I-DNS ye-OpenVPN esangweni: i-dnsmasq kanye nobubanzi be-firewall

Sebenzisa i-dnsmasq ekhelini lethumbu, vumela i-DNS kuphela eqenjini lamaklayenti, gcizelela isixazululi, bese uhlola imibuzo eqondile kanye nokusesha kohlelo lokusebenza uqobo.

Amaklayenti asethumbini ayafinyelela esangweni, futhi isango liyafinyelela isixazululi sangaphakathi, ngakho i-DNS kufanele isebenze. Kepha ayisebenzi, ngoba lezi izimvume ezimbili ezihlukene futhi insiza ye-DNS esebenzayo into yesithathu. Isilaleli kufanele sibe khona ekhelini amaklayenti afinyelela kulo, i-firewall kufanele ivumele imibuzo kulelo kheli, futhi iklayenti kufanele litshelwe ukuthi liyisebenzise. Ukuvula ithumbu kuzo zombili izinhlangothi kuxazulula ezimbili zokuqala ngengozi futhi kushiye eyesithathu ingaqediwe.

Isilaleli iyinsiza yasendaweni enezinhlangothi ezimbili

Ngaphakathi, iklayenti lithumela umbuzo ekhelini lethumbu lesango embobeni 53. Ngaphandle, i-daemon idlulisela lowo mbuzo kwi-upstream yayo emisiwe. Womabili amahafu kufanele asebenze, futhi ehluleka ngezindlela ezihlukene.

Isikhathi sokuphela esibikwa iklayenti kanye nesikhathi sokuphela esibonakala esangweni akusona isici esisodwa.

Bopha ikheli lethumbu, hhayi wonke amakheli

I-instance ye-dnsmasq ezinikezelwe yalo msebenzi idinga ikheli elicacile lokulalela, imodi yokubopha ebekezelela ukuvela kwethumbu ngemva kokuqala, kanye ne-upstream eyodwa ecacile. Leli yinguqulo encane engiyisebenzisayo:

listen-address=127.0.0.1,10.90.0.1
bind-dynamic
no-resolv
no-hosts
server=192.168.50.53

bind-dynamic ibopha amakheli angawodwana futhi ibhekana nalapho tun0 kuvela kamuva, okuyinto ebalulekile kumhlambi lapho insiza ye-VPN iqala kabusha. Ukufaka i-loopback kugcina amathuluzi asendaweni esebenza ngaphandle kokwengeza isilaleli somphakathi. no-resolv ivimbela i-daemon ukuthi ingadli ifa le-upstream kusuka ekucushweni kwesixazululi somhlambi, kanti no-hosts ivimbela le instance ukuthi ingashicileli ifayela le-hosts lesango. Awekho kulawa makhethi anikeza noma ubani imvume yokubuza insiza.

Ngaphambi kokuqala i-daemon yesibili, hlola ukuthi kukhona yini isilaleli esivele sikhona embobeni 53, futhi sebenzisa umnikazi wokucushwa kwesabelo esikhundleni sefayela elahlekile kusikhombisi esingalungile.

Vumela okokufaka kwe-DNS, hhayi ukudlula kwethumbu

Imithertho ye-firewall eyenza lokhu kusebenze yimithertho yokufaka yasendaweni elinganiselwe ku-interface yethumbu, iqembu lamaklayenti, ikheli lesango kanye nembobo 53. Imithertho emibili, eyodwa nge-protocol ngayinye, yanele:

sudo ufw allow in on tun0 proto udp from 10.90.0.0/24 to 10.90.0.1 port 53
sudo ufw allow in on tun0 proto tcp from 10.90.0.0/24 to 10.90.0.1 port 53

I-DNS ihamba nge-TCP kanye ne-UDP, ngakho umthetho we-UDP kuphela ushiya izimpendulo ezinkulu zihluleka ngendlela ebonakala njengeyezikhathi. Lezi akuzona ufw route izimvume, futhi akufanele zibe yimvume ebanzi ku- tun0. Ukulandelana kubalulekile njengokuqukethwe: umthetho wangaphambili olahla konke okokufaka okuvela ku- tun0 usanqoba, futhi ukwengeza imvume ngaphansi kokulahla kokugcina akudali lutho.

Uma i-DNS yesango manje isiyingxenye yedizayini, buyekeza leyo nqubomgomo yangaphambili ngamabomu futhi ubhale ukuthi kungani.

Ingxenye ye-upstream iyindlela ehlukile

Imibuzo ishiya isango isuka ekhelini layo iqonde kwisixazululi se-upstream, ngakho umzila wesango kanye nenqubomgomo yokuphuma ebhekise kuleso sixazululi kufanele kuvumele ukushintshana. Lona umthetho ohlukile kulawo ovumela amaklayenti ukuthi afinyelele isilaleli, futhi uhluleka ngophawu oluhlukile.

Ungengezi ukuphuma kwethumbu okungavinjelwe ukuze izimpendulo zisebenze; izimpendulo ezilandelwayo azikudingi lokho.

Gcizelela inketho, bese uhlola ukudluliselwa

Iseva ingamemezela isixazululi kumaklayenti ngenketho egcizelelwe. Leyo yinketho, hhayi umyalo okufanele uhlelo lokusebenza luwulale:

push "dhcp-option DNS 10.90.0.1"

Iklayenti le-Linux lomugqa womyalo lingadinga ukuhlanganiswa kwesixazululi kumphathi walo wokuxhumana, futhi idivayisi ephethwe ingadinga iphrofayela yokuphatha ebuyekeziwe. Ngemva kokuxhuma, qinisekisa isixazululi esisebenzayo kuklayenti esikhundleni sokucabanga ukuthi ukugcizelela kusetshenzisiwe. Lapho izindlela ezimbili zizama ukusetha i-DNS ngasikhathi sinye, uthola umncintiswano obonakala njengokuxazululwa okucwayizayo.

Umgomo uwumnikazi oyedwa wokucushwa kwesixazululi sekilayenti, futhi ukugcizelela ngokuvamile kungumnikazi lowo kuphela lapho inkundla yekilayenti ivuma.

Hlola lokho okwakhe ngempela

Buza igama eliyimfihlo eligcwele ngokufanele kanye negama langaphandle elivunyelwe ngqo ekhelini lethumbu, nge-UDP nange-TCP. Bese uphinda ngomzila wokusesha ojwayelekile wohlelo lokusebenza.

Uma imibuzo eqondile isebenza futhi uhlelo lokusebenza lusahluleka, isici sisekudluliselweni hhayi kuseva:

  • Iklayenti alikaze lisebenzise inketho egcizelelwe.
  • Esinye isixazululi sasetwa kamuva futhi sanqoba umncintiswano.
  • Uhlelo lokusebenza lusebenzisa umtapo walo wesixazululi noma impendulo egciniwe.

Qeda ngokuqinisekisa ukuthi umthombo ongaphandle komzila we-VPN ovunyiwe awukwazi nhlobo ukusebenzisa isilaleli. Ukuxazululwa okuphumelelayo akuvumeli ikheli elikubuyiselile, ngakho gcina le mibuzo emibili ihlukene.

Izihloko ezihlobene