I-Pi-hole ayivimbi izikhangiso ngemva kokuxhuma kwe-VPN: ukuhlola okuhlanu

Izikhangiso zisabonakala kuklayenti, i-Pi-hole izibika iphilile, futhi ithumbu liyasebenza, ngakho umuzwa uwukuthi ithrafikhi yaleyo klayenti ihanjiswe nge-Pi. Lelo yijika elingalungile. Ukuhlunga kudinga imibuzo, hhayi amaphakethe, futhi iklayenti okuhamba ngayo imibuzo yayo iya kusixazululi somhlinzeki ihlala ingahlungiwe noma iyiphi indawo ithrafikhi yayo ihamba kuyo. Landela lolu hlu ngokulandelana futhi ume esinyathelweni sokuqala esihlulekayo, ngoba isinyathelo sakamuva asikwazi ukukutshela lutho ngesikhathi esedlule siphukile.

1. Funda isixazululi esisetshenziswa iklayenti ngempela

Buza iklayenti, hhayi irotha. Ku-Linux i-resolvectl status iphrinta amaseva e-DNS ngokuxhumana ngakunye nokuthi yikuphi ukuxhumana okunqobayo; i-/etc/resolv.conf iyodwa ngokuvamile iyisitubu esikhomba ku-127.0.0.53. Ku-Windows i-ipconfig /all ibala amaseva anikezwe yi-DHCP ngokwesixhumi ngasinye, futhi ku-macOS i-scutil --dns ibonisa into efanayo ngokwesimo. Uma impendulo ingelona ikheli le-Pi-hole, unenkinga yokwabiwa futhi isinyathelo 2 yindawo lapho ikhona.

Izinto ezimbili zinqoba isixazululi sohlelo ngisho nalapho sisethelwe kahle. Izicukuthwane ezine-DNS yazo evikekile (inketho ye-Chrome ethi “Use secure DNS”, i-network.trr.mode ye-Firefox) zithumela imibuzo nge-HTTPS kusixazululi somphakathi futhi azilokothi zivule umbobo 53. Futhi iklayenti le-VPN kuklayenti uqobo lingafaka iseva ye-DNS kusixhumi sethumbu saso ngesizinda somzila esingu-~., lokho okwenza lokho kuxhumana kube negunya kuyo yonke igama.

Hlola indlela izinhlelo ezihamba ngayo, hhayi indlela ithuluzi lokulungisa iziphazamiso elihamba ngayo. I-resolvectl query example.com ikhombisa ukuthi yikuphi ukuxhumana okuphendulile, futhi i-getent hosts example.com ihamba ngendlela ye-NSS efanayo neyohlelo; ku-macOS i-dscacheutil -q host -a name example.com ifunda izixazululi zesimo ezibalwa yi-scutil --dns. I-dig enqunu ayikwenzi lokhu: ifunda i-/etc/resolv.conf futhi yeqe ukukhethwa ngokuxhumana, ngakho ingaphendula isuka ku-Pi-hole ngesikhathi lonke uhlelo lusebenzisa isixazululi esiqhutshwayo, futhi lokho kuyikho kanye ukwehluleka okukhona kwalolu hlu. Gcina i-dig @192.168.1.53 ukuze uhlole iseva eyodwa ethile.

2. Qinisekisa ukuthi ngubani osabalalisa impendulo

Ukwabiwa kuvela kunoma yini ephendula i-DHCP. Ku-dnsmasq kuwumugqa owodwa, i-dhcp-option=6,192.168.1.53; kusixhumi sewebhu serotha kuyinkambu ye-DNS esigabeni se-DHCP se-LAN. Amaklayenti kufanele avuselele ngaphambi kokuyibona. Idivayisi ebilokhu ivuliwe izinsuku isabambelele esivumelwaneni esidala, futhi idivayisi enesixazululi esibhalwe ngesandla iyibamba unomphela. Vuselela kuklayenti lokuhlola esikhundleni sokucabanga ukusabalala.

I-IPv6 iyingxenye eyodwa elibanziwe. Izimemezelo zerotha zingathwala iseva yazo ye-DNS (RDNSS), futhi ku-OpenWrt lokho kuyinketho ye-ra_dns ye-odhcpd; iklayenti elikhetha i-IPv6 lisebenzisa leyo seva ngesikhathi inketho ye-DHCPv4 oyisethe manje ihleli ingasetshenziswa. Uma ungakakulungeli ukukhonza i-DNS nge-IPv6, sula isimemezelo se-DNS kuphela: i-ra_dns ku-odhcpd, noma inketho ye-RDNSS kunoma yini ephendula izimemezelo zerotha. Ukucisha sonke isimemezelo kususa nokukhethwa kwe-IPv6 ku-LAN, okuwushintsho olukhulu kakhulu kunalokho obukuhlosile, kuyilapho ukusula inketho ye-DNS kuphela kugcina ukukhetha kungaphazamisekile futhi kwenza i-RDNSS engekho ibonakale ekuthunjweni kwamaphakethe.

3. Fakaza ukuthi umbuzo ufinyelela ku-Pi-hole

Umbuzo ovela ku-Pi awufakazi lutho mayelana nendlela yenethiwekhi. Wusebenzise kuklayenti bese ufunda ikhodi yempendulo:

dig @192.168.1.53 example.com
dig @192.168.1.53 doubleclick.net

Ukuphela kwesikhathi kukhombisa ukuhlunga noma umzila; i-REFUSED ikhombisa umthetho wokufinyelela; i-SERVFAIL ikhombisa isixazululi esingaphezulu ngemuva kwe-Pi-hole; impendulo efanele engalokothi ivele kungobo yemibuzo isho ukuthi iklayenti libuze enye into. Hlola i-UDP ne-TCP 53, ngoba izimpendulo ezinkulu nezinye izixazululi zibuyela ku-TCP, futhi ushicilele kokubili lapho i-Pi-hole isebenza kusiqukathi. Ukuhlelwa okuhlanganisa i-UDP kuphela kukhiqiza ukwehluleka okungapheliyo okubonakala njengokulahleka kwamaphakethe.

Ngemva kwalokho imodi yokulalela ye-Pi-hole inquma ukuthi iphendula nhlobo yini. Kumodi yasendaweni kuphela i-dnsmasq iziba imibuzo evela emithonjeni engekho kusubneti exhunywe ngqo, futhi iklayenti elingemuva kwerotha elinye noma eliza ngethumbu libonakala kanjalo impela: iklayenti liphelelwa yisikhathi futhi umbuzo awufinyeleli kungobo. Umbuzo ovela njenge-REFUSED wanqatshwa uhlu lokufinyelela noma umthetho we-firewall. Ukuvumela yonke imithombo kuyisilungiso esivamile, kuhambisana nomthetho we-firewall olinganisa umbobo 53 kumasubneti akho.

4. Hlola ukuthi ithumbu lishintshe noma lagwinya impendulo yini

Lesi yisimo lapho zombili izimpawu zicasha khona. Lapho irothi ngokwalo liyiklayenti le-VPN, inketho ye-DNS eqhutshwayo ingadlula isethingi ye-LAN ngesikhathi ithumbu likhuphuka: amaseva e-OpenVPN aqhutshela i-dhcp-option DNS, futhi amaphrofayili e-WireGuard athwala ingeno yawo ye-DNS. Funda isixazululi esisebenza serotha ngesikhathi ithumbu livuliwe, hhayi ngaphambi kwalo, futhi uzibe okushiwo yikhasi le-LAN.

Enye iphutha ukufinyeleleka, hhayi ukushintshwa. Uma iziqalo ezivunyelwe zethumbu zihlanganisa isubneti yakho ye-LAN, irothi linomzila othumela imibuzo ye-192.168.1.53 ngaphakathi ethumbu, futhi uhlangothi olunye alunamzila wokubuya: imibuzo iphelelwa yisikhathi nakuba ithumbu liphilile. Okuphambene kwenzeka lapho i-Pi-hole ihlezi kusubneti ithumbu engayithwali. Qhathanisa ikheli neziqalo ezivunyelwe zethumbu kanye nethawula yemizila yerotha ngaphambi kokuthinta i-DNS futhi.

Khetha isilungiso esisodwa, hhayi kokubili. Kuphakathi noma gcina ithumbu kude ne-DNS — nge-pull-filter ignore “dhcp-option DNS” ku-OpenVPN nangaphandle kwesiqalo se-LAN ku-AllowedIPs ku-WireGuard —, noma yamukela isixazululi esiqhutshwayo bese uyeka ukuhlunga kwasendaweni kumaklayenti angemuva kwaleyo rotha. Noma yini oyikhethayo, yibhale eduze kwephrofayili, ngoba umuntu olandelayo oyihlelayo uzophendula isinqumo ngengozi.

5. Phinda ukuhlola ngemva kokuxhuma kabusha

Buza kuklayenti, qinisekisa ukuthi leyo klayenti ivela kungobo ye-Pi-hole, bese uxazulula isizinda okufanele sivinjwe futhi uhlole ukuthi uthola impendulo yokuvimba esikhundleni yeyangempela. Xhuma ithumbu futhi, futhi wenze imibuzo emibili efanayo, ngoba isethingi yesixazululi ehlala kuphela kuze kube ukuxhumana okulandelayo iwumphumela ojwayelekile wesilungiso esisetshenziswe kungqimba engalungile.

Shiya indlela yesixazululi yesibili engathembele ethumbu, ukuze ukuphazamiseka kwe-Pi-hole kwehle ekuphequluleni okungahlungiwe esikhundleni sokungabi nakho ukuphequlula nhlobo. Gcina amanani angaphambili e-DHCP nesixazululi kuze kudlule ukuhlola kabili; ushintsho olwephula i-inthanethi yasekhaya ngesikhathi sesidlo sakusihlwa lunzima kakhulu ukululungisa kunalolo ongalubuyisela ngomzuzu owodwa.