I-OpenVPN kuphothi 53: izingxoxo ezintathu abantu abazididayo
Ukuxazululwa kwegama lendawo yokugcina, ukuthuthwa okubethelwe kanye ne-DNS ngemva komhubhe kuyizingxoxo ezintathu. Khomba ukuthi yisiphi isigaba esihlulekile ngaphambi kokushintsha iphothi noma isixazululi.
Imibiko ethi i-VPN ivinjiwe kuphothi 53 ihlanganisa ukubheka okuthathu okuhluleka ngezizathu ezihlukene. Ukuxazululwa kwegama lendawo yokugcina kwenzeka ngaphambi kokuba kube khona umhubhe, ukuthuthwa okubethelwe kuyingxoxo ehlukile, futhi imibuzo ye-DNS eyenziwa ngemva kwalokho ingeyesithathu. Ngakunye kunophawu lwakho lokuhluleka, futhi kukodwa kuphela okuhlobene ne-DNS.
Ngaphambi kokushintsha noma yini, hlukanisa amaphakethe ngokwenhloso yawo, ngoba ukulungiswa kulandela isigaba.
Izingxoxo ezintathu, inombolo yephothi eyodwa
Ingxoxo yokuqala ukufunwa kwegama lendawo yokugcina: umshini wakho ubuza isixazululi esilungisiwe ukuthi i-vpn.example.com ikuphi, futhi leyo mpendulo ifika nge-DNS evamile ngaphambi kokuba iklayenti lithumele ngisho iphakethe elilodwa lomhubhe. Eyesibili ukuthuthwa kwe-OpenVPN uqobo, okuxhuma ekhelini elitholwe ukufuna, ngephrothokholi nangephothi okusho uhlu lwezilungiselelo. Eyesithathu kwenzeka ngemva kokuba umhubhe unyuke, lapho izinhlelo zicela amagama futhi izilungiselelo zesixazululi ezithunyelwe zinquma ukuthi ngubani ozophendula.
Lokhu kuthathu kungaphumelela noma kuhluleke ngokuzimela. Iklayenti lingaxazulula ingxenye yalo yokugcina ngokuphelele kodwa lihluleke ukufinyelela umlaleli, futhi lingasungula umhubhe kuyilapho ukufunwa kwegama ngalinye langaphakathi kuhluleka ngoba izilungiselelo ze-DNS azikaze zifike.
| Conversation | When it happens | What has to be true |
|---|---|---|
| Endpoint lookup | Before the client contacts a hostname | An underlying resolver path can answer for the endpoint name |
| OpenVPN transport | During tunnel establishment | The gateway listens on its configured transport, address and port, and nothing filters it |
| Application DNS | During or after the protected session | A resolver the client can reach, plus routing that carries its queries |
Funda ithebula njengohlu lokuhlola hhayi njengencazelo. Uma igama lendawo yokugcina lingaxazululeki, akukho okunye okungasebenza ngemva kwalokho, futhi umhubhe awuqali neze.
Inombolo yephothi ayiliqambeli igama uhlelo
Iphothi 53 ithwala i-DNS ngokwesiko, futhi umqhubi we-OpenVPN angashicilela nomlaleli lapho, yikho kanye le nombolo iyisihlonzi esingesihle. Isikhathi se-OpenVPN ku-UDP 53 siseyisikhathi se-OpenVPN, futhi umbuzo we-DNS oya kuseva kuphothi 53 awusho lutho mayelana nokuthi umhubhe uvunyelwe yini. Imigqa proto ne remote yohlu lwezilungiselelo ichaza indawo yokugcina yangaphandle; inombolo yephothi ngokwayo ayichazi lutho.
Lapho uhlola, lokhu kusika nhlangothi zombili: ukuhlolwa kwe-UDP okuvamile okuya kuphothi 53 kufakazela ukuthi iphothi liyaphendula, hhayi ukuthi insizakalo ye-VPN iyaphendula. Hlola ngeklayenti langempela nohlu lwezilungiselelo lwangempela, ngoba yikhona kuphela okuqeqesha ukuxhawulana insizakalo ekulindele.
Fakazela umlaleli ngaphambi kokusola inethiwekhi
Kuseva, qinisekisa ukuthi yini eboshiwe nge-ss -lunp | grep 53 bese uyiqhathanisa nephrothokholi nephothi yohlu lwezilungiselelo. Kusukela kunethiwekhi yeklayenti, sebenzisa iklayenti ngemininingwane eminingi ukuze ilogi itshengise ukuthi yiliphi ikheli nokuthuthwa elikuzamile. Uma iseva ilalela futhi amaphakethe eklayenti engafiki, indlela noma inqubomgomo iyawenqaba, futhi lokho kuyingxoxo nomnikazi wenethiwekhi hhayi isizathu sokushintsha iphothi.
Enye iphothi isiza kuphela uma insizakalo ilalela lapho ngempela futhi ukuthunyelwa kuvuma. Ukuhambisa umlaleli ukuze ugweme ukuhlungwa kwenethiwekhi ephethwe kuyisinqumo senqubomgomo, hhayi isigaba sokuxazulula inkinga. Buza umnikazi wenethiwekhi ukuthi yini evunyelwe ngaphambi kokushintsha insizakalo, ngoba indlela yokugwema ephula inqubomgomo iyavalwa ngemva kwalokho noma kunjalo. Bhala leyo mpendulo eceleni kohlu lwezilungiselelo ukuze umuntu olandelayo angaphindi isicelo.
Hlola i-DNS ngemva komhubhe, ngokwehlukana
Lapho umhubhe unyukile, hlola isimo sesixazululi kusixhumi se-VPN bese ubuza igama elilodwa langaphakathi negama elilodwa lomphakathi. Uma amagama angaphakathi ehluleka ngesikhathi umhubhe uthwala ithrafikhi, izilungiselelo ze-DNS ezithunyelwe azizange zisetshenziswe, okuyindaba yokuhlanganiswa kweklayenti hhayi yokuthuthwa. Uma amagama omphakathi ehluleka futhi amagama angaphakathi esebenza, inqubomgomo yomhubhe ohlukanisiwe yenza okulungiselelwe kona.
Shiya izinguquko ze-DNS kumnikazi wesixazululi. Ukubhala phezu kokulungiselelwa kwesixazululi esiphethwe ukuze ukuhlolwa okukodwa kudlule kungase kuphule amagama ayimfihlo kukho konke okunye kumshini. Uma umhubhe uthumela isixazululi futhi iklayenti lingakunaki, lungisa ukuhlanganiswa kweklayenti esikhundleni sokwengeza ingeno emile kwenye indawo. Izingeno ezimile zifihla ukuhluleka kuze kube umuntu ushintsha inethiwekhi. Bhala ukuthi yisiphi isixazululi okulindeleke ukuthi siphendule endaweni ngayinye yamagama.