Indlela yokuhlola ama-DNS resolver asetshenziswa yi-Mac yakho ku-VPN

scutil --dns iphrinta ukuhlelwa kwe-resolver okubhekwa ngempela yi-macOS, hhayi leyo seva eyodwa ye-DNS oyithayiphile epaneli yezilungiselelo. Ukuphuma kude kunalokho abantu abaningi abakulindele, ngoba uhlelo lugcina amabhlokhi e-resolver ahlukene endlela ezejwayelekile, kuma-interface anomkhawulo nasekudluliseni okugxile kusizinda. Ibhlokhi ephezulu kokuphuma ayiyona ngempela leyo ephendula umbuzo. Uma igama langasese lixazululwa ehhovisi bese lihluleka ngaso leso sikhathi i-VPN inyuka, ukungafani kusemthethweni wokuhlanganisa nasemizileni, hhayi ekhelini leseva. Funda ukulandelana kuqala, bese uqinisekisa impendulo ngokusesha kwangempela.

Funda ukulandelana kwamabhlokhi ngaphambi kwamakheli

Yonke ingeno ivuleka nge-resolver #N futhi ibala i-nameserver[0], ngezinye izikhathi i-if_index, umugqa we-flags, i-reach futhi, lapho ibhlokhi ingeyona okuyiyona ejwayelekile, i-domain nohlu lwe-search domain. I-resolver yenumbolo 1 engenasizinda iyona ejwayelekile ephethe amagama asesidlangalaleni. Noma yini ethwala i-Scoped emikhonjweni yayo ixhunyiwe ku-interface eshiwo yi-if_index, futhi noma yini emakwe nge-Supplemental isebenza kuphela kuzizinda ezibalwe ngaphansi kwayo.

Ukusebenzisa ukuhlanganisa kwesijobelelo. Egameni elifana ne-intranet.corp.example, i-macOS ithanda i-resolver okungukuthi ingeno yayo ye-domain iyisijobelelo esihambisana kakhulu futhi side, ngakho ibhlokhi ene-domain : corp.example inqoba okwejwayelekile ngisho noma isezansi kakhulu kokuphuma. I-order ixazulula ukulingana phakathi kwezizinda ezinobude obulinganayo. Ukubuka kokuqala akuvamisile ukudinga okungaphezulu kwalokhu: ukuphuma konke lapho ufuna ukufunda ibhlokhi eyodwa kusuka ekuqaleni kuze kube sekugcineni, imigqa yokuqala ukufunda ukulandelana kwamabhlokhi, nokuhamba okuhlungiwe okubhala izihloko zamabhlokhi eceleni kwemigqa yensimu. Amabhlokhi anomkhawulo avela ngaphansi kwesihloko sawo futhi afundwa njengokuqhubeka kohlu olungenhla kwawo, ngakho gcina isihloko emehlweni wakho njalo lapho ucaphuna ukuphuma.

scutil --dns
scutil --dns | sed -n '1,45p'
scutil --dns | grep -nE '^resolver #|^DNS configuration'
scutil --dns | grep -nE 'resolver #[0-9]+|if_index|domain|flags|nameserver'

Hlanganisa i-if_index ne-interface yomhubhe

Inkomba ilusizo kuphela uma ungasho i-interface engemuva kwayo. I-scutil --nwi ibala ulwazi lwenethiwekhi olugcinwa uhlelo, kuhlanganise ne-interface eyinhloko nokufinyeleleka, kuyilapho i-ifconfig -l ikunikeza amagama, lapho i-utun0 kuya ku-utun9 kukhona khona abazongenela umhubhe abavame ukwakhiwa iklayenti. I-Apple isebenzisa i-scutil --dns njengesibonelo sayo sokuhlola ku-umhlahlandlela wokusabalalisa, futhi ibhala phansi ukuthi i-Network Extension ingayisa kanjani izizinda ezithile kuma-resolver athile, okuyindlela eveza lawo mabhlokhi anomkhawulo.

Ukuhlola okuquma umbuzo ukuthi i-resolver ihlezi endleleni efakwe umhubhe:

scutil --nwi
ifconfig utun4
route -n get 10.20.0.53
netstat -rn | grep -m5 utun

Uma i-route -n get ibuyisela isango ne-interface engahambisani nengeno ye-resolver, ikheli lingase lilunge ngokuphelele futhi lingafinyeleleki. Umhubhe ohlukanisiwe othwala kuphela amasubneti enkampani ulahla imibuzo eqeleqelela iseva ye-DNS engaphandle kwawo, futhi ukwehluleka kuvela njengokuphela kwesikhathi, yingakho ukuphuma kokuhlelwa kubonakala kukuhle njalo.

Buza i-resolver yohlelo, bese ubuza iseva

Amathuluzi amathathu aphendula imibuzo emithathu ehlukene, futhi ukuwahlanganisa kukhiqiza iningi leziphetho ezingalungile kule ndawo. I-dscacheutil -q host -a name idlula ku-resolver efanayo yohlelo esetshenziswa izinhlelo ezijwayelekile, ngakho amabhlokhi anomkhawulo nawengezelelo ayasebenza. I-dig ngaphandle kwengxabano yeseva ifunda i-/etc/resolv.conf, okungesona umthombo weqiniso lokuxazulula okunomkhawulo ku-macOS, futhi yeqa ngokuphelele imithetho yesizinda ngasinye. I-dig @address ifinyelela iseva eyodwa ngqo futhi ayisho lutho ngokusele.

dscacheutil -q host -a name intranet.corp.example
dig intranet.corp.example
dig @10.20.0.53 intranet.corp.example
nslookup intranet.corp.example

Uma umyalo wokuqala uphendula futhi owesibili ubuyisela i-NXDOMAIN, uthole ukuhlukaniswa obukufuna futhi akukho okugqilikile. Uma owesokuqala uphelelwa isikhathi kuyilapho i-dig @10.20.0.53 iphendula, i-resolver iyasebenza kodwa ayifinyeleleki endleleni esetshenziswe ngumhubhe, ngakho isinyathelo esilandelayo i-route -n get hhayi ukuguqula izilungiselelo ze-DNS. Gcina amagama angasese eceleni kwanoma yini oyinamathisela etikithini noma encwadini eyabiwe.

Lokho ukuphuma akukwazi ukukubonisa

Izendlalelo eziningana zihlezi phezu kohlu lwama-resolver noma eceleni kwawo, futhi ngayinye ingathumela umbuzo endaweni ukuphuma okungakaze kuyikhulume. Isiphequluli esine-DNS ephephile ivuliwe singaxazulula ngomzila waso oshiyiwe, ngakho ikhasi elilayishwa ngesikhathi i-dscacheutil iphela isikhathi akusona ukuphikisana. I-proxy ye-DNS efakwe isofthiwe yezokuphepha isebenza njengomhlinzeki we-Network Extension futhi idlulisa imibuzo ngokwayo, futhi i-scutil --dns ikhombisa lokho okwalungiselelwe, hhayi ikheli langenhla i-proxy elagcina ilisebenzisile. Izizinda zokusesha zengeza ukugoqa kwesithathu: igama elingaqinisekisiwe linanyathiselwa isijobelelo ngasinye esibaluliwe ngokulandelana, ngakho ibhlokhi eyaphendula ingaba ngeyona ongakaze uyisole.

Izimpendulo ezindala yizo ezingabizi kakhulu ukuzikhipha futhi ezivame ukweqiwa:

sudo dscacheutil -flushcache
sudo killall -HUP mDNSResponder
scutil --dns | head -20

Uma ukuphuma kushintsha ngemva kokuhlanza, isimo sasigcinwe futhi ukuphuma kwangaphambili kwakuchaza umhubhe ongasekho. Uma kungashintshi, ukuhlelwa kunjalo, futhi umbuzo udlulela emizileni nasemthethweni wohlelo.

Incwajana emfushane yangaphambi nangemva

Thatha umugqa wesisekelo kuphela lapho umthetho uvuma khona, futhi gcina amafayela ngaphandle kwanoma yisiphi isikhwama esivumelanisiwe. Ukulandelana okungezansi yikho engikwenzayo emishinini yamaklayenti: thatha umugqa wesisekelo, xhuma, thatha futhi, bese uqhathanisa futhi usesha.

scutil --dns > ~/dns-before.txt
# connect the VPN, then:
scutil --dns > ~/dns-after.txt
diff -u ~/dns-before.txt ~/dns-after.txt
dscacheutil -q host -a name intranet.corp.example

Funda umehluko ngamabhlokhi hhayi ngemigqa. I-resolver entsha enomkhawulo ethwala inkomba ye-interface yomhubhe nengeno ye-domain yesijobelelo sangasese iyisimo esilindelekile. I-resolver eyisisekelo entsha ekhomba ekhelini lomphakathi iyinto etholakele okufanele yethulwe kumnikazi wephrofayela yeklayenti. Bese uphinda ukusesha ngaphakathi kohlelo olwahluleka ngempela, hhayi egobolondweni kuphela, futhi ubhale i-interface evela ku-route -n get eceleni komphumela.

Ukuze uhoxise ushintsho, nxepha futhi uphinde ukuthatha komugqa wesisekelo. Uma ibhlokhi enomkhawulo isihambile, iklayenti lizihlanzele ngokwalo. Uma ibhlokhi isabalulwa ngokumelene ne-interface engasekho, isimo sesidala, futhi ukuhlanza kanye nokuxhuma kabusha kuyisilungiso esithambile kakhulu ngaphambi kokuba noma ubani athinte iphrofayela.

Ukuhlola okune ngokulandelana: ingabe ibhlokhi ye-resolver ihambisana nesijobelelo eside kakhulu segama; ingabe leyobhlokhi ixhunyiwe ku-interface eyafakwa umhubhe; ingabe umzila oya esevini yayo yamagama usebenzisa umhubhe; futhi ingabe i-resolver yohlelo, hhayi i-dig, iyona ebuyisela impendulo. Ukuhlola kokuqala okwehlulekayo kukutshela ukuthi ushintshe umthetho we-DNS, imizila yomhubhe noma uhlelo. Uma konke okune kudlula kodwa igama lihluleka, inkinga ingaphezulu kwe-DNS, futhi into elandelayo okufanele ihlolwe yinoma yini ephendula iphothi 53 phambi kwayo.