Ingabe i-VPN yakho ibethela i-DNS, noma ihopu elilandelayo kuphela?

Ukuvula i-DNS ebethelwe kuseva ye-VPN kuvame ukuchazwa njengokuvala ukuvuza, futhi leyo ncazelo ifihla ukuthi yikuphi ukuxhumana okwashintshayo. Ihopu elsuka kukliyenti liya kusisombululi kanye nehopu elsuka kusisombululi liya phezulu kuyizixhumanisi ezihlukene ezinabanikazi abahlukene. Ukubethela okunye kushiya okunye kunjalo ngqo njengakuqala.

Bhala phansi ukuthi ubani uthola umbuzo esigabeni ngasinye ngaphambi kokuthinta ifayela lokuhlela.

Amalungiselelo amabili abukeka efanayo ekhasini lezilungiselelo

Kulungiselelo lokuqala idivayisi izisebenzisa yona i-DNS over TLS, futhi umhubhe udlulisa nje lokho kuxhumana kusiya kusisombululi osikhethile. Isikhathi se-TLS siphela kusisombululi, okusho ukuthi isisombululi sibona umbuzo kanti ukuphuma kwe-VPN kubona umbhalo obethelwe elingakwazi ukuwufunda. Kulungiselelo lwesibili idivayisi ithumela i-DNS evamile ngomhubhe iya kudluliseli kuseva ye-VPN, futhi leso sidluliseli sivula ukuxhumana kwaso okubethelwe kusiya kusisombululi esiphezulu. Kuhlu lwezici zombili zibukeka njenge "i-DNS ebethelwe ne-VPN", futhi zibeka umbuzo ofundekayo emabhilidini ahlukene.

Umehluko uyalinganiseka, awuyona ifilosofi. Sesha isikhathi se-TLS kukliyenti noma kuseva, futhi uzokwazi ukuthi yiluphi ulungiselelo onalo ngempela.

Yenza imephu yochungechunge lwezisombululi ngaphambi kokulushintsha

Bala izisombululi endleleni futhi usho indima yisombululi ngasinye. Ingxenye yokudlulisela inikeza isicelo kwesinye isisombululi, kanti isisombululi esiphindayo senza umsebenzi wokuthola impendulo futhi singakhuluma ngqo namaseva anegunya. Lezi zindima zichazwe ngokwahlukene ngenxa yalesi sizathu, futhi izincazelo zezisombululi ze-RFC 9076 zifanele ukufundwa ngaphambi kokuthi ucabange ukuthi kunendawo eyodwa yokugcina ephezulu. Umsingathi osebenzisa isisombululi sakhe esiphindayo akanayo eyodwa "indawo ephezulu" yokubethela, okwenza lonke uhlelo lungasebenzi.

Bese ubuza ukuthi iyiphi ingxenye ikliyenti elilungiselelwe ukuyisebenzisa. Ikheli le-DNS elihambiswa iphrofayili ye-VPN likutshela ukuthi imibuzo iya kuphi, hhayi ukuthi iyiphi inqubo ephendulayo.

Qaphela nokuziphatha lapho kuhluleka. Uma indawo ephezulu ebethelwe ingafinyeleleki, ingabe isidluliseli sihluleka sivaliwe, sibuyela embhalweni ocacile, noma sishintshela kwesinye isisombululi? Leso sinqumo kufanele sibe semqulwini, ngoba sishintsha isiqinisekiso sobumfihlo ngesikhathi umhubhe unempilo encane kakhulu.

Qinisekisa ukuthi yiliphi ihopu elibethelwe

Qala kukliyenti bese uqinisekisa ukuthi ingabe linesikhathi se-TLS esiya kwithumba le-853. Umbuzo oxazululwa ngendlela efanele ngethumba le-53 awufakazi lutho ngokubethela.

resolvectl status | grep -E "DNS Servers|DNS over TLS"
kdig +tls +tls-ca +tls-hostname=dns.example.net @198.51.100.53 example.com A

Bese uya kuseva ye-VPN bese ufuna ukuxhumana okuphumayo okubethelwe okwavulwa isidluliseli. Ithebula lamasokhethi likutshela ukuthi ingabe kunesikhathi se-TLS esiphezulu futhi iyiphi inqubo esiphethe:

ss -tunp '( dport = :853 )'
dig @127.0.0.1 example.com A +short

Uma ikliyenti likhombisa isikhathi se-TLS kanti iseva ayikhombisi lutho, usukulungiselelo lokuqala futhi iseva ayikwazi ukufunda imibuzo eyidlulisela kusendlalelo se-IP. Uma iseva ikhombisa isikhathi se-TLS kanti ikliyenti likhombisa ithrafikhi ejwayelekile yethumba le-53 ngaphakathi komhubhe, usukulungiselelo lwesibili: ihopu elilandelayo livikekile, futhi isidluliseli sisafunda lonke igama idivayisi elibuzayo. Lowo mphumela wesibili akukona ukwehluleka, kodwa ukuwubiza ngokuthi ukubethela kusukela ekupheleni kuya ekupheleni kungalungile.

Qopha umnikazi nokuziphatha lapho kuhluleka

Ubunikazi bunquma ukuthi yini ovunyelwe ukuyithembisa. Umnikazi wedivayisi ulawula ukuxhumana okubethelwe ohlangothini lwekliyenti, kanti umlawuli we-VPN ulawula ukuxhumana okulandelayo okwenziwa isidluliseli sakhe. Noma ubani ongasebenzisi noma yikuphi kwalokhu akwazi kuphela ukuchaza indlela.

Ngaphambi kokuvula noma yini, hlola ukuqanjwa kwamagama kwangaphakathi. Ukuthumela amagama enhlangano kusisombululi somphakathi akulona idizayini elinganayo, futhi indawo ye-split-horizon ekhona ngaphakathi kwenethiwekhi kuphela ngeke ixazululwe nhlobo phezulu. Hlola igama elilodwa langaphakathi nelilodwa lomphakathi ngemuva koshintsho, bese ugcina umphumela kanye noshintsho lokuhlela. Uma indlela ebethelwe yephula ukuxazululwa kwamaseva angaphakathi, isixazululo umthetho wesisombululi onomkhawulo, hhayi umhubhe obanzi.

Qeda ngokubhala umusho owodwa ngehopu ngalinye: iyiphi ingxenye eyathola umbuzo, ingabe lelo hopu lalibethelwe, futhi ubani ongafunda igama. Uma umusho mayelana neseva ye-VPN usasho ukuthi ingafunda imibuzo, umbhalo kufanele usho njalo, ngoba umdwebo osho okuphambene uzokukholwa umuntu ongakaze asebenzise lezi ziqondiso.