I-DNS ephushwayo yi-OpenVPN ayinakwa: iyiphi ingxenye eyisebenzisayo

Ilogi ibonisa ukukhetha okwapushwa iseva, ithuneli liyasebenza, futhi amagama angaphakathi ahluleka namanje. Umbuzo oqondile ku-resolver uyaphendula, ngakho iseva ilungile, kodwa uhlelo ngalunye luqhubeka lubuza i-router yendawo. Okwafinyelela iklayenti isiphakamiso, hhayi ushintsho ku-resolver, futhi ingxenye ephethe ukuxazululwa kwamagama iyahluka ku-Linux, Windows naku-macOS. Uma uhlukanisa ukukhetha kumnikazi wakho, amaphutha amane amboza cishe yonke imibiko: ayikho ihuku, amahuku amabili ancintisanayo, i-DNS ehlukanisiwe esebenza ngendlela eyakhiwe ngayo, noma igama elifushane elidinga isijobelelo hhayi iseva.

Ukukhetha okupushwayo isiphakamiso, hhayi ukufakwa

Kuseva, imiyalo emibili ichaza inhloso, hhayi umphumela:

push "dhcp-option DNS 10.8.0.1"
push "dhcp-option DOMAIN corp.example"

Iklayenti alitholi i-resolver elungisiwe. Lithola okuguquguqukayo kwemvelo, foreign_option_1 nokulandelayo, okukodwa ngomugqa ngamunye opushwayo, futhi okuthile kwendawo kufanele kukufunde futhi kubhale kabusha isimo se-resolver sohlelo lokusebenza. Ku-Linux akukho lutho olwenza lokho ngokuzenzakalela, yingakho iseva efanele neklayenti elixhunyiwe kusengakwazi ukuxazulula amagama nge-LAN.

Phakathi kwemikhawulo emibili kunezigaba ezintathu: ukupusha kufanele kufinyelele, iklayenti kufanele kukwembule, futhi ihuku kufanele kukusebenzise. Funda isigaba esiphakathi kwilog ye-klayenti nesokugcina esimweni se-resolver, hhayi okuphambene nalokho, ngoba umugqa welogi ufakazela emibili yokuqala kuphela.

Qinisekisa ukuthi ukupusha kufinyelele futhi uthole umnikazi

Qala ngokusho umqalisi: umyalo openvpn olula, isibonelo se-systemd, i-NetworkManager noma iklayenti lomkhiqizi. Lokho kunquma ukuthi ihuku lingahlala kuphi. Kusinikeza i-systemd-resolved, resolvectl status kubala uxhaxha ngalunye ngamaseva e-DNS namadomeni okusesha eliwasetshenzisayo ngempela, futhi uxhaxha lwethuneli aluhlali lubizwa tun0.

Uma ikheli elipushwayo livela kwilog kodwa kungekho kuxhaxha, ukuhlanganiswa akukho. Uma livela kuxhaxha futhi imibuzo isaphuma kwenye indawo, inkinga iwukuthi yimiphi imibuzo ekhetha lolo xhaxha. I-NetworkManager dns=dnsmasq kufayela /etc/NetworkManager/NetworkManager.conf iqalisa isidluliseli sendawo esisebenzisa i-DNS ehlukanisiwe ngamabomu: amagama angaphakathi kwisizinda se-VPN aya ku-resolver ye-VPN, konke okunye kugcina indlela yako yangaphambili. Lokhu kuziphatha kubonakala njengephutha lapho ubulindele ukuthi yonke i-traffic ihambe; hlola izilungiselelo zoxhaxha ngalunye nge nmcli connection show "My VPN", lapho ipv4.dns futhi ipv4.dns-search kugcina amanani angemuva kwalokho okubikwa yithuluzi, ngaphambi kokukubiza ngokuthi konakele. Uma umbuzo ngamunye kufanele ufinyelele ku-resolver ye-VPN, susa dns=dnsmasq ku NetworkManager.conf futhi uqalise kabusha i-NetworkManager, okubuyisela ukuxazululwa kwezilungiselelo zoxhaxha; uma kungenjalo gcina i-DNS ehlukanisiwe futhi ulungise uhlu lwezizinda olupushwayo.

Linux: nikeza izinketho ku-resolver

Amaphakethe okusabalalisa aletha ihuku yalokhu, futhi iklayenti kufanele livunyelwe ukuyisebenzisa. Ukuhlelwa okuvamile kusinikeza ngaphandle kwe-systemd-resolved:

script-security 2
up /etc/openvpn/update-resolv-conf
down /etc/openvpn/update-resolv-conf

Nge-systemd-resolved iskripthi esidala se-resolv.conf singase singashintshi lutho olubalulekile, ngoba i-stub resolver igcina isimo ngoxhaxha ngalunye. update-systemd-resolved umsizi ubhala uhlobo lwehuku olusebenzisa up-restart futhi down-pre, okubalulekile lapho i-interface iphila isikhathi eside kunomzamo woxhaxha owodwa. Noma yini oyikhethayo, ingxenye eyodwa kufanele iphathe isimo. Ukwengeza ihuku engahlobene eduze kwe-NetworkManager kunikeza ababhali ababili uxhaxha olulodwa, futhi umphumela lapho uncike ekulandeleni hhayi ekulungiseni kwakho.

Kukhona futhi isimo lapho i-NetworkManager yashaya indiva ngokuphelele ukukhetha okupushwayo kwaze kwaba yilapho ikheli leseva lifakwa ezilungiselelweni ze-IPv4 zoxhaxha, kwase kuthi isimo se-resolver sibonise ukuthi liyasetshenziswa. Kufanele ukuzame ngaphambi kokubhala kabusha amaskripthi, ngoba kudlulisela inkinga isuka kuhuku ye-shell iye kuphrofayela yoxhaxha osevele ithwele ithuneli.

I-Windows ne-macOS zisebenzisa izingxenye ezihlukene

Iklayenti le-Windows liyasetha amaseva e-DNS e-adaptha ye-VPN, kodwa i-Windows isakhetha i-interface ngemethrikhi futhi isadinga isijobelelo ukwandisa igama elifushane. Qinisekisa isimo se-adaptha hhayi iphrofayela:

Get-DnsClientServerAddress -InterfaceAlias "My VPN"
Get-DnsClientNrptPolicy

Uma ikheli lingekho, lisethe nge Set-DnsClientServerAddress -InterfaceAlias "My VPN" -ServerAddresses 10.8.0.1, bese wengeza isijobelelo ezimpawini ze-IPv4 ze-adaptha ukuze fileserver kube fileserver.corp.example. Inani SearchList lomshini wonke ngaphansi kwe Tcpip\Parameters lenza okufanayo. Lapho igama elide lixazululwa futhi elinqunu lingaxazululwa, i-resolver isivele ilungile futhi inegeke uhlu lokusesha. Izilungiso, ngokulandelana: pusha DOMAIN ukuze iklayenti lifunde isijobelelo, engeza leso sijobelelo ohlwini lokusesha lwe-adaptha noma loxhaxha, futhi njengesinyathelo sesikhashana bopha igama ku hosts, noma ku LMHOSTS ku-Windows; ukuphequlula kwe-NetBIOS akweqi i-router, ngakho ukusakaza okuthola igama elifushane ku-LAN yasehhovisi akufinyeleli neze ku-klayenti yethuneli.

block-outside-dns I-block-outside-dns iwukuziphatha kweklayenti le-Windows, hhayi umugqa wephrofayela ohambayo, futhi ukukukopela kuphrofayela ye-Linux noma ye-macOS akukubuyiseli lapho. Uma amagama omphakathi esebenza futhi awangaphakathi ehluleka ku-Windows, qhathanisa ukulandelana kwe-adaptha ngaphansi kwezilungiselelo ezithuthukisiwe ne ipconfig /all. Ku-macOS ukulandelana kwe-resolver ngesevisi ngayinye kungokwesistimu, ngakho sebenzisa scutil --dns ukubona iyiphi i-resolver ebuzwayo ngesizinda sini, futhi thubhela noma yikuphi ukulungiswa kwephrofayela okukodwa okubikiwe njengokuncike ku-klayenti hhayi okujwayelekile.

Umshini ongokoqobo ku-laptop efanayo awutholi lutho kulokhu. Nikeza isivakashi ukungena kwayo kwe-resolver kwesizinda sangaphakathi, noma vumela i-NAT ye-hypervisor idlulise imibuzo yayo ngokusebenzisa umsingathi, okulungile kuphela ngesikhathi ithuneli yomsingathi isebenza.

Umlando uyimbangela yesithathu. Amaseva e-DNS noma izilungiselelo zesijobelelo zephrofayela yangaphambili zingasinda ekuxhumaneni kabusha, ngakho uma i-adaptha ibonakala ilungile futhi ukusesha kusahluleka, qhathanisa i-adaptha ephilayo ne Get-VpnConnection futhi susa noma ubhale phezu kokungena okuphelelwe yisikhathi ngaphambi kokuthinta iseva.

Fakazela ukuthi umbuzo waya kuphi

Ukuthwebula ngesikhathi sokusesha okukodwa kuqeda impikiswano: tcpdump -ni eth0 port 53 kubonisa imibuzo ku-interface ebonakalayo, okusho ukuthi iphuma ngaphandle kwethuneli futhi i-resolver ayikaze ishintshwe. dig @10.8.0.1 name.corp.example bese ihlukanisa izimo ezimbili ezisele. Uma umbuzo oqondile uphendula, i-resolver iyasebenza futhi iklayenti aliyisebenzisi; uma kuphelelwa yisikhathi, i-resolver ayifinyeleleki ngethuneli futhi akukho shintsho lendawo oluzosiza.

Uma i-resolver esasetshenziswa ingenye eyanikezwa umhlinzeki, ithuneli ibethela i-traffic kodwa amagama ahlala ebonakala kulowo mhlinzeki. Lona umbuzo wokuvuza hhayi wokusebenza, futhi ukuthwebula okufanayo uyawuphendula: umbuzo ku-interface ebonakalayo uya komunye ongaphandle kwethuneli.

Ukufinyeleleka kuhlanganisa i-firewall kumsingathi we-VPN, okufanele ivumele i-UDP ne-TCP 53 evela echibini. Iphothi elivaliwe libonakala njengokupusha okonakele, futhi kanjalo ne-resolver ephendula kuphela ngaphakathi kwenethiwekhi yethuneli. Phinda ukuthwebula ngemva kokunqamula nokuxhuma kabusha kanye, ngoba izilungiselelo ezivela ekuxhumaneni kokuqala futhi zinyamalale kwesesibili ziyiphutha lomjikelezo wokuphila kuhuku, hhayi ukukhetha okungekho.

Gcina umnikazi oyedwa futhi uqinisekise ngokulandelana

Iskripthi esibhala kabusha i-DNS ye-adaptha ngokusekelwe esimweni sethuneli esicatshangelwayo siphindaphinda ukulungiswa okuvele kuthwelwe iphrofayela, futhi sihluleka buthule okokuqala lapho ukuqagela kungalungile. Khetha izilungiselelo ze-DNS zoxhaxha ngokwalo noma ihuku eyodwa ebhaliwe, futhi bhala ukuthi ukhethe yiphi ukuze umuntu olandelayo angangezi eyesibili.

Vala umjikelezo ngezinto ezine zokuhlola: ikheli elipushwayo likhona kuxhaxha lwethuneli, igama langaphakathi lixazululwa njengegama eligcwele, igama elifanayo lixazululwa ngaphandle kwesijobelelo, futhi kokubili kusenzeka ngemva kokuxhuma kabusha kanye. Ukuthwebula okukodwa kukutshela ukuthi yikuphi kokune okuhlulekile. Incwadi ye-OpenVPN 2.6 ibala dhcp-option kanye nemiyalo yamaskripthi namazwi ayo eplathifomu.