Kungani imibuzo ye-dnsmasq iphuma ku-VPN ngemva kokudluliselwa kwe-DNS

Iklayenti le-LAN lifinyelela i-VPN yalo ngendlela efanele kodwa imibuzo yalo ye-DNS isabonakala kumgudu ongaphezulu ongafanele. Lokhu akukona ukuvuza ngomqondo ojwayelekile; yilokhu okwenzeka lapho i-rotha iyeka ukudlulisa umbuzo bese iyiphendula yona. Ukungena phakathi kubhala kabusha indawo eya kusokhethi yasendaweni, bese isixazululi sivula ingxoxo yesibili, engahlobene, enekheli laso lomthombo kanye nesinqumo saso somzila. Izimpawu ezifakwe emfudlaneni weklayenti zichaza ingxoxo yokuqala futhi azisho lutho ngeyesibili.

Uphawu aluhambi nombuzo

Izimpawu zepakethe zihlala kumugqa we-conntrack nakupakethe elindizayo. Umthetho we-REDIRECT uqeda lolo kundiza: umthwalo unikezwa isokhethi yasendaweni, futhi umugqa wokuqala usuqedile umsebenzi wawo. Lokho okuphuma ku-rotha ngemva kwalokho yisokhethi entsha eyakhiwe inqubo yesixazululi, nekheli le-rotha uqobo njengomthombo.

Yingakho umzila wenqubomgomo oboshelwe ekhelini leklayenti le-LAN awusoze wafana nombuzo waphezulu. Isokhethi entsha ingeya-dnsmasq hhayi eyeklayenti, futhi i-kerneli ihlola umzila mayelana nokuhamba kwe-rotha uqobo. Imithetho yomthombo, imithetho yesixhumanisi kanye nemithetho yezimpawu konke kubona i-tuple ehlukile. Ukucabanga ukuthi uphawu luyasakazeka yiphutha elivame kakhulu kulolu hlelo, futhi alubonakali ekubanjweni ohlangothini lweklayenti.

Lezi zingxoxo ezimbili zabelana ngegama nesikhathi, futhi yikho okwenza zibonakale njengomfudlana owodwa uma ubheka ngokushesha ukubanjwa.

Lapho ukudlulisa kuphenduka ukuxazulula kwasendaweni

Qala ngokuthola ukuthi umgudu 53 uyadluliselwa, uhunyushwa uya kwesinye isiphethi, noma ushiywa njengoba unjalo, ngoba lezi zimo ezintathu ziziphatha ngendlela ehlukile. Ukudlulisela kumgudu wasendaweni kuqeda ukudlulisa, kuyilapho ukuhumushela kumshini omunye kugcina ipakethe ihamba futhi kugcina i-tuple yeklayenti inencazelo.

Bheka zombili izivumelwano. Isixazululi esifinyeleleka nge-UDP ne-TCP sizohlolwa kukho kokubili, futhi isethi yemithetho ehlanganisa kuphela i-UDP ishiya imbobo ethule yezimpendulo ezinkulu. Imithetho ekhiqizwa umphathi wokuhlela we-rotha uqobo nayo iyabalwa, futhi ukuhlela ifayela elikhiqiwe ngokuvamile kwehlulwa ukulayishwa kabusha okulandelayo.

sudo nft list ruleset | grep -n -B2 -A4 'dport 53'
sudo iptables -t nat -L -n -v | grep -E ':53|dns'
sudo ss -lunp | grep ':53'

Lokho okuphumayo kuphendula imibuzo emithathu ngokulandelana: yini ebhala kabusha umbuzo, yini eyamukelayo, nokuthi iyiphi inqubo ephethe isokhethi elalelayo. Uma umnikazi esaziwa, inqubomgomo yaphezulu inendawo yokuhlala.

Nika isixazululi inqubomgomo yaso yokuphuma

Umgudu waphezulu oqondene nesizinda uyithuluzi elihlanzekile kakhulu uma kungamagama ambalwa kuphela adinga umhubhe. I-dnsmasq yamukela umugqa we-server oboshelwe esizindeni, ngesixhumanisi noma ikheli lomthombo elingakhethwa elikhipha umbuzo ngaphandle kwedivayisi ekhethiwe. Yikho lokho kuqondisa okwenza ingxoxo yesibili ilandele i-VPN.

server=/corp.example/10.30.0.53@tun_work
log-queries

Isizinda, ikheli nesixhumanisi esingenhla kuyizindawo zokubamba zamazinga akho. Ukukhetha isizinda nokulawula ukuphuma kusalokhu kuyizinqumo ezihlukene: umzila kufanele ube khona, ikheli lomthombo kufanele livunyelwe isixazululi saphezulu, futhi i-firewall kufanele ivumele impendulo. Ukuqondisa ngesixhumanisi kuphela akusilo i-fail-closed, ngoba umhubhe onyamalalayo ungashiya isixazululi siwela komunye umzila. Gcina noma yikuphi ukubuyela emuva komphakathi kude nesikhala samagama okufanele sihlale siyimfihlo.

Beka umugqa kumnikazi wokuhlela owedluliselwa yi-rotha hhayi efayeleni elikhiqiwe, uma kungenjalo ukulayishwa kabusha okulandelayo kuzosula ukulungiswa.

Lokho isilondolozi esabiwe esingakugcini

Isidlulisi esisodwa esinesilondolozi esisodwa sisebenzela wonke iklayenti le-LAN, futhi lokho kubhidliza umehluko odingwa ezinye izimboni zokuxhumana. Uma amaklayenti amabili kufanele axazulule igama elifanayo ngendlela ehlukile, isokhethi ebiwe ayinayo indlela yokubuyisa ukuthi yiliphi iklayenti elibuzile. Inqubomgomo yeklayenti ngalinye kufanele ihlale ezingxenyeni ezihlukene zesixazululi noma esicini sokudlulisa esigcina ubunikazi.

Impendulo egciniwe nayo ayibona ubufakazi ngomzila omusha. Impendulo ingavela enkumbulweni kuyilapho umzila waphezulu usagqekezile.

Imithetho yomgudu 53 ayisho lutho ngamaphrogu akhuluma i-DNS nge-HTTPS noma nge-TLS. Leyo mibuzo ayifiki ekudluliselweni, ngakho inqubomgomo eyakhiwe kumgudu 53 kuphela ichaza isethi encane yokuhamba futhi kufanele ibhalwe njengesethi encane.

Qinisekisa ingxoxo yesibili, hhayi eyokuqala

Hlola ngegama elilodwa olilawulayo bese ubheka izinhlangothi zombili. Ukubanjwa ohlangothini lweklayenti kufakazela ukuthi umbuzo washiya i-LAN; uhlangothi lwe-rotha kuphela olufakazela ukuthi waya kuphi ngemva kwalokho.

sudo tcpdump -ni tun_work udp port 53
ip route get 10.30.0.53
dig +short corp.example @10.30.0.53

Sula isilondolozi ngaphambi komzamo ngamunye, ngoba impendulo efudumele ifihla umgudu waphezulu ogqekezile. Phinda nge-TCP, bese uphinda ngomhubhe uvaliwe ukuze ubone okwenziwa isixazululi uma umzila waso owuthandayo ungekho. Yikho lokho kuziphatha kokugcina okunquma ukuthi umklamo uyi-fail-closed noma uyinenhlanhla nje.