Izimpendulo ze-AdGuard Home WireGuard Amaklayenti Avela Ekhelini Lakho le-LAN

Umhubhe usuphakeme, i-firewall ivumela iphothi 53, i-AdGuard Home iyasebenza, kodwa amagama asenqanyuliwe kumaklayenti we-WireGuard. Umbuzo uhlala ufika futhi impendulo ivamise ukuphuma, ngakho ukubalwa kwamaphakethe kumphenduli kubukeka kuphilile futhi insiza ibukeka ingenacala. Okuphuma phutha ikheli lomthombo kuleyo mpendulo: liphuma ekhelini lendawo iklayenti alikucelanga, futhi umphenduli wama-stub wekhasimende ulihlanza. Uhlu olulodwa kusethulo se-AdGuard Home luyinqumo ngalokhu, futhi ukukhethwa okujwayelekile kudlulisa isinqumo ku-kernel.

Umbuzo ifika, impendulo iphuma kwenye indawo

Ikhasimende elihlelwe nge-10.6.0.1 njenge-resolver yalo lithumela imibuzo ye-UDP ku-10.6.0.1 port 53. Lelo pakethe lidlula ngaphesheya kwe-tunnel lifike kumshini, futhi i-AdGuard Home liyaphendula. Nokho, entanjeni, impendulo iyipakethe entsha elikheli laso lokuqala likhethwa yi-stack yomshini, hhayi ngalokho okulindelwe ikhasimende.

Lapho i-resolver yekhasimende iyisokhethi exhunywe, okuyinto esetshenziswa yi-systemd-resolved, dnsmasq kanye nazo zonke izixazululo eziningi ze-stub, yamukela kuphela izimpendulo ezivela okukheli ngqo yokuthumela. Impendulo evela ku-192.168.1.10 kumibuzo ethunyelwe ku-10.6.0.1 iyakashelwa ngaphambi kokuba kube nokuhlaziywa. I-resolver ibhala impendulo ephumelelayo, ikhasimende libhala isikhathi sokuphela, futhi bobabili bathembekile.

Ngakho-ke ama-counters akhohlisi futhi iklayenti nalona alikhohlisi. Ubufakazi obudingayo busezindaweni ezintathu, ngokulandelana kwalokhu: ikheli okumele lihlale kulaleli lalo, umzila i-kernel ezosebenzisa ukubuyela eklayentini, kanye nekheli lomthombo eliphepheni lokuphendula langempela.

Indlela i-kernel ekhetha ngayo umthombo wokuphendula

I-UDP socket eboshelwe ku0.0.0.0ayinayo ikheli lomthombo eliyiyo, ngakho-ke ukuphendula ngakunye okuqhamukayo kubangela ukubheka umzila wendawo okuya kuyo. I-kernel bese ithatha umthombo kulowo mzila: ikheli eliboshwe ngumzila, noma ikheli eliyinhloko lesixhumi esiphumayo. Akukho lutho mayelana nekheli lendawo ephenywayo elikhunjulwayo.

Kumshini owodwa kuphela lokhu akubonakali, ngoba kunempendulo eyodwa kuphela engaba yiyo. Kumshini onekheli le-LAN, ikheli le-WireGuard nekheli lokuphatha, izimpendulo eziningana zingaba yizo, futhi owaphumelela kuncike kuthebula lokudlulisela ngalowo mzuzu. Engeza umzila owengeziwe, ikheli lesibili kuleso sixhumi, i-NAT redirect phambi komxazululi, noma usebenzise i-AdGuard kukhontena enegama lesikhala sayo siqu, futhi umthombo okhethiwe ungahluka kulowo okwenziwe ngamaklayenti.

ss -lunp | grep :53kukhombisa ukuthi usemidlalweni enjani. Umamukeli ku-0.0.0.0:53uyimeko ye-wildcard; umamukeli ku-10.6.0.1:53usubeke impendulo. Ukufunda isokethi kushesha kune ukufunda i-YAML, futhi kubonisa lokho okusebenzayo ngempela kunalokho okulondolozwe okokugcina.

Lokho i-bind_hosts iqondise ngempela

I-AdGuard Home'sdns.bind_hostsyiluhlu lwamakheli endawo alusetshenziswa umamukeli we-DNS. Okuzenzakalelayo okutshalwe kumphakeli kuyisikhala esijwayelekile, okusho ukuthi yamukela kuwo wonke amakheli endawo futhi ivumele i-kernel ukukhetha umthombo ngokuphendula ngakunye. Ukushintsha isikhala esijwayelekile ngamakhheli lapho amaklayenti ebuzisa khona kushintsha i-sokethi, futhi nakho kushintsha ikheli lomthombo kuwo wonke impendulo.

Lolu hlu lungabamba okungaphezu kokukodwa, okubalulekile kumxazululi osebenzela amanethiwekhi amabili. Ukubala10.6.0.1kanye192.168.1.10kunikeza ama-sokethi amabili axhunywe, futhi umbuzo ofika kunoma iyiphi yokubili uphendulwa ngamakheli afikile kuyo. Yilokho ukuziphatha okucatshangelwayo ukuthi isikhala esijwayelekile sesivele sinikeza.

I-YAML ilula, futhi ikheli elikuyo yilona amaklayenti edivayisi yakho yethunela abatshelwe ukulisebenzisa, hhayi ikheli eliyinhloko lehosti:

dns:
  bind_hosts:
    - 10.6.0.1
  port: 53

Kungani ukufakwa okuphindwe kabili komxazululi okukodwa kungavumelani

I-plugin-managed, kulesi simo, kusho ukuthi i-resolver ifakwe futhi ilawulwa enye iphakheji: iphakheji yesofthiwe ye-router, iphakheji ye-NAS, noma i-add-on yokuzilawula kwekhaya. Le phakheji ngokuvamile ithumela ikhophi yayo ye-YAML ye-AdGuard Home futhi iqala kabusha inqubo ngokwesheduli yayo, kanti isitshalo esizimele yibhayineri noma i-container yomthengisi oyilungisayo ngokwakho. Noma yikuphi, ubheka izinqubo ezimbili ezizimele nezifayela zokumisa ezihlukene nezinketho zokubopha ezihlukene, noma zombili zifunda uhlu olufanayo lwangaphambili nohlu lwezihlungi olufanayo. Omunye angaqhagamshela ikheli lohambo oluthile kanti omunye uthola i-wildcard, futhi isikhombimsebenzisi sewebhu sibukeka sifana noma ngabe ukubuka kuphi.

Yikho-ke ukuthi "isixazululo esifanayo sasisebenza ngaphambi kokudluliswa" akukhombisi lutho mayelana nokunamathela kwamanje. Hlola isokhethi, bese uhlole ifayela lomyalo esewusebenzisa ngempela. Ikhophi endala kwenye ifolda yisizathu esivamile sokuthi ukuhlela kubonakale kungaphumeleli.

Qinisa, bese uhlola ohlangothini lwe-tunnel

Shintshabind_hostskuya ekhelini le-tunnel, qala kabusha insiza, bese uqinisekisa ukuthi isokhethi ishintshe:ss -lunp | grep :53kufanele manje ibonise10.6.0.1:53futhi ingenayo i-wildcard. Uma kusabonakala0.0.0.0,inqubo esebenzayo ayifundi ifayela olilihlelile.

Bese uhlola ohlangothini lwekhasimende, ngoba yilona kuphela uhlangothi olubalulekile. Umbuzo one-dig @10.6.0.1 example.comusebenzisa umzila umsebenzisi owusebenzisa, futhi ukuqoqa kudivayisi esihostini netcpdump -ni wg0 udp port 53bonisa ikheli lomthombo wempendulo kunkabazwe. Qhathanisa nalo nekheli elisesimeni sokuxazulula sekhasimende; uma lifana, isikhathi sokulinda siyayeka ukuba yimfihlakalo.

ip route get 10.6.0.2kuchaza noma yimuphi umehluko osele, ngoba kuphrinta isikhombimsebenzisi nomthombo umsingathi azosebenzisa ukubuyela kukhasimende. Uma lowo mphumela ubiza isikhombimsebenzisi se-LAN, ukushintsha kokubopha akusiwo wonke umumo futhi itafula lokudlula izindlela liyinto elandelayo okufanele ifundwe.

Lokho isethulo sokubopha esingakwazi ukusilungisa

Ukubopha umsakazi akulungisi uhlu lokufinyelela olushiya ngaphandle i-tunnel subnet, umthetho womlilo ovumela ukubuzwa kodwa ungavumeli impendulo, noma indlela elahlekile ebuya e-WireGuard pool. Lezi zehluleka ngaphambi noma ngemuva kwekheli lomthombo, futhi ngayinye inabanikazi abahlukile.

Futhi akushintshinokuthi iyiphi i-resolver ephambili edlulisela kuyo, noma ukuvikelwa kokubopha kabusha kwenqaba impendulo yangasese yegama eliyimfihlo, noma indlela iklayenti elisebenzisa ngayo izizinda zalo zokusesha. Lezo ziyi-controles ezihlukene. Shintsha ikheli lokubopha uma umthombo wokuphendula ungamanga, futhi shintsha okuthile okunye uma kungenjalo.