Amarekhodi e-resolver ye-DNS namarekhodi okuxhumana kwe-VPN: yini egcinwa yiwo wonke
I-resolver ibhala amagama ecelwe ukuba iwaphendule; i-VPN ibhala izehlakalo zomhubhe kusukela ekusetshenzisweni kwayo. Inqubomgomo eyodwa yokugcina ayiyihlanganisi enye.
Irekhodi le-resolver ye-DNS nerekhodi lokuxhumana kwe-VPN kokubili amarekhodi enethiwekhi, kokubili awusizo futhi awakwazi ukushintshana. I-resolver ithola amagama ecelwe ukuba iwaphendule. Iphelo le-VPN liphatha ukuxhumana komhubhe futhi libhala noma yini ekusetshenzisweni kwalo ekukhethe ukuyibhala ngakho. Zingaba sesakhiweni esisodwa, ziqhutshwe yiqembu elilodwa futhi zihlanganiswe isaziso sobumfihlo esisodwa, futhi zisachaza izehlakalo ezahlukene ngobunikazi obuhlukene nokugcinwa okuhlukene. Ukufunda enye njengokungathi ngenye kuyona ndlela imibuzo ehamba ngayo iphutha.
Amarekhodi amabili, izehlakalo ezimbili
Ukungena kwe-resolver kuphendula umbuzo mayelana nokuqanjwa kwamagama: leli klayenti licele leli gama ngalesi sikhathi, futhi impendulo kwakungu lena. Ukungena kwe-VPN kuphendula umbuzo mayelana nokuxhumana: leli qembu lalisungula noma lalahlekelwa umhubhe, lanikezwa leli kheli, futhi ladlulisa cishe leli nani ledatha ngaphambi kokunyamalala. Akukho kokubili okuyirekhodi yalokho umsebenzisi akwenza ngaphakathi kwesikhathi se-HTTPS, futhi akukho okushintsha okunye.
Lo mehluko unomphumela ongokoqobo eziqagelweni. Isitatimende sokuthi umhlinzeki we-VPN akabhalisi umsebenzi womhubhe asisho lutho nge-resolver ayinikezayo, futhi inqubomgomo yokugcina ye-resolver ayisho lutho ngokuthi ubani oxhumane nomhubhe. Isimangalo ngasinye singesomqhubi waso kanye nohlelo lwaso.
Landela umbuzo ngaphambi kokufunda noma yimuphi umrekhodi
Umbuzo ufika ku-resolver kuphela uma indlela iwubuza ngempela. Uhlelo lokusebenza lungasebenzisa i-resolver yohlelo lokusebenza, lusebenzise iklayenti le-DNS elibethelwe lalo, noma lifunde impendulo egciniwe futhi lingathumeli lutho. Ngakho irekhodi le-resolver elingabonisi lutho akulona ubufakazi bokuthi igama alikaze lisetshenziswe; ubufakazi bokuthi le resolver ayibuzwanga.
resolvectl status
dig @127.0.0.53 build.corp.example +qr
journalctl -u systemd-resolved -n 20 --no-pagerLowo myalo wokugcina ufunda incwadi yerekhodi ye-resolver yasendaweni uqobo, okungafani nerekhodi leseva ephezulu. Uma imibuzo yakho iphuma nge-DNS over HTTPS iya kumhlinzeki, i-stub yasendaweni ingase ingabonisi lutho kuyilapho umhlinzeki unerekhodi eliphelele, futhi umhlinzeki ungumqhubi ohlukile onenqubomgomo ehlukile.
Irekhodi ngalinye lingakhombisa ini futhi lingakwazi ukukhombisa ini
| Record | Typically shows | Does not show |
|---|---|---|
| Resolver log | Queried name, client address, time, response | Which page was fetched, or what the tunnel did |
| VPN connection log | Peer identity, assigned address, connect and disconnect times, volume | Which name the application asked for |
| Application or proxy log | Requests, status codes, sometimes full URLs | Resolved addresses for every dependency |
Ukwihlanganisa umsebenzi wangempela, futhi ukuhlanganyela akwenzeki njalo. I-resolver ebhala amakheli amaklayenti ingaqhathaniswa ne-VPN enikeza amakheli avela echibini elaziwayo, futhi lokho kuqhathanisa kudala ukuxhumana okunengqondo phakathi kwegama elibuziwe nomhubhe, okuhlala kuyikuxhumana phakathi kwamarekhodi amabili hhayi irekhodi lomuntu.
I-DNS ebethelwe ishintsha ukuthutha, hhayi ukubonakala endaweni yokugcina. I-resolver isathola umbuzo ekuwuphendulayo, njengoba RFC 8484 kucacisa, futhi ukugcinwa kuleyo resolver isinqumo senqubomgomo hhayi isici somthetho wokuxhumana.
Lapho i-DNS ehlukanisiwe namakhashi kudida indaba
Ama-resolver amaningi kuyinto evamile. Idizayini ye-DNS ehlukanisiwe ithumela amagama angaphakathi kuseva yangaphakathi futhi konke okunye kuseva yomphakathi, ngakho uphenyo olulodwa lungabandakanya amarekhodi amabili angakaze ahloselwe ukuhlanganiswa kanye nezilungiselelo ezimbili zokugcina ezingakaze zihloselwe ukuqhathaniswa. Ukubona imibuzo kukho kokubili ubufakazi bokuthi idizayini iyasebenza, hhayi ubufakazi bokuvuza.
Amakhashi asika ngakolunye uhlangothi. Igama elidume kakhulu lingaphendulwa lisuka kukhashi amahora amaningi, ngakho irekhodi le-resolver likhombisa umbuzo wokuqala bese lingakhombisi lutho, kuyilapho uhlelo lomsebenzisi luqhubeka nokuxazulula igama elifanayo ngenjabulo. Ukungabikho kokungena ngemuva kwesikhathi esithile akusho ukuthi akekho owasebenzisa igama ngemuva kwaleso sikhathi.
Ithrafikhi yangemuva ingukuhlanekezela kwesithathu. Ifoni exazulula igama le-telemetry ngesikhathi sokuqala, isiphequluli esixazulula isizinda sesiphakamiso sokusesha, nesibuyekezi esixhumana njalo ngehora konke kuvela kurekhodi le-resolver eceleni kwegama okukhathazayo ngempela. Umthamo kulelo rekhodi akukona ukunaka, futhi ukubala imibuzo akukona ukubala ukuvakasha. Irekhodi le-resolver liyirekhodi yemibuzo, futhi imibuzo ishibhile ukuyidala.
Buza imibuzo yokugcina ngokwehlukana
Kuhlelo ngalunye, buza imibuzo emithathu: ubani oqoqayo, ini okuqoqwayo, futhi isikhathi esingakanani okugcinwa sona. Bese ubuza ukuthi ubani angakwazi ukuyifunda nangaphansi kwayiphi inqubo. Ingxoxo ye-RFC 8484 nge-DNS over HTTPS iyisikhumbuzo esihle sokuthi ukuthutha okubethelwe akususi iphelo, futhi imibhalo yomqhubi uqobo iyisitatimende esisodwa esithembekile mayelana nalokho okugcinwa yilelo phelo.
Uma kwenziwa isimangalo ngobumfihlo nge-“VPN”, yihlukanise ngezingxenye ngaphambi kokuyamukela: umqhubi womhubhe, i-resolver enikezwa umhubhe, noma iyiphi i-resolver ephezulu efinyelelwa yileyo mibuzo, kanye nezinhlelo ezisemthini. Ngasinye sinempendulo yaso, futhi isimangalo esinembile kwesinye siphinda senziwe njalo sengathi sihlanganisa zonke ezine.
Ukuze uxazulule izinkinga, sebenzisa ukwehlukanisa okufanayo. Buza ukuthi yiluphi uhlelo olwenza umbuzo nokuthi iyiphi i-resolver eyaphendula, bese bheka irekhodi elinomnikazi wangempela waleyo zehlakalo. Ukuqagela kusuka kwelinye irekhodi konga umzuzu futhi kubiza intambama.