I-DNS ayixazululi lapho i-kill switch ye-VPN ivimbela i-port 53
I-kill switch ingavimbela i-DNS ngamabomu. Qhathanisa ukuxazululwa ngaphakathi komhubhe kuphela nomhlobo womxazululi wendawo, bese uthola ukuthi iluphi ungqimba lwehlulekile ngempela.
Lapho i-kill switch iwisa umhubhe, ihamba nayo indlela ye-DNS, futhi umxazululi osele ngokuvamile akusiyena lowo owulindele. Izakhiwo ezimbili zibhekana naleso sikhathi ngendlela ehluke kakhulu: ukuvimbela wonke amaphakethe e-DNS angekho ngaphakathi komhubhe, noma ukushiya umxazululi owodwa umi njengomhlobo. Kokubili kuyavikeleka. Kusuka kuthebhu yesiphequluli izimpawu zibonakala zicishe zifane, ngakho umsebenzi wokuqala ukuthola ukuthi yiluphi uhlobo lwezakhiwo olusebenzisile ngempela.
Ngigcina lowo mehluko phambi kwami ngoba ukulungisa kuphambene esimweni ngasinye. Uhlobo olulodwa ludinga umhlobo obanzi, olunye ludinga omncane. Ukuqagela kukubiza imfihlo noma ingxenye yosuku.
Izakhiwo ezimbili ze-DNS zenkinga eyodwa
Uhlobo A luthatha umxazululi njengenye insizakalo engemuva komhubhe. Imithetho ye-firewall ivumela i-UDP ne-TCP 53 kuphela kusixhumi somhubhe, futhi ikheli elinikezwa iklayenti umxazululi ongaphakathi komhubhe. Lapho umhubhe uwela, ukusesha kuyama, futhi lowo umphumela ohlosiwe, hhayi iphutha.
Uhlobo B lugcina umxazululi ufinyeleleka kunethiwekhi yendawo, ngokuvamile i-router ku-192.168.1.1 noma i-stub yohlelo lokusebenza ku-127.0.0.53, ngesizathu sokuthi ukuxazululwa kwamagama akufanele kufe nomhubhe. Kuyalula ku-LAN yasekhaya lapho i-router ixazulula khona indlu yonke. Ku-Wi-Fi yasehhotela noma yesikhumulo sezindiza lowo mhlobo ukhomba kuseva yomunye umuntu, futhi lonke igama olibhalayo liyadalulwa, nakuba ithrafikhi yakho yewebhu ihlala ivinjiwe.
Umngcele ukuthi umxazululi ngowakabani. Uma uthemba owendawo, umhlobo uwumgodi omncane nothembekile. Uma ungathembi, uhlobo lomhubhe-kuphela ukuphela okuma, futhi intengo ukuthi umhubhe owile uthatha wonke amagama.
Kungani ukusesha kweklayenti le-VPN uqobo kusasebenza
Iklayenti kufanele lixazulule igama lomsingathi wegedi ngaphambi kokuba umhubhe ube khona, ngakho ukuvimbela okuqinile akufanele kugubuzele indlela yokuqalisa yeklayenti. Iningi lamaklayenti lihlala ligcina ikheli lendawo yokugcina kusilondolozi noma linikeza umhlobo wokuqalisa obhaliwe walowo msingathi oyedwa. Uma isethi yemithetho yakho ivimbela lokho kusesha, umhubhe awusoze wabuya futhi amalogi akhombisa iklayenti elingakwazi ukufinyelela iseva yalo, okuwukukhubazeka komgomo hhayi kwe-DNS.
I-DNS ehlukanisiwe iyindawo yesibili lapho lokhu kubonakala khona. Iklayenti lihudulela indawo yangaphakathi kumxazululi oyimfihlo bese lishiya konke okunye kumxazululi wohlelo. Ngemva kokuwa, amagama omphakathi kungenzeka asaxazululeka kuyilapho awangaphakathi ephelelwa yisikhathi, ngoba indawo eyimfihlo ayisenayo indlela. Kumsebenzisi lokho "i-VPN yephule i-inthanethi"; kumlogi yomxazululi lokho umbuzo ongakaze ufike.
Ngaphansi kwe-systemd-resolved ungabona ukuhlukaniswa ngqo. resolvectl status ibala amaseva e-DNS ngesixhumi ngasinye kanye nezizinda zomzila, futhi ngemva kokuba umhubhe wehle isizinda sangaphakathi siqhubeka sikhomba kuseva esixhumini esingasekho. I-stub ku-127.0.0.53 isawamukela umbuzo, bese ilinda umfudlana ophezulu ongeke uphendule, yingakho ukwehluleka kuthatha amasekhondi esikhathi eside esikhundleni sokubuya ngokushesha.
I-DNS ebethelwe ayidluli isihlungi samaphakethe
I-DNS over HTTPS ne-DNS over TLS zihamba ku-443 no-853, ngakho umthetho ovimbela i-port 53 awushongo lutho ngazo. Ukuvimbela "i-DNS" nge-port umgomo mayelana ne-port, hhayi mayelana nokuxazululwa kwamagama. Uma i-kill switch yakho ivimbela yonke ithrafikhi ngaphandle komhubhe, i-DoH ivinjelwa ngesikhathi esingahlosiwe. Uma wenzile umhlobo we-captive portal noma umxazululi womphakathi, ayivinjeliwe.
Izilawuli zohlangothi lweklayenti ziyisigxobo esishibhile. I-Firefox iyeka umxazululi wayo we-DoH lapho igama le-canary use-application-dns.net lingaxazululeki, yingakho amanethiwekhi aphethwe eshicilela leso sizinda njenge-NXDOMAIN; umgomo webhizinisi ungaphinda uwubophele uvaliwe. I-Android Private DNS ne-DNS ephephile ye-Chrome zinezokushintsha zazo kanye namavelu azo okuzenzakalela. Ukuzivala kuthembeke kakhulu kunokujaha amakheli omxazululi, ngoba uhlu lwamakheli luyashintsha futhi isethi yakho yemithetho ayishintshi.
Kukhona inguqulo yalokhu engakhulumi nhlobo ngokuvuza. Uhlelo olunomxazululi oboshiwe lusadinga indlela yenethiwekhi ukuze lufinyelele kuwo. Ukubethela kushintsha ukuthi ubani angafunda umbuzo, hhayi ukuthi iphakethe lingaphuma emshinini, ngakho ukuvimbela idivayisi yonke kunqoba isilungiselelo ngaphandle kokusithinta.
Hlanganisa isibonakaliso nongqimba
Iningi lemibiko lifika njengomusho owodwa, futhi lowo musho uvamise ukusho ungqimba kakade. Ithebula elingezansi yilokho engikudlulayo ngaphambi kokuthinta umthetho; inhloso ukunquma ukuthi umbuzo wavinjelwa, waqondiswa kabi noma awuzange uthunyelwe.
| Symptom | Likely layer | First check |
|---|---|---|
| Every name fails at once, instantly | Resolver answering with a refusal | Query the resolver by address, not by name |
| Lookups hang for seconds, then time out | Packets dropped with no response | Watch port 53 on the physical link |
| Public names resolve, internal ones do not | Split-DNS routing domain | Per-link DNS servers on the tunnel |
| Names resolve, the page still fails | Not DNS: routing or MTU | Connect to the IP directly |
| Only one application fails | Pinned resolver or cached answer | Check that app's DNS setting |
Imigqa emibili yokuqala yiyona abantu abayihlola kabi. Ukuwa buthule nokwenqaba kokubili kubonakala njengokuthi "i-DNS iphukile" kusiphequluli, kodwa kukodwa kuphela okusho ukuthi i-kill switch yakho yenza umsebenzi wayo. Ukwenqaba kusho ukuthi kukhona okuphendulile, ngakho ukuvimbela akukho lapho ucabanga khona.
Buyisela umgomo womxazululi, bese uwufakazela
Lungisa uhlobo, hhayi isibonakaliso. Ekuxazululweni komhubhe kuphela, vumela u-53 kusixhumi somhubhe, sunduzela umxazululi wangaphakathi kanye nokucushwa komhubhe, futhi ushiye isixhumi somzimba singenaso isimvume se-DNS. Ku-wg-quick umugqa DNS = yiwona obhala umxazululi ekucushweni kwesixhumi, ngakho umhubhe oshiya lowo mugqa ushiya umxazululi omdala endaweni yawo futhi wonke umbuzo uthatha indlela engalungile. incwadi ye-wg-quick ibhala lokho kuziphatha ngeplathifomu ngayinye.
Bese uqinisekisa ngalokhu kuhleleka. Ku-Linux resolvectl status kukhombisa isixhumi esisebenzayo, dig +short example.com kuhlola igama lomphakathi, dig @10.8.0.1 internal.example.com kuhlola elangaphakathi, futhi sudo tcpdump -ni any port 53 kukhombisa ukuthi imaphi amaphakethe asebenzisa isixhumi ngesikhathi usebenzisa kokubili. Ku-Windows Get-DnsClientServerAddress -AddressFamily IPv4 futhi Resolve-DnsName example.com kunikeza amaqiniso amabili afanayo: ubani ocushwe futhi ubani ophendulayo.
Qeda ngokuhlola okungalungile. Nqamula umhubhe, qinisekisa ukuthi igama lomphakathi elisha liyahluleka, qinisekisa ukuthi igama langaphakathi liyahluleka, futhi qinisekisa ukuthi awekho amaphakethe e-port 53 aphume ku-adaptha yomzimba. Ukuvimbela okuma kuphela ezimpendulweni ezigciniwe akumi nhlobo.
Uhlu lokuhlola ngaphambi kokuvala ithikithi:
- Umxazululi osetshenziswe ngesikhathi senkinga yiwona ohloswe umgomo.
- Ukusesha kwendawo yokugcina kweklayenti uqobo kusavunyelwe, ngesilondolozi noma ngomhlobo.
- I-DoH ne-DoT zivinjeliwe noma zivaliwe ngumgomo.
- Izizinda eziyimfihlo ziyahluleka zivaliwe, hhayi zivulekile, lapho umhubhe ungekho.