Qondisa amaklayenti e-OpenVPN kusixazululi se-Pi-hole kwenye enye i-host

Ukufaka ikheli le-Pi-hole kuphrofayela ye-OpenVPN akudali indlela eya kuyo, akunikezi imvume yokuyibuza, futhi akuqinisekisi ukuthi iklayenti izoyisebenzisa. Uma i-Pi-hole ikumshini we-LAN ohlukile, izinto ezine kumele zihambisane: indlela evela kuklayenti, ukudluliswa kusuka esangweni, indlela yokubuya eya echibini, kanye nenqubomgomo yokwamukela ku-Pi-hole ngokwayo. Ihluleka ngalinye libonakala ngendlela ehlukile kulogi. Ukubhekana nazo ngalolo hlelo kushesha kunokulungisa okokugcina kuqala. Indlela emfushane evamile, ukuvula ukuphindaphinda kuyo yonke imithombo, ishintsha inkinga encane ngenkinga ehlala njalo.

Okwenziwa nokungakwenzi ukhetho lwe-DNS olushelelwe

Iseva imemezela isixazululi ngomyalelo ongezansi, icabanga ukuthi u-192.168.50.53 uyi-host ye-Pi-hole. Iklayenti ithola ukhetho futhi, kuye ngeplathifomu yayo nokuhlanganiswa kwesixazululi , ilusebenzisa kusixhumi somhubhe noma ilushaya indiva ithande i-stub yasendaweni. Umugqa wendlela ubalulekile njengomugqa we-DNS, ngoba isixazululi iklayenti engakwazi ukusifinyelela akusona isixazululi nhlobo. Akukho kulokhu okubonakala ohlangothini lweseva.

server 10.90.0.0 255.255.255.0
push "dhcp-option DNS 192.168.50.53"
push "route 192.168.50.0 255.255.255.0"

Ukuthola ukhetho akufani nokulusebenzisa. Iklayenti le-Linux elinokuphathwa kwesixazululi lingase lamukele iseva esishelelwe futhi lithumele amanye amagama kuphela kuyo; iklayenti elilawula i-DNS ngokwalo lingase lishintshe isethingi ngokuphelele. Izindlela ezishelelwe nazo zikhawulwe kwezinye izinkundla, okushiya isixazululi singafinyeleleki ngisho ukhetho lwamukelwe. Hlola kuklayenti ukuthi iyiphi iseva ephendulayo, hhayi kuseva ukuthi kwathunyelwani.

Ukhetho futhi akusho lutho ngohlangothi lweseva. Ukuhamba kwe-DNS kusafanele kuhambe kusuka kuklayenti kuya esangweni nokusuka esangweni kuya ku-Pi-hole ngaphambi kokuba naluphi ukhetho lube nencazelo. Indlela engekho kanye nombuzo onqatshiwe kubonakala kufana kuklayenti, ngakho qinisekisa kuqala ukudluliswa esangweni.

Indlela yokubuya isuka ku-Pi-hole iya echibini

Uma ikheli lomthombo weklayenti ligcinwa, i-Pi-hole iphendula ikheli elingaphakathi kwechibi le-VPN. Ithebula layo lendlela cishe alazi lutho ngalelo chibi, ngakho impendulo iya esangweni layo elizenzakalelayo bese ilahleka. Ilogi yemibuzo ibonisa isicelo esingenayo impendulo ehambisanayo, okulula ukukuthathela phezulu njengenkinga yomlilo.

Nikeza i-LAN router indlela emile yechibi esangweni le-OpenVPN njengehop elilandelayo, noma uhumushe umthombo esangweni ngaphambi kokudlulisela ku-Pi-hole. Eyokuqala igcina amakheli eklayenti ngalinye ebonakala kulogi yemibuzo ye-Pi-hole. Eyesibili isusa isidingo sendlela yokubuya kodwa yenza umbuzo ngamunye ubonakale usuka esangweni. Akukho okungalungile; ziphendula imibuzo ehlukile.

Uma ukubikwa noma inqubomgomo yeklayenti ngalinye kubalulekile, indlela emile iyisimo esingcono. Uma i-LAN iphethwe omunye umuntu futhi kungekho ndlela, ukuhumusha kuyisinqumo esisebenzayo, nokulahlekelwa ubunikazi beklayenti kubhaliwe. Bhala ukuthi wakhetha kuyiphi, ngoba wonke umbuzo welogi olandelayo uncike kukho.

Imodi yokulalela ye-Pi-hole yamaklayenti anendlela

Uhlu olwehla lwendlela yokuziphatha kokulalela kwezixhumi ekhasini lezilungiselelo ngaphansi kwe-DNS lunquma ukuthi i-Pi-hole iphendula imithombo iphi. Ukhetho oluqinile kakhulu lwamukela amaklayenti akunethiwekhi exhunywe ngqo kuphela; ukhetho oluvumela amadivaysi ukuba abe kude nehop elilodwa ludlulela lokho kumasubnethi angemuva kwerouter eseduze, futhi iklayenti le-VPN elinendlela libonakala kanjalo ncamashi. Iphakethe lifika ngempela kusixhumi se-LAN, kodwa ikheli lomthombo walo lingelinye isubnethi. Lokhu ukwenqaba ngenqubomgomo, hhayi ukwehluleka kwendlela, futhi umehluko ubalulekile lapho ufunda amalogi.

Umhlahlandlela we-Pi-hole wokulalela wehlukanisa imithombo exhunywe endaweni nemithombo enendlela, futhi isixhumi sokufika akusona isilinganiso. Khetha imodi evumela ichibi le-VPN ngaphandle kokuvumela i-inthanethi yonke, bese uyihlanganisa nomthetho womlilo owamukela i-DNS evela echibini kuphela.

Ukuvula ukuphindaphinda kuyo yonke imithombo ukuze umbuzo wokuqala usebenze ukulungisa okungalungile. Kwenza isixazululi esiyimfihlo sibe esivulekile, futhi ukulungisa imvume ekhawulelwe, hhayi yomhlaba wonke.

Hambisa impendulo nelogi yemibuzo

Buza iklayenti, bese uhlola iseva futhi uqhathanise kokubili. Kuklayenti le-systemd-resolved imiyalelo engezansi ibika ukuthi yisiphi isixazululi esikhiqize impendulo nokuthi yimaphi amaseva amisiwe kusixhumanisi ngasinye. Sebenzisa igama elaziwa yi-Pi-hole kuphela, ngoba umbuzo oqondile ekhelini le-Pi-hole ufakazela ukufinyeleleka, hhayi ukulungiselelwa.

resolvectl query intranet.example.lan
resolvectl dns

Impendulo elindelekile isho u-192.168.50.53 njengesiseva futhi ibuyisela ikheli elalizokwaziwa yileso sixazululi kuphela. Bese ubheka umbono we-Pi-hole ngokwayo: pihole -t ilandela ilogi yemibuzo bukhoma, futhi umugqa ngamunye uthwala ikheli lomthombo. Uma umthombo uyikheli lomhubhe weklayenti, indlela yechibi iphelele. Uma kuyikheli le-LAN lesango, ukuhunyushwa komthombo kuyasebenza futhi ikheli leklayenti ngokwalo ngeke livele neze.

Uma kungabonakali lutho kulogi, umbuzo awukaze ufinyelela ku-Pi-hole futhi into elandelayo okufanele ihlolwe ukudluliswa esangweni. Uma umbuzo ubonakala kodwa impendulo ingabuyi, inkinga iyindlela yokubuya, okungukuthi isigaba esandulele. Ukwehlukanisa ukwehluleka ngale ndlela kuvimbela iphutha lendlela ukuthi lithathwe njengomthetho womlilo.

Hlola umthetho wokudlulisela wesango

Isango kumele lidlulisele amaphakethe e-DNS eklayenti ngase-Pi-hole, futhi umthetho okwenzayo kufanele ufundwe, hhayi kucatshangwe. Imiyalelo engezansi ibala imithetho ethinta iphothi 53 kanye nezibali, kuhost ye-nftables nakuhost ye-iptables. Umthetho okhona kodwa obonisa uziro wokufana isibonakaliso sokuthi ukuhamba kuyalahlwa ngaphambi kokuhunyushwa.

sudo nft list ruleset | grep -A3 'dport 53'
sudo iptables -t nat -L POSTROUTING -n -v | grep 53

Funda izibali, hhayi imithetho kuphela. Umthetho ongafani neze usho ukuthi iphakethe liphuma ngolunye uxhumo, noma iklayenti alikaze likuthumele. Umthetho ofana kuwo wonke umbuzo usho ukuthi ukudluliswa kuyasebenza futhi inkinga ikude phambili endleleni.

Noma yiliphi ithuluzi elisetshenziswa ihost, gcina ukuhlola kuncane: ichibi njengomthombo, iphothi 53 njengendawo ekuyiwa kuyo kanye ne-Pi-hole njengomgomo oyedwa ovunyelwe. Umthetho wokudlulisela obanzi ovumela nephothi 80 unenye inkinga elindele ukwenzeka.