1.compute.internal waxaa lagaga jawaabaa resolver-ka VPC ee gobolkaas, oo kaliya inta uu dhammaadka VPN-kaagu ku jiro isla gobolka uu khadka ku jiro. Ku xidh dhammaad ku yaal Frankfurt, weydii magac compute.internal oo ka yimid Ireland, oo wax cabbir maxalli ah ma caawin doonto: aagga hayaa diiwaanka halkaas lama gaari karo.
Domain-yada raadintu waxay soo saaraan sawirka milicsiga. service qaawan waxaa lagu buuxiyaa dabo-raaca resolver-ku u arko mid lagu dabaqi karo, iyo xiriir VPN ah domain-ka maxalliga ahi wuu ka adkaan karaa kan shirkadda. Ku weydii iyadoo dhibic ku leh dhammaadka si aad uga saarto mala-awaalka, getent ahosts service.internal.example., haddii taas shaqeyso halka magaca gaaban uu guuldareysto, hagaajintu waa domain-ka raadinta ee tunnel-ka, ma aha cinwaanka server-ka.
Macmiillada la maareeyo waxay ku daraan lakab saddexaad oo ka sarreeya resolver-ka nidaamka. Profayl VPN Windows wuxuu qaadi karaa siyaasaddiisa xallinta magacyada, xeerar barnaamij kasta ah iyo shax NRPT oo shaqeeya xitaa marka tunnel-ku daman yahay. Barnaamijyada leh keyd DNS u gaar ah, oo caadi ku ah deegaannada .NET iyo Java, waxay hayaan guuldarro duugoobay muddo dheer ka dib markii silsiladda la hagaajiyay. Macmiillada Apple waxay split DNS ku habbeeyaan domain-yada iswaafaqsan ee cabbirrada DNS halkii ay ka isticmaali lahaayeen resolv.conf, Chromium ama Firefox oo ku jira habka DNS ammaan ah waxay ka gudbi karaan resolver-ka nidaamka magacyada guud. Tixraaca Microsoft ee xallinta magacyada VPN waxay sharraxaysaa dhinaca Windows ee lakabkaas siyaasadeed.
Go’aanso lakabka la hagaajinayo
Ka shaqee calaamadda ilaa lakabka halkii aad isku dayi lahayd hagaajinno si kala horreysan:
| Symptom | What it means | Check first |
|---|---|---|
| dig answers, getent fails | lookup chain, not the packet path | nsswitch line and resolvectl status |
| Timeout rather than NXDOMAIN | private resolver unreachable through the tunnel | resolvectl dns tun0, route to that address |
| NXDOMAIN | an authority answered and does not know the name | zone owner, endpoint region |
| FQDN works, short name fails | search suffix mismatch | resolvectl domain on the tun link |
| getent works, app fails | app cache or its own resolver | restart the app, check secure DNS |
Laba sadar ayaa qaada culeyska ugu badan. Waqti-dhaafku waa dhibaato gaaritaan: resolver-ka gaarku kama jawaabo tunnel-ka, sidaas darteed hubi waddada cinwaankiisa iyo in server-ka DNS ee xiriirku yahay kan aad u malaynayso. NXDOMAIN waa dhibaato awood: wax baa jawaabay oo ma aqaan magaca, taasina waxay tilmaamaysaa aagga, gobolka ama resolver aan waligiis ahayn inuu weydiinta helo.
Sadarka ugu dambeeya waa kan dadku seegaan sababtoo ah labada qayboodba waxay u muuqdaan guul. Magac gaaban oo si ka duwan FQDN loo xalliyo waa iswaafaq la’aan dabo-raac, dib u xidhka tunnel-kana ma beddeli doono dabo-raaca uu macmiilku diro.
Qabso xaaladda ka hor inta aadan tafatirin fayl cabbir, si aad u sheegto haddii tafatirku wax qabtay:
resolvectl status > before.txt
getent ahosts service.internal.example >> before.txtSoco hubinnada si kala horreysan oo ku joogso tan ugu horreysa ee guuldareysta. getent iyo resolvectl query waa inay iswaafaqaan; haddii getent guuldareysto halka dig jawaabayo, ku sii jir silsiladda raadinta oo ha taaban marinka. resolvectl status waa inuu muujiyaa server DNS iyo domain marin oo ku yaal interface-ka tun. nsswitch waa in aanu goor hore ku soo noqon NOTFOUND dabo-raaca aad tijaabinayso. Magacu waa inuu awood ku leeyahay shabakadda uu dhammaadkaagu ku xiran yahay, lagu tijaabiyay dhibic dhammaadka. Barnaamijku waa in aanu haysan keyd u gaar ah ama ka-gudub DNS ammaan ah.
Hagaaji kaliya lakabka ugu horreeya ee guuldareysta, kadibna mar kale soco isla amarradaas. Laba isbeddel hal mar ah waxay kaa hor istaagaan inaad sheegto midka muhiimka ahaa, guuldarrada xigtana waxay baaritaanka ka bilaabataa eber.