Kungani impendulo ye-DNS ihluleka ku-firewall yomkhawulo we-VPN engenasimo

Impendulo engenayo yombuzo we-DNS womsingathi we-VPN ithwala imbobo yomthombo 53, hhayi imbobo yomgomo 53. Khawulela umthetho ku-solver wangempela kanye nomkhawulo osendleleni.

Umhubhe uyasebenza, amaklayenti ayafinyelela umsingathi we-VPN, kodwa umsingathi akakwazi ukuxazulula lutho. Imibuzo yakhe ephumayo ishiya isixhumi ngokuhlanzekile, ngakho ukwehluleka kusendleleni yokubuya: emkhawulweni ophezulu ohlunga ithrafikhi engenayo ngaphandle kokukhumbula okuthunyelwe umsingathi. Ukuvumela imbobo yomhubhe akukuchazi nhlobo lokho kushintshana. Impendulo yombuzo we-DNS iwukugeleza okuhlukile, futhi uma umkhawulo ungenasimo, akukho okukunikeze imvume yokubuya.

Ukushintshana okubili akukho kushintshana okukodwa

Bhala ama-tuple futhi iphutha liyacaca. Imbobo yomgomo yesicelo iba imbobo yomthombo yempendulo, okuphambene nalokho abantu abaningi abakucabangayo lapho bengeza umthetho ongenayo wembobo 53:

query:  203.0.113.10:53018 -> 198.51.100.53:53
reply:  198.51.100.53:53 -> 203.0.113.10:53018

Umthetho ongenayo odinga imbobo yomgomo 53 uchaza ithrafikhi eqondiswe kusilaleli se-DNS esisebenza kumsingathi, futhi lokho kuwumsebenzi ohluke ngokuphelele. Leyo mikhondo iyizibonelo zomdokumenti, futhi imbobo yomthombo iyasetshenziswa iklayenti embuzweni ngamunye, ngakho akulona inani ongalikopisha emthethweni bese ulindela ukuthi uzoqhubeka usebenza.

Umkhawulo ongenasimo ngokumelene ne-firewall yomsingathi enesimo

Isihlungi somkhawulo esingenasimo sihlola iphakethe ngalinye elingenayo ngokumelene nohlu lwayo lwemithetho ngaphandle kwethebula lokuxhumana ngemuva kwayo. Umbuzo ophumayo ophume ngempumelelo awudali muntu imvume yempendulo yawo engenayo, ngoba idivaysi ayinawo umbhalo wokuthi umbuzo wake waba khona. I-firewall yomsingathi enesimo iyaphambana: ukulandelela kwayo ukuxhumana kuyabona ithrafikhi ebuyayo yokushintshana okuvunyelwe futhi kuyidlulise ngaphandle komthetho wempendulo. Yomibili imingcele ikhona endleleni evamile, futhi kokubili kumele kuvumele iphakethe elihlosiwe.

Ukuqhathanisa kubalulekile ngoba amadivaysi amabili ehluleka ngezindlela ezihlukene. I-firewall enesimo ephika impendulo ibhala ukulahla; umkhawulo ongenasimo uyiphika buthule, yingakho umsingathi ugcina nje uphelelwa yisikhathi.

Akha imvume ngokuzungeza iphrothokholi, hhayi inombolo yembobo

Khawulela umthetho kumakheli angempela e-solver, kumsingathi womgomo kanye nenqubomgomo yembobo yokwamukela esekelwa umkhiqizo. Khumbula futhi indlela ye-TCP ye-DNS, ngoba impendulo enkulu noma ukuhlehla ngenxa yokunqunywa kudlulisela ukushintshana ku-TCP futhi umthetho we-UDP kuphela ngeke ukumboze. Uma umkhawulo usekela ukuhlola okunesimo kokugeleza okuchaziwe, khetha lokho esikhundleni somthetho wempendulo obhalwe ngesandla, ngoba indlela enesimo ilandela ngokuzenzakalela izimbobo ezikhethwe iklayenti.

Bese uqinisekisa ukuthi imuphi umkhiqizo osendleleni ohlunga ithrafikhi ngempela. Ububanzi bomkhawulo we-IPv4 obhalwe emdokumentini abusunguli inqubomgomo ye-IPv6, futhi ithrafikhi yangaphakathi yomhlinzeki ingase ingalokothi idlule kuleso sihlungi.

Kungani ukuvumela noma yimuphi umthombo wembobo 53 kungekona ukulungisa

Umthetho owamukela noma yini ethi inombobo womthombo 53 uwumthetho owamukela lokho okubhalwa umthumeli emkhakheni wekhanda. Inombolo yembobo ayiqinisekisi umthumeli futhi ayifakazi ukuthi umthwalo uyimpendulo evumelekile, ngakho umthetho wandisa ukuchayeka komsingathi ngaphandle kokwenza ukuxazulula kuthembeke kakhudlwana. Gcina imikhawulo yomthombo futhi gcina iziqinisekiso zempendulo zeklayenti ngokwalo, kuhlanganise nokwenziwa okungahleliwe kwembobo yomthombo, esikhundleni sokuzivala ukuze wenze uhlu lokufinyelela lula.

Uma i-solver iwusevisi oyilawulayo, ukukhawulela kumakheli ayo kwanele. Uma iyisixazululi somphakathi, khawulela kumakheli okuvumile futhi uwabhale kumazwana womthetho.

Qinisekisa emkhawulweni ofanele, endleleni efanele

Bamba kumsingathi nase mkhawulweni umbuzo ofanayo, futhi uqhathanise ama-tuple esikhundleni sezibalo zamaphakethe. Umbuzo obonakala ezinhlangothini zombili ngaphandle kwempendulo ebonakala ohlangothini lomsingathi ukhomba esihlungini esingenayo; umbuzo obonakala ohlangothini lomsingathi kuphela ukhomba ekuhambiseni noma ku-solver uqobo. Phinda ngombuzo we-TCP uma unemvume ye-UDP kuphela, ngoba yilowo msamo ongabonwa ukuhlolwa kokuqala.

Ukulungisa lokhu kuqedela ukushintshana kwe-DNS umsingathi akudinga ngempela. Akusenzi umsingathi abe isixazululi somphakathi, akuvumeli ukugeleza kwe-VPN okudlulisiwe, futhi akufakazi ukuthi i-DNS iyimbangela yanoma iyiphi inkinga yomhubhe engahlobene.

Izihloko ezihlobene