Nika i-VPN yakho yasekhaya ama-record ayo e-DNS e-nas.home.arpa
Shicilela igama elilodwa kusuka ku-dnsmasq, qondisa i-resolver nge-WireGuard, bese ukhetha phakathi kokusunduza i-DNS kuyo yonke iklayenti kanye ne-split-DNS ye-home.arpa kuphela.
Lapho umhubhe usuphezulu, isinyathelo sokugcina ngokuvamile igama elisebenzayo esikhundleni sekheli olinamathisela kubhukimaka. Irekhodi lomsingathi ye-dnsmasq kanye nekheli le-resolver iklayenti engalifinyelela kukwenza lokho ngamafayela amabili futhi ngaphandle kwe-multicast. Isinqumo esidinga ukucatshangelwa ngempela sincane: ingabe iklayenti lithumela yonke i-DNS nge-resolver yasekhaya, noma amagama angaphansi kwe-home.arpa kuphela? Konke okungezansi kucabanga ukusethwa kwe-WireGuard okugunyaziwe kanye neklayenti le-Linux kanye ne-resolver yaselabhorethri esivele ilawulwa ngumlawuli wasekhaya.
Izindlela ezintathu zokunika iklayenti i-resolver
| Approach | Scope | Cost |
|---|---|---|
DNS = in the wg-quick interface | the client's general DNS while the tunnel is up | every name in the house now depends on the tunnel |
Platform split-DNS for home.arpa | only that suffix | more configuration per client platform |
Manual dig @resolver | one query at a time | fine for testing, useless for applications |
Kwilaptop ehlanganyela emhubheni ngezikhathi ezithile, i-split-DNS iwukuhlela okuyimfihlo okungcono: igcina amagama ajwayelekile e-inthanethi kuyi-resolver umshini osevele uwethemba. Emshinini okhona ukuze ufinyelele izinsizakalo zasekhaya, ukusunduza i-resolver kulula futhi izindleko zobubanzi azibalulekile.
Shicilela irekhodi kuyi-resolver engumnikazi wendawo
Hlukanisa izindima ngaphambi kokubhala ukumiswa: ikheli leklayenti le-VPN, i-resolver kanye nensizakalo izingingi ezintathu ezihlukene ezinemisebenzi emithathu ehlukene. Kulolu labhorethri zingu-10.77.0.2 zeklayenti, 192.168.50.53 ze-dnsmasq kanye no-192.168.50.20 ze-NAS, kanti umhubhe uqondisa i-LAN yasekhaya.
listen-address=127.0.0.1,192.168.50.53
bind-interfaces
local=/home.arpa/
host-record=nas.home.arpa,192.168.50.20Umugqa we-host-record unikeza ikheli kanti umugqa we-local= ugcina imibuzo engaziwa ye-home.arpa ngaphakathi kwale resolver esikhundleni sokuyidlulisela phezulu. Qala ngokufunda ukumiswa kwakho okukhona bese uhlanganisa noma yini esevele ichaza iseva, isixhumi noma isizinda sendawo efanayo; ukubeka ingcezu phezu kokuphikisayo kukhiqiza i-resolver elayisha ngokujabulayo futhi ephendula ngokungalungile. Incwadi ye-dnsmasq ichaza zombili iziqondiso kanye nezilawuli zokulalela.
Bese uqinisekisa insizakalo esebenzayo, hhayi ifayela. Ukuhlolwa kokumiswa kanye nokuqalisa kabusha kuyisisekelo, futhi impendulo esebenzayo yilokho umbuzo okubuyisayo.
Qondisa i-resolver, hhayi ikhasi lewebhu kuphela
I-AllowedIPs ye-WireGuard inquma ukuthi yiziphi izindawo ezingena emhubheni. Uma ikheli le-resolver liwela ngaphandle kwayo, umbuzo uphuma ngomzila ojwayelekile futhi awufinyeleli ku-dnsmasq nhlobo, nakuba i-NAS uqobo ifinyeleleka. Faka ikheli le-resolver, noma isiqalo se-LAN esiliqukethe, bese uhlola inqubomgomo yokudlulisa yesango ohlangothini olunye.
Vumela i-UDP ne-TCP kupothi 53 kusukela kububanzi bomhubhe ogunyaziwe, ngomzila wokubuyela ekhelini lomhubhe weklayenti. Ungadlulisi ipothi 53 kusuka ku-WAN ukuze wenze ukuhlola kube lula: i-resolver ephindayo evulekile kuxhumano lwasekhaya itholakala phakathi namahora. Ukubopha kusixhumi akuwona umgomo wokufinyelela ngokwawo.
Hlola impendulo ngaphambi kohlelo lokusebenza
Buza i-resolver ngqo kuqala, bese uhlelo, bese uhlelo lokusebenza. Isinyathelo ngasinye sihlukanisa isixhumanisi esisodwa ochungechungeni, futhi umehluko phakathi kwazo ukuxilongwa.
dig @192.168.50.53 nas.home.arpa. A
dig +tcp @192.168.50.53 nas.home.arpa. A
getent ahostsv4 nas.home.arpa
curl -sS --max-time 5 http://nas.home.arpa/ -o /dev/null -w '%{http_code}\n'Kufanelekile ukusebenzisa umbuzo we-TCP ngoba impendulo ye-UDP enqanyuliwe iphoqa ukuphinda, futhi inqubomgomo elahla i-TCP 53 ikhiqiza ukwehluleka okubonakala kungu-ngezikhathi ezithile. Isinyathelo se-getent sikhombisa lokho ukumiswa kwe-resolver yomshini okwenzayo ngempela, okuwukuthi akuyona into oyisunduzile njalo.
Nquma ukuthi kwenzeka ini lapho umhubhe uphansi
Uma i-DNS evamile yeklayenti ikhomba ku-192.168.50.53, konke ukuxazululwa kwamagama kuyayeka ukusebenza lapho umhubhe ungekho phezulu. Lokho kwamukeleka emshinini owusizo kuphela nomhubhe, futhi akwamukeleki kwilaptop esebenzisa ne-Wi-Fi yasendaweni yokudlela. I-split-DNS igwema lo mbuzo ngokuphelele, ngoba ukusesha kwe-home.arpa kuphela okuncike ku-resolver yasekhaya.
Khumbula ukuthi igama liyini: i-home.arpa igcinelwe amanethiwekhi okuhlala futhi ayiyingqayizivele emhlabeni wonke, ngakho enye inethiwekhi ingasebenzisa igama elifanayo ngokusemthethweni. Kuwubukhululekile basendaweni, hhayi isihlonzi esithembekile. Gcina irekhodi lisesikhathini lapho insizakalo isuka, futhi susa inqubomgomo ye-resolver lapho ilabhorethri isiyeka ukusebenza esikhundleni sokushiya ilaptop ekhomba ekhelini engalifinyelela kuphela ngomhubhe ongasekho.