Amagama angaphakathi ayahluleka ku-VPN kuyilapho amasayithi omphakathi esebenza kahle

Omunye umsebenzisi ubika ukuthi igama lehodi yangaphakathi alixazululeki nge-VPN. Umbiko wesibili, ovela kulelo laptopi, uthi ukuhlolwa kokuvuza kusabonisa imibuzo ephendulwa isixazululi sasendaweni. Kuzwakala njengenkinga eyodwa kodwa zimbili, ezinobufakazi obuhlukene, futhi ukulungiswa okuvamile kokokuqala kwenza okwesibili kube kubi nakakhulu. Hlukanisa ngaphambi kokuthinta noma yisiphi isilungiselelo.

Izimpawu ezimbili okungezona iphutha elilodwa

Ukwehluleka ukuxazulula igama langaphakathi kusho ukuthi umbuzo waya endaweni engenayo impendulo yawo. Imibuzo ephuma emhubheni isho ukuthi umbuzo waya endaweni engalungile ngisho noma impendulo ibikhona. Lawa amaphutha aphambene: elinye impendulo engekho, elinye indawo eyengeziwe.

Ingozi ukuthi ukufaka isixazululi sasehhovisi kuyo yonke indawo kulungisa okokuqala futhi kuqinisekisa okwesibili. Ukufaka isixazululi somphakathi kuyo yonke indawo kwenza okuphambene.

Bhala kokubili okubonile ngesikhathi, bese wenza ukuhlola okune okungezansi ngokulandelana.

Isixazululi sayiphi i-adapha esithola umbuzo

Ku-Windows, iklayenti le-DNS likhetha amaseva ngokulandelana kokubophelela kwe-adapha, futhi i-adapha yomhubhe ayihlali iphambili ngokuzenzakalela. Vula izilungiselelo ezithuthukisiwe ze-adapha, hambisa uxhumano lokufinyelela kude ngaphezu kwe-adapha ebonakalayo, bese uxhuma kabusha ukuze ushintsho lusebenze kuseshini entsha.

Ukulandelana kokubophelela yingxenye yokuqala kuphela. Iklayenti kumele futhi lazi ukuthi yimaphi amagama angaka-adapha, futhi lokho kuwumbuzo wesijobelelo hhayi wokulandelana.

Beka ipconfig /all yomshini osebenzayo eduze naleyo yelaptopi, kokubili kuthathwe ngesikhathi umhubhe uvuliwe. Umshini osebenzayo uzobonisa isijobelelo se-DNS esiqondene noxhumano ku-adapha yasehhovisi, kanti ilaptopi ingase ingabonisi lutho kumhubhe. Lowo mehluko uchaza lonke iqembu lemibiko ethi “iseva likhona lapho kodwa igama lisa hluleka”, ngoba ngaphandle kwesijobelelo igama elifushane alikaze liqedelwe lingene endaweni esetshenziswa isixazululi sasehhovisi.

Igama elifushane lidinga isijobelelo ngaphambi kokuba lidinge umzila

Ukuthayipha igama lehodi elingaphelele kucela isixazululi ukuthi siqagele isizinda. Ukuqagela kuvela kuhlu lwezijobelelo olunamathiselwe kuxhumano, futhi uma lolo hlu lungenalutho umbuzo uphuma njengethegi elilodwa okungekho ndawo yangasese elizohambisana nayo.

Kopisha isijobelelo somshini osebenzayo kuzakhiwo ze-IPv4 ze-adapha ye-VPN kuthebhu ye-DNS, bese uxhuma kabusha. Ku-Linux okufanayo yisizinda sosesho kusixhumanisi somhubhe, esivezwa i-systemd-resolved isixhumanisi ngasinye hhayi ngokwendawo yonke.

Gcina lezi zilungiselelo ezimbili zihlukene kumanothi akho. Isijobelelo sishintsha okubuzwayo; ikheli lesixazululi lishintsha obuzwayo. Ukulungisa okukodwa ngenkathi okunye kunephutha kuveza umphumela obonakala ungenasizathu.

Buza isixazululi ngqo, bese ubuza igama

Umbuzo oqondile kwisixazululi sasehhovisi uhlukanisa inkinga yegama enkingeni yomzila, ngoba udlula ngokuphelele ekukhethweni kwesixazululi okwenziwa yiklayenti.

nslookup intranet.corp.example 10.20.0.53
nslookup intranet
resolvectl status

Umyalo wokuqala ubuza iseva ethile igama eliphelele. Uma iphendula, isixazululi nomzila oya kuso kulungile futhi iphutha likukhetho noma kusijobelelo. Uma iphela isikhathi, ikheli alilungile noma alifinyeleleki futhi inkinga ingeyomzila hhayi eye-DNS. Umyalo wesibili ubonisa okwenzeka ngegama elifushane, futhi owesithathu uprinta ukulungiselelwa kwesixazululi kwisixhumanisi ngasinye kumshini osebenzisa i-systemd.

Qaphela izimpendulo zewildikhadi, ezinye izinkundla zizibuyisela emagameni angaziwa. Impendulo ebonakala inengqondo akuwona ubufakazi bokuthi iseva ebiqondiwe iphendule, ngakho qhathanisa ikheli elibuyisiwe nalelo isevisi yangaphakathi elisebenzisa ngempela. Uma ikheli lingelkhasi lokupaka noma iphroksi, isixazululi siphendule kodwa impendulo ibingeyakho. Lowo mehluko wonga ihora lokujaha umhubhe obusebenza kahle sonke leso sikhathi.

Ku-Linux, iklayenti le-VPN elibhala kabusha ifayela elithi /etc/resolv.conf lishintsha ngokuphelele izixazululi zasendaweni. i-vpnc iveza ukulungiselela okuthi DNSUpdate no ukuze kuvinjelwe lokho, futhi i-systemd-resolved ingahambisa kuphela izizinda ezisohlwini zisiyise kusixhumanisi somhubhe. Zombili izindlela zigcina amagama omphakathi kusixazululi sasendaweni kuyilapho zithumela amagama angaphakathi ehhovisi.

Ukuvuza kuwumthetho, hhayi ibhokisi lokuhlola

Ukuxazululwa kwamagama ukushintshana kwe-UDP kuphothi 53, ngakho umhubhe ohambisa ithrafikhi yewebhu kodwa hhayi i-UDP ushiya umbuzo emzileni obonakalayo. Kufakazele ngokuthwebula kukhadini lenethiwekhi ebonakalayo ngenkathi kuxazululwa igama lomphakathi. Umbuzo obonakala kuleso sixhumanisi ngendlela efundekayo usho ukuthi umhubhe awuwuthwali.

sudo tcpdump -ni eth0 -c 20 'udp port 53'
resolvectl query example.com

Uma umbuzo uvela kuleso sixhumanisi ngendlela efundekayo, umhubhe awuwuthwali. Ukulungisa kuwumthetho ovumela iphothi 53 kuphela kusixazululi esisithunyelwe yi-VPN futhi owalahla ezinye izindawo, kanye nokulungiselelwa kweklayenti okungayilahli buthule inketho ethunyelwe.

Le ngxenye yokugcina ibaluleke ukwedlula indlela ebonakala ngayo. Qala i-OpenVPN nge-route-nopull, futhi inketho ye-DNS ethunyelwe iyanyamalala kanye nemizila, ngaphandle uma isihlungi sokudonsa sandiswa ukuyigcina. Futhi iklayenti elingayinaki i-dhcp-option DNS lizoqhubeka lisebenzisa noma yini elalinayo ngaphambili. Noma yiluphi ushintsho ohlangothini lweseva ludinga iseshini entsha ukuze lusebenze, ngoba uhlu lwezixazululi lulethwa lapho umhubhe uvuka futhi iseshini endala iqhubeka ibonisa isimo esidala.

Bhala ukuthi yiluphi iphutha owabona ngempela ngaphambi kokuvala ithikithi. Impendulo yangaphakathi engekho nombuzo ophuma emhubheni kudinga ukulungiswa okuhlukene, futhi ushintsho lwesijobelelo olulungisa okokuqala lungenza buthule okwesibili kube kubi nakakhulu. Ozothatha ithikithi ngemuva kwakho uzothemba ilebula, ngakho yenza ilebula linembile.