Ukuhlela i-resolv.conf akulungisi i-DNS ngemva kokunqamuka kwe-VPN

Unqamula i-VPN, i-ping 1.1.1.1 isaphendula, futhi konke ukubheka kwegama kulenga ngaphambi kokuba ikhasi linikeze ngokuphelele. Bese kuthi i-cat /etc/resolv.conf ikhombise iseva yamagama eyayike yaba khona ngaphakathi komhubhe kuphela, ngokuvamile eyokuqala ohlwini. Ukususa lowo mugqa kubonakala kukulungisa imizuzu engaba yishumi, kuze kube ukulala, ukuzulazula kwe-Wi-Fi noma ukuqala kabusha kuyibuyisela. Ifayela olihlelile akusona isilungiselelo; kuwumbukiso wesimo sesixhumanisi esiphethwe enye ingxenye.

Kungani ingxenye eyodwa endala ibiza amasekhondi ekubhekeni ngakunye

Isixazululi se-glibc sihamba ngohlu lwamaseva amagama ngokulandelana futhi silinda isikhathi esithile sokulinda ngaphambi kokuzama okulandelayo, futhi resolv.conf(5) sinciphisa lolo hlu lube izingxenye ezintathu. Beka isixazululi sohlangothi lomhubhe njenge-10.8.0.1 phezulu ngemva kokuba umhubhe unyamalele, futhi ukubheka ngakunye kukhokha isikhathi sokulinda ngaphambi kokuwela kuseva ephendulayo. Yikho lokhu okwenza uphawu lubonakale njengokuxhumana okufile hhayi iphutha le-DNS: iziphequluli ziyavinjwa, ziphelelwe yisikhathi futhi ngezinye izikhathi zinikeza ikheli eligciniwe elizoguga kamuva.

Lokhu futhi kuchaza ukuthi kungani isikhalazo siza njenge-«intanethi yephukile». I-ping ekhelini le-IP ibonisa ukuthi isixhumanisi silungile, okwenza iphutha libonakale njengelohlelo. Uhlu lwezixazululi yinto yokuqala okufanele ifundwe ninto yokugcina okufanele ihlelwe.

Inganekwane: i-resolv.conf iyifayela lezilungiselelo

Buza ukuthi leyondlela iyini ngempela ngaphambi kokuyishintsha:

ls -l /etc/resolv.conf
readlink -f /etc/resolv.conf

Kumkhathi one-systemd-resolved kuyisixhumanisi esingokomfanekiso esiya kufayela le-stub elikhomba ku-127.0.0.53, futhi amaseva angempela ahlala esimweni sesixhumanisi ngasinye esikhonjiswa i-resolvectl. Kumkhathi one-NetworkManager kungase kube yifayela elibhalwa i-NetworkManager isuka ekuxhumaneni okusebenzayo. Kwamanye amaklayenti abathengisi kuyifayela elivamile elibhalwa kabusha endaweni lapho kuxhunyaniswa futhi, uma ungenhlanhla, lingalokothi libuyiselwe lapho kunqanyulwa. Laba bangabanikazi abathathu abehlukene, futhi ukuhlela ababili bokuqala ngesandla kungase kungenzi lutho noma kuhlale kuze kube umcimbi olandelayo wenethiwekhi.

I-resolvectl status iwumbono otshela iqiniso: amaseva e-DNS ngesixhumanisi ngasinye, izizinda zomzila kanye nokuthi isixhumanisi somhubhe sisekhona yini. I-resolvectl query example.com iya phambili futhi ikhombisa ukuthi iyiphi i-interface ephendulile. Sebenzisa kokubili ngaphambi kokuthinta ifayela, futhi khumbula ukuthi isiphequluli esine-DNS yaso evikekile sizishaya indiva zonke lezi.

Thola umnikazi ngaphambi kokuhlela noma yini

Ngokuvamile izingxenye ezintathu ziqhudelana ngokulungiselelwa okufanayo: i-systemd-resolved, i-NetworkManager kanye nalokho okufakwe iklayenti le-VPN. Qala ngokuhlonza esiphilayo:

systemctl is-active systemd-resolved
nmcli connection show --active
ps aux | grep -E "openvpn|wg-quick|vpn"

Uma i-resolved isebenza futhi isixhumanisi esingokomfanekiso sikhomba ku-stub yaso, ifayela lomhlaba wonke liwukukhipha okukhiqiziwe futhi ukuhlela kwakho kungokweso. Uma i-NetworkManager ingumnikazi wokuxhumana, amaseva angawephrofayela yokuxhumana, ngakho ukulungiswa ukushintsha impahla nge-nmcli hhayi ukuhlela ifayela. Uma i-daemon yomthengisi isebenza, yindlela yayo yokubuyisela kuphela ephila ngokuxhumana okulandelayo.

Hlanza isimo sesixhumanisi esishiywe iklayenti

Iklayenti elibulewe alikwazi ukugijima ingwegwe yalo yokuhlanza. I-SIGKILL ayibanjwa neze, kuyilapho i-SIGINT ne-SIGTERM zibanjwa, ngakho umhubhe «ovele wama» ngemva kokubulawa ngenkani uvamise ukushiya kokubili ukubhaliswa kwe-interface kanye nengxenye yesixazululi endaweni. Thola i-PID ethile bese uthumela isignali kuyo kuphela:

ps aux | grep -E "openvpn|wg-quick"
sudo kill <pid>
resolvectl revert tun0

Ungagxumi ku-pkill -f vpn noma ku-killall vpn ngaphambi kokufunda uhlu oluphelele lokufana. I-f ifana nawo wonke umugqa womyalo, ngakho ingaqeda iskripthi sokugoqa, isikhathi somhleli noma inqubo engahlobene i--path yayo equkethe lowo mucu. Ukuqeda inqubo engalungile phakathi nomsebenzi yindlela isinkinga sesixazululi esiba ifayela elilahlekile ngayo.

I-resolvectl revert isetha kabusha ukulungiselelwa kwe-DNS kwesikhathi sokusebenza salelo sixhumanisi, okuncane kunokuqala kabusha isixazululi futhi kuncane kakhulu kunokuhlela ifayela lomhlaba wonke. Uma isixhumanisi somhubhe sinyamalele ngokuphelele, i-systemctl restart NetworkManager yakha kabusha isimo sokuxhumana futhi leso yisinyathelo izintambo zomthombo ezihlala zibuyela kuso. Qaphela umphathi wesevisi one-Restart=always, ngoba angabuyisela iklayenti elibulewe kanye nezilungiselelo zalo ze-DNS ngqo.

Elinye icele: i-DNS ephushwe kodwa engafikanga

Isithombe esibukisayo sengxenye endala umhubhe ongenaso isixazululi esisebenzisekayo. Inketho ye-DNS kuphrofayela iyisicelo; ingxenye ephethe ukuxhumana kufanele iyinikeze isixazululi. Uma ilogi ibonisa ukuthi iseva yamukelwe kodwa isixhumanisi somhubhe asithwali zilungiselelo ze-DNS, okushodayo ukuhlanganiswa, hhayi iseva.

Hlola ukunikezwa ngokukwenza ngesandla, lokhu okuhlukanisa «iseva ayilungile» kokuthi «akukho oyisebenzisile»:

resolvectl dns tun0 10.10.10.10
resolvectl domain tun0 ~.

Isizinda somzila esibamba konke sithumela lonke igama kuleso sixhumanisi, okuyikho okufunwa iklayenti lomhubhe ogcwele futhi okuyikho i-DNS ehlukanisiwe okungafanele ikusebenzise. Lezi zilungiselelo zinyamalala ekuxhumaneni okulandelayo. Ukuze uzienze zihlale njalo ku-NetworkManager, vala i-DNS ezenzakalelayo, setha iseva ekuxhumaneni futhi wengeze isizinda:

nmcli connection modify office ipv4.ignore-auto-dns yes
nmcli connection modify office ipv4.dns 10.10.10.10
nmcli connection modify office ipv4.dns-search "~."

Kumhubhe wenkampani okufanele uphendule amagama angaphakathi kuphela, bhala lezo zindawo nge-tilde yokuqala esikhundleni sokubamba konke, ukuze amagama omphakathi aqhubeke esebenzisa isixazululi sendawo.

Izixazululo zesikhashana eziba ukuphazamiseka okulandelayo

Ukukopisha i-resolv.conf ngaphambi kokuxhumana nokuyibuyisela ngemva kuyilayini esemthethweni ku-runbook, futhi iyisixazululo sesikhashana hhayi ukulungisa. Yehluleka khona lapho kubalulekile, ngoba ukuphahlazeka noma ukuqala kabusha ngenkani kudlula ukubuyisela. Kuyibhale njengesixazululo sesikhashana ukuze umuntu olandelayo angakhi phezu kwayo.

Ukuvala i-systemd-resolved nokubhala amaseva omphakathi ngenkani kungenye indlela ethandwayo. Kwenza ukuxhumana nokunqamuka kube okulindelekile futhi kususa i-DNS ngesixhumanisi ngasinye kuyo yonke enye inethiwekhi, okwephula i-DNS ehlukanisiwe yamagama angaphakathi futhi kwephula injongo yomhubhe ohloselwe ukugcina imibuzo ngaphakathi kuwo. Ukufaka i-resolvconf nokuphina amaseva omphakathi kubiza okufanayo ngongqimba olwengeziwe. Phatha noma yikuphi kwalokhu njengokuxilonga: uma kubuyisela ukuphequlula, ufunde ukuthi ukuhlanganiswa kwesixazululi yikho okunecala, hhayi ukuthi amaseva omphakathi alungile.

Ukulungisa okuhlala njalo ingumnikazi oyedwa ngongqimba ngalunye: nquma ukuthi iyiphi ingxenye ephethe i-DNS yesixhumanisi somhubhe nokuthi iyiphi ephethe okumisiwe komhlaba wonke, bhala lokho futhi ususe ezinye endleleni. Bese uqinisekisa ngemva kokunqamuka ngegama elixazululwa i-VPN kuphela. Uma igama langasese lisaphendula, ukubhaliswa akususwanga; uma kungaxazululwa lutho, ifayela likhomba kuseva engasekho. Kokubili kuyabonakala ku-resolvectl ngaphambi kokuba uvule isiphequluli.