I-DNS yezwe ne-anycast: ukuhlola umnyango we-VPN oyitholayo

I-DNS yezwe ne-anycast zikhetha amaphoyinti okungena ngemithetho ehlukene. Hlola ukuthi impendulo ikhombisa isiphi isixazululi, bese uthola ukuthi iseshini iyasinda yini lapho inodi ishintsha.

Impendulo ye-DNS eseduze izwakala njengenkinga esexazululiwe kuze kuthi ukuxhumana kwehlele kwenye indawo. I-DNS yezwe kanye ne-anycast zombili zizama ukufinyeza indlela, futhi zithatha leso sinqumo olwazini oluhlukene. Akukho okuqinisekisa ukuthi isango oyafinyelela kulo liyafinyeleleka, ukuthi liveza ubunikazi obulindelwe yiklayenti lakho, noma ukuthi iseshini yakho iyasinda lapho inodi ishintsha. Izihlolo ezingezansi zihlukanisa leyo mibuzo emine.

Hlola ukuthi isixazululi sibika ngempela indawo kabani

Iseva egunyaziwe ephendula umbuzo ozwela ku-topology ivamise ukubona ikheli lesixazululi esiphindaphindayo esibuzile, hhayi ikheli lomuntu othayiphe igama. Isixazululi esimaphakathi singahlala kude namaklayenti esiwasebenzela, futhi impendulo ikhombisa isixazululi hhayi wona. Lokho akulona iphutha; yileyo ndlela iphrothokholi eziphatha ngayo ngaphandle uma kunikezwe ulwazi olwengeziwe. Incazelo ye-EDNS Client Subnet ichaza kokubili umkhawulo kanye nekhambi elingakhethwa.

I-EDNS Client Subnet ingathwala ulwazi lwenethiwekhi yomthombo lapho wonke umhlanganyeli eyisekela futhi eyivula. Iyakhethwa, inemithelela yobumfihlo nokugcinwa kwememori, futhi akuyona imvume yokucabanga ukuthi noma yisiphi isixazululi somphakathi sibika indawo enembile yomsebenzisi. Buza abasebenza ngesixazululi ngaphambi kokuklama mayelana nayo.

dig +short vpn.example.com @1.1.1.1
dig +short vpn.example.com @9.9.9.9
dig +subnet=203.0.113.0/24 +short vpn.example.com

Hlola ukuthi ukuhamba kwendlela kwe-anycast kunqume ini

Nge-anycast, izindawo ezimbalwa zimemezela ukufinyeleleka kwekheli elilodwa lesevisi, futhi inethiwekhi iletha iklayenti ngalinye kunodi ethandwa ukuhamba kwayo. Lokho kukhethwa kwenziwa yi-BGP kanye nenqubomgomo ezungezile, hhayi ibanga elikusemephini. Ukusondelana kwe-topology nakho ngokuvamile akusho ukusebenza okungcono kokuhamba nokubuya, ngoba indlela ebonakala imfushane ingase igcwele noma ingalingani. Ikheli olitholile alisho lutho mayelana nokuthi iyiphi inodi ephendulile.

Qinisekisa indawo esebenzayo ohlangothini lwesevisi, noma empendulweni eyishoyo, hhayi kuphela empendulweni ye-DNS. I-traceroute -n 198.51.100.20 ikhombisa indlela oyihambile futhi ayikabonisi igama lomsingathi ekupheleni kwayo, ngakho-ke yifunde njengendlela hhayi njengempendulo.

Hlola ukuthi iseshini iyasinda lapho inodi ishintsha

Umbuzo we-DNS mfushane futhi iseshini ye-VPN yinde, futhi kokubili kunezidingo zesimo ezihluke ngokuphelele. Ukuhamba kwendlela kungashintsha phakathi neseshini, futhi lapho kwenzeka lokho, amaphakethe akamuva angafika kunodi engakaze ibone umhubhe wakho. Ukuthi lokho kuyasinda kuncike ekusetshenzisweni: isimo esabiwe, ukuxhumana kabusha ngamabomu, noma ukwehluleka okubhaliwe. Ikheli lodwa alinikezi lutho kulokho.

Buka ukushintsha esikhundleni sokukucabanga. Lapho indlela ishintsha i-sudo tcpdump -ni any -c 20 esp ikhombisa amaphakethe angaphandle, futhi ukushintsha kungazelelwe kwekheli lozakwethu ukushintsha okwenzekayo. Chaza ngokusobala ukuziphatha okuhloswe ngokusetshenziswa okusebenzayo, bese ukuhlola ngokuphoqa ukushintsha kwendlela. Uma umklamo ucabanga ukuphindwa kweseshini, shono umshini futhi usho ukwehluleka ongakukhavi.

Hlola ukuthi ubunikazi busafana

Iphoyinti yokungena ngayinye kufanele iveze ubunikazi obulindelwe iphrofayela yeklayenti lakho. Isitifiketi esikhishwe ngegama lesevisi sisebenza kuwo wonke amanodi, kuyilapho izitifiketi zenodi ngayinye ziphoqa iklayenti ukuthi lamukele okusha, futhi yilapho abasebenzisi befunda ukuqhubeka ngokuchofoza izixwayiso. Gcina ubunikazi obulindelekile kanye nephrofayela kuhambisana nomodeli wokungena.

Kuhlole kusuka kuklayenti elifinyelele inodi engajwayelekile, ngoba leso yisimo lapho isitifiketi senodi sibonakala khona. I-openssl s_client -connect vpn.example.com:443 -servername vpn.example.com iphrinta uchungechunge namagama, okuyikho kanye lokho iklayenti elikuqhathanisayo. Bese unquma ukuthi iphrofayela kufanele incishiswe noma imodeli yesitifiketi ishintshwe.

Hlola irekhodi, hhayi impendulo yokuqala kuphela

Hlola izimo ezintathu futhi ubhale amaqiniso amane esimweni ngasinye: ukungena okujwayelekile, indawo eyodwa engatholakali, kanye nesimo sokubuyisela okuvunyelwene ngaso. Amaqiniso amane yisixazululi esisetshenzisiwe, ikheli elibuyisiwe, indawo esebenzile, kanye nomphumela omusha wohlelo lokusebenza. Lelo rekhodi lihlukanisa inkinga yokukhetha i-DNS enkingeni yesango, inkinga yokuhamba kwendlela noma inkinga yesimo seseshini. Ngaphandle kwalo, konke lokhu kubonakala kufana kuklayenti.

dig +short vpn.example.com
getent hosts vpn.example.com
curl -s -o /dev/null -w "%{http_code}
" https://vpn.example.com/health

Sebenzisa izimo kusuka kumanethiwekhi wokufinyelela amelela hhayi kuphela kusuka ehhovisi, ngoba umbuzo wonke umayelana nokuthi yiliphi iphoyinti yokungena amaklayenti ahlukene awafinyelela ngempela. Inethiwekhi eyodwa iyisampula yesinye.

Izihloko ezihlobene