Amagama e-VPN angasese ahluleka? Ukuzivikela kwe-DNS rebinding yikhona okusolwayo

Ku-LAN yasehhovisi igama langaphakathi liphendula ngokushesha. Uma i-VPN isikhona liyeka ukusebenza, uhlelo lubika isikhathi sokuphela, kanti ithuna uqobo lidlulisa ithrafikhi ngaphandle kokukhononda. Okwashintshayo isixazululi, futhi leso sixazululi sinombono waso mayelana namakheli angasese.

Isivikelo se-rebinding sikhona ukuze simise iqhinga elithile. Igama langasese elishicilelwe ngamabomu libonakala lifana ngokwanele ukuthi isivikelo sisebenze.

Funda impendulo ngaphambi kwenqubomgomo

Buza igama kusixazululi esisatshalaliswa yi-VPN ngempela, hhayi leso ikhompyutha yakho ephathekayo esisebenzisa ekhaya. Qhathanisa impendulo nerekhodi oyilindele, futhi ubhale ukuthi impendulo ayinalutho, yenqatshiwe, noma igcwele amakheli omphakathi okungekho muntu owawuhlele.

Izimpawu ziyahlangana, ngakho ukuma kwempendulo yikho okunquma ukuxilongwa. I-NXDOMAIN yirekhodi elahlekile, i-REFUSED umthetho wokufinyelela, ikheli lomphakathi egameni langaphakathi iphutha lenqubomgomo noma le-split DNS, futhi ikheli langasese elilungile iklayenti elingakwazi ukulisebenzisa liyinkinga ehluke ngokuphelele. Ukuxhumana okwenqatshiwe noma isicelo esimile kakukufakazeli lutho ngokwako, yingakho umyalo wokuqala kumathikithi anjalo kufanele kube ukusesha hhayi ukuqala kabusha. Bhala phansi impendulo ngaphambi kokushintsha noma yini.

Isivikelo sivimbelani ngempela

I-DNS rebinding isebenza ngokushintsha ukuthi igama lixazululeka libe yini ngemva kokuba iklayenti selithembile. Ikhasi lilayishwa lisuka egameni elilawulwa umhlaseli, impendulo iphendukela ekhelini langasese, futhi isiphequluli siyakhohliswa ukuba sikhulume nokuthile kwinethiwekhi yasendaweni ebesingeke sasamukela ukuxhumana okuqondile nakho. Isivikelo siwukwenqaba izimpendulo ezikhomba endaweni yangasese lapho isixazululi singakaze sicelwe ukuthi sisebenzele indawo yamagama yangasese. Lokho kungalingani yikho konke ukuhlasela.

I-dnsmasq ibhala phansi ngqo lokho kuziphatha, kanye nokuhlukile esigabeni ngasinye segama. Encwadini yayo yokuhola ichaza rebind-domain-ok njengendlela yokuqamba amagama ezizinda ezingabuyisela ngokusemthethweni amakheli anjalo. Kufunde njengophawu lokuthi ukulungiswa okuhloswe wukuvunyelwa okulinganiselwe, hhayi iswishi yomhlaba wonke.

Nciphisa okuhlukile endaweni yamagama

Lungisa kuqala indawo yamagama, bese kuba okuhlukile. Qinisekisa ukuthi igama elihlulekayo lingelikaqamba elilawulwa inhlangano nokuthi irekhodi linakekelwa ngamabomu. Ikheli elingalindelekile elifana kuphela nobubanzi be-LAN olujwayelekile lifanele ukusolwa, hhayi ukuhlukile, ngakho hlola umnikazi wesigaba ngaphambi kokubhala noma yikuphi ukuvunyelwa.

# ask the resolver the VPN pushed, and show the full answer
dig +noall +answer db.corp.example @10.40.0.1
dig +short db.corp.example @10.40.0.1

# dnsmasq: what does the running configuration already allow?
grep -R 'rebind' /etc/dnsmasq.d /etc/dnsmasq.conf

Bese ufaka ukuvunyelwa okuncane kakhulu okuhlanganisa amagama ahlosiwe: isizinda esisodwa, noma isizinda esingaphansi esisodwa esithunyiwe, ekulungiselelweni kwesixazululi okubuzwa ngamaklayenti e-VPN. Ukucisha isivikelo kuwo wonke amagama kuleso sixazululi kususa isivikelo kuwo wonke ngasikhathi sinye, kufaka namagama angakaze akudinga.

I-Split DNS iyingxenye yesinqumo esifanayo. Uma indawo yamagama yangasese kufanele iphendulwe yisixazululi sangaphakathi kuphela, yishicilele lapho futhi uyeke ukuvuza kwayo kusixazululi somphakathi, ukuze okuhlukile kuhlanganise indlela eyodwa hhayi zonke izindlela.

Phinda uhlole insiza nesivikelo

Buza futhi, bese uxhuma enkonzweni futhi uhlole ukuthi iklayenti libona ini. Impendulo yangasese elungile enesikhathi sokusebenza esisebenzayo isho ukuthi okuhlukile kufakiwe. Impendulo elungile enesikhathi esimile isho ukuthi umsolwa olandelayo umzila noma ubunikazi benkonzo.

# the internal name and the public control should behave differently
dig +short db.corp.example @10.40.0.1
dig +short www.example.com @10.40.0.1

# and the service itself, with the certificate it presents
curl -sS -o /dev/null -w '%{http_code}\n' https://db.corp.example/health

Hlola negama lomphakathi ngesixazululi esifanayo. Isivikelo kufanele sisasebenza ngendlela efanele emagameni angaphandle kokuhlukile, futhi uma lokho kuhlola kwehluleka, ushintsho lwalubanzi kunalokho obekuhloswe. Ungathinti ukuqinisekiswa kwezitifiketi ngaso sonke isikhathi, ngoba igama elixazululeka ngendlela efanele kusamele lihambisane nesitifiketi esethulwa yinkonzo.

Bhala ethikithini impendulo enqatshiwe, isizinda, isixazululi nokuthi ubani umnikazi wenqubomgomo. Lowo mbhalo yiwona oguqula ukuphazamiseka kwangaphakathi okungaqondakali kube ushintsho lokulungiselela umuntu angalubuyekeza.