Sababta Pi-hole v6 uu iska indhatiro weydiimaha DNS ee macaamiisha WireGuard

Pi-hole v6 waxa uu qaataa weydiin DNS dekedda 53 kadibna waxa uu go'aamiyaa in baakadda timid loo jawaabi karo iyo in kale. Martigeliyaha WireGuard go'aanka labaad ayaa inta badan sababta macmiilku u helo waqti-dhaaf ah halka xalliyuhu uga muuqdo mid caafimaad qaba LAN-ka. Dekeddu way furan tahay, FTL way shaqaynaysaa, haddana waxba kama soo noqdaan 10.90.0.1. Saddex waxyaabood ayaa is dhexgala ka hor inta jawaabtu bixin: dns.interface, dns.listeningMode iyo dab-damiska labadooda hortiisa.

Socket-ka dhegeysiga ma go'aamiyo cidda jawaab helaysa

FTL waxa uu furaa dhegeystayaal UDP iyo TCP dekedda 53. Habaynta caadiga ah socket-ku inta badan waa wildcard, sidaas darteed ss -lunp | grep :53 waxa uu muujinayaa 0.0.0.0:53 iyo [::]:53 iyada oo aan loo eegin in macaamiisha VPN la adeego iyo in kale. Socket wildcard waxa uu aqbalaa baakadda, ka dibna FTL waxa uu hirgeliyaa xeerarkiisa interface-ka iyo isha ka hor inta uusan jawaabin. Taasi waa sababta "dekeddu way dhegeysanaysaa" wax yar ka caddaynayso macmiilka tunnel-ka.

Akhri habaynta socota halkii aad ka akhrin lahayd faylka aad u malaynayso inuu firfircoon yahay. pihole-FTL --config dns.interface iyo pihole-FTL --config dns.listeningMode waxa ay daabacaan qiyamka dhabta ah, waxaana laga yaabaa inay ka duwanaadaan faylka martigeliyaha marka konteenar, doorsoome deegaan ama maareeyaha geynta uu leeyahay dejintaas. Tixraaca habaynta Pi-hole FTL waxa uu taxaa hababka iyo midka ku tiirsan interface-ka.

LOCAL waxa uu weydiiyaa subnetkee, SINGLE waxa uu weydiiyaa interfacekee

LOCAL, oo ah kan caadiga ah, waxa uu ka jawaabaa weydiimaha cinwaanka ishkood uu ka tirsan yahay subnet lagu habeeyay mid ka mid ah interface-yada martigeliyaha. wg0 fudud oo leh 10.90.0.1/24 ayaa mara imtixaankaas, sababtoo ah macmiilka 10.90.0.2 wuxuu ku dhex jiraa subnet-ka tunnel-ka. Macmiil la maray dhanka kale ee peer-ka, ama mid ku qarsoon NAT ka dambeeya prefix kale, ma maro, in kasta oo baakaddu wg0 timid, weydiinna kama muuqato diiwaanka.

SINGLE waxa uu beddelaa su'aasha. Waxa uu aqbalaa weydiimaha yimaada dns.interface lagu magacaabay interface-ka, oo ay ku jirto loopback, wuuna iska indhatiraa subnet-ka isha. Kaasaa waa habka ka badbaada topology VPN silsilado ah ama la maray. Labada fureyaal wada dhig, sababtoo ah hab aan interface magac leh lahayn ma aha tilmaam buuxda:

sudo pihole-FTL --config dns.interface "wg0"
sudo pihole-FTL --config dns.listeningMode "SINGLE"

BIND waxa uu beddelaa socket-ka, taasna waxa ay leedahay qiimo

BIND ma shaandheeyo socket wildcard; waxa uu dekedda 53 ku xidhaa oo keliya cinwaannada ku jira interface-ka magaca leh, sidaas darteed kernel-ku waxa uu diidaa baakadaha meel kale yimaada. Waxa uu ka adag yahay SINGLE oo ma aha isku macne. Qiimuhu waxa uu muuqdaa bilowga: haddii wg0 aanay kor u kicin marka FTL bilaabayo, laga yaabee in aan la helin cinwaan la xidho, xalliyuhuna waxa uu shaqayn karaa isagoo aan dhegeyste lahayn ilaa interface-ku soo baxo oo FTL dib u bilaabmo.

Dooro BIND marka aad xakameyso nidaamka bilowga, tusaale ahaan unug systemd oo lagu habeeyay WireGuard interface-ka ka dib, iyo marka aad rabto in kernel-ku tuuro baakadaha lumay ka hor inta FTL uusan arkini. Dooro SINGLE marka tunnel-ku yimaado oo tago, ama marka interface-ka uu abuuro qalab FTL ka dib bilaaba.

Dab-damiska waa albaabka labaad

Hab FTL sax ah wali wuu guuldarraystaa haddii dab-damiska martigeliyaha uu tuuro dekedda 53 wg0. Fasax xadka isha VPN labada borotokool, oo hayso dhinaca internet-ka oo xiran. nftables, oo leh silsiladda input ee jirta ee shaxda inet filter, xeerarku waxa ay u eg yihiin sidan:

sudo nft add rule inet filter input iifname "wg0" ip saddr 10.90.0.0/24 udp dport 53 accept
sudo nft add rule inet filter input iifname "wg0" ip saddr 10.90.0.0/24 tcp dport 53 accept

Ku dar xeerar IPv6 u dhigma haddii tunnel-ku qaado IPv6, oo hor dhig siyaasadda drop ee silsiladda. Haddii martigeliyuhu isticmaalo ufw ama firewalld, ku sheeg isla isku-dhac maareeyahaas halkii aad qalab isku qasi lahayd. Ha u gudbin dekedda 53 router-ka internet-ka; macaamiishu waa in ay tunnel-ka ku gaaraan cinwaanka VPN ee xalliyaha.

Laba waddo ayaa kala gaar ah. Weydiimaha macaamiishu waxa ay ku dhammaadaan FTL. Raadinta FTL ee kor u socota waxa ay u baxdaa sida shaxda marinada martigeliyaha, oo laga yaabo in ay isticmaasho tunnel-ka ama aanay isticmaalin, sidaas darteed xalliye jawaaba laakiin aan wax faa'iido leh soo celin waa dhibaato kor u socota. Maamulka web iyo API waxa ay dhegeystaan dekedo u gaar ah oo waxa ay u baahan yihiin xaddidaad u gaar ah.

Xaqiiji jawaabta iyo diidmada

Macmiil VPN, weydii cinwaanka xalliyaha labada borotokool: dig @10.90.0.1 example.com iyo dig +tcp @10.90.0.1 example.com. Kadib hubi diiwaanka weydiimaha ee interface-ka maamulka si aad u xaqiijiso in FTL duubay weydiinta. Waqti-dhaaf macmiil oo aan diiwaan gelin lahayn waxa uu tilmaamayaa dab-damiska ama shaandhada interface-ka; diiwaan aan jawaab lahayn waxa uu tilmaamayaa xallinta kor u socota.

Tijaabi jidka taban martigeliye ka baxsan VPN. dig @10.90.0.1 example.com waa in uu waqti-dhaaf noqdaa, iyo ss -lunp xalliyaha waa in aanu muujin dekedda 53 oo ku xidhan cinwaan dadweyne. Hal mar dib u bilow adeegga, kadib dib u bilow martigeliyaha oo xaqiiji in xalliyuhu wali jawaabayo marka wg0 mar kale soo baxo. Weydiin ku shaqaysa oo keliya ilaa dib-u-bilowga xiga ma aha isbeddel dhammaaday.