Kungani i-DNS yerutha ngokwayo yeqa umhubhe we-VPN?

Ukusesha kwekliyenti kulandela umhubhe, kuyilapho ukusesha kwerutha ngokwayo kuphuma nge-WAN, futhi umthetho wodonga lomlilo olawula owodwa awunawo umthelela kwesinye. Isizathu akusona iphutha: isicelo esidlulisiwe kanye nesicelo esakhiwe yirutha ngokwayo kuyimigudu emibili ehlukene, futhi ngayinye iqhathaniswa nengxenye ehlukile yokuhlelwa. Ukubamba uhhafu wekliyenti kuphela kunikeza impendulo eqinisekile mayelana nomkhondo ongasetshenziswa neze uhhafu wesibili. Isixazululo siwukuqondisa ngamabomu isixazululi serutha, bese uhlola imikhondo emibili ngokwehlukana.

Yimuphi umgudu okubhalwa kwamaphakethe okungowakho ngempela

Ukusesha okukodwa kufaka izinguquko ezimbili. Ikliyenti le-LAN lithumela umbuzo kwisixazululi serutha, futhi ufika njengethrafikhi edlulisiwe kusixhumanisi se-LAN, ngakho umthetho womkhondo wenqubomgomo noma umthetho we-NAT obhalelwe amaphakethe adlulisiwe ungavumelana nawo. Bese irutha liphendula lisuka kusilondolozi noma, uma kungenjalo, livula umbuzo walo siya kuseva ephezulu.

Lowo mbuzo wesibili unerutha njengomthombo nanjengendawo yalo, futhi isigaba sikhetha umkhondo walo kusuka kwelinye ibhlokhi yokuhlelwa. Izinguquko zombili zithwala igama elifanayo, futhi akukho okukodwa okuyikhophi yokunye. Ngakho ukubamba okwenziwe ohlangothini lwe-LAN kubonisa ukuthi iphakethe lekliyenti laya kuphi futhi akusho lutho ngephakethe eliphumayo.

Ukuhlola okungokoqobo ukuqaphela izinhlangothi zombili ngasikhathi sinye. Kurutha, bhala uhlu lwesokhethi yesixazululi, buza kuso endaweni futhi ubambe isixhumanisi se-WAN:

sockstat -4 -l | grep :53
dig +short @127.0.0.1 example.com
tcpdump -ni igb0 udp port 53

Uma uhlu lwamasokhethi lubonisa isilaleli esiboshelwe ekhelini le-loopback noma le-LAN, irutha liphendula endaweni esikhundleni sokudlulisela kwenye ihosti. Bese ukubamba kubonisa ukuthi umbuzo waphezulu ovelayo uphuma ngesixhumanisi somhubhe noma nge-WAN, futhi yilokho impendulo umthetho womkhondo wenqubomgomo ongasoze wayinikeza.

Kungani umkhondo wenqubomgomo ungalokothi ubone umbuzo wesibili

Imithetho yodonga lomlilo ibhalelwa isixhumanisi, umthombo, indawo ekuyiwa kuyo kanye nechweba, futhi ihlolwa ngamaphakethe adlula kudivayisi. Umbuzo owakhiwe yirutha awudluli lutho, ngoba inqubo yendawo iwunikeza ngqo ithebula lomkhondo. Ukuhamba ngomkhondo kwenqubomgomo kanye ne-NAT ngakho kusebenza emkhondweni odlulisiwe kuphela, futhi yingakho isethi yemithetho ingabonakala igcwele kodwa ishiye i-DNS yerutha ngaphandle komhubhe.

Lo mehluko uhlala ukhona ngemva kwakho konke ukubhalwa kabusha kwefirmware ngoba uvela emkhondweni wephakethe hhayi esicini. Konke okwakhiwa idivayisi ukuze kusisebenzele, kungaba imibuzo yesixazululi, ukuvumelanisa isikhathi, ukuhlola izibuyekezo noma ukufinyelela ezibukweni zamaphakethe, kunomsuka wendawo futhi kuwela endaweni eyodwa engabonakali. Yingakho futhi ukuhlola okwenziwe kusuka kukhompyutha ephathwayo kungafakazi lutho ngerutha.

Isixazululi se-pfSense sinquma kuphi umkhondo waso waphezulu

I-pfSense yenza lokho kwehlukana kubonakale. Ithrafikhi yekliyenti ingahamba ngomkhondo wenqubomgomo ngesango le-VPN kuyilapho ithrafikhi yodonga lomlilo ngokwayo ilandela isethingi yokuphuma yesixazululi hhayi imithetho ye-LAN. Kusixhumanisi sewebhu leso sethingi singaphansi kwe Services > DNS Resolver > Outgoing Network Interfaces, futhi inani laso uhlu lwezixhumanisi isixazululi esingazisebenzisa emibuzweni yaphezulu.

Ukuqamba isixhumanisi somhubhe lapho, futhi leso sixhumanisi kuphela, yikho okwenza ukusesha kwerutha ngokwayo kulandele umhubhe. Uma kushiwo okumisiwe, isixazululi sikhetha umkhondo wokuphuma ovela kuthebula lomkhondo, okuthi kuhosti ene-WAN ezimbili noma i-VPN kuvame ukuba yi-WAN.

Amanye amafirmware aveza isinqumo esifanayo ngaphansi kwelebuli ehlukile: uhlu lwamaseva aphezulu oluboshelwe ekhelini lomthombo, imodi yokudlulisa kuphela, noma inqubomgomo yomkhondo ebhaliwe. Isethingi okufanele sihanjwe yileso esikhetha umkhondo wokuphuma noma umthombo emibuzweni eyakhiwe endaweni njalo. Incwadi yokuhlelwa kwesixazululi ibhala lokho kukhetha kwe-pfSense futhi kufanele kufundwe ngaphambi koshintsho.

Khetha ukuziphatha kokwehluleka ngaphambi kwesethingi

Uma umhubhe uwile, izindlela ezimbili zokuziphatha ziyavikeleka: misa imibuzo yaphezulu ukuze kungavuzi lutho, noma buyela kusixazululi esigunyaziwe emkhondweni owaziwayo. Zombili ziyinqubomgomo, futhi akukho okukodwa okutholakala ngokumisiwe. Nquma ukuthi iyiphi idingwa inethiwekhi ngaphambi kokuthinta uhlu lwezixhumanisi.

Ukuvala ngesikhathi sokwehluleka kulula ukuvikela, kodwa kuguqula ukunqamuka komhubhe kube ukunqamuka kokuxazululwa kwamagama kuyo yonke idivayisi engemuva kwerutha. Ukubuyela kugcina ihhovisi lisebenzeka, ngezindleko zokushintshana kwaphezulu ngaphandle komhubhe okufanele kwamukeleke ngamabomu hhayi ngephutha. Bhala ukukhetha, ngoba umuntu olandelayo obona ikheli lesixazululi ngaphandle kwe-VPN uzolifunda njengokuvuza ngaphandle uma inothi lisho okunye. Lelo nothi yilo elihlukanisa ukubuyela okubhaliwe ekutholakaleni okungachazwanga ekubuyekezweni kwekota elandelayo.

Izimo ezimbili zenza isinqumo sibe nzima. Amagama ayimfihlo angadinga isixazululi sangaphakathi umhubhe ongafinyelela kuso, futhi isiphequluli noma uhlelo olune-DNS yalo ebethelwe lungadlula ngokuphelele irutha, ngakho isixazululi osihlelile akusona njalo leso esisetshenziswa uhlelo oluthile.

Hlola imikhondo yomibili futhi gcina imiphumela yahlukene

Ukuhlola kwe-DNS kusiphequluli kuphendula umbuzo omncane: yimiphi imixazululi eyasetshenziswa yileso siphequluli ngaphansi kwezimo zalokho kuhlola. Akubhali izinto zenethiwekhi futhi akukwazi ukubona umbuzo owakhiwe yirutha ukuze kusisebenzele. Thatha umphumela walo njengephoyinti elilodwa ledatha hhayi njengokuhlola okuphelele.

Kusuka kukliyenti le-LAN, cela irutha igama lomphakathi bese ucela igama eliyimfihlo okufanele liphendule kuphela indawo yakho yangaphakathi. Ukwehluleka embuzweni wesibili kuphela kukhombisa ukudluliswa kwamagama hhayi umhubhe:

dig @192.168.1.1 example.com
dig @192.168.1.1 intranet.example.lan

Bese wehlisa umhubhe futhi uphinda imibuzo yomibili. Izimpendulo ezenqatshiwe zisho ukuthi isixazululi siyavala ekwehlulekeni; impendulo ephumelelayo ikhombisa isixazululi esiyisipele kanye nomkhondo esiwusebenzisile. Qhathanisa lokho nenothi olibhalile kanye nokubamba kusixhumanisi se-WAN okuthathwe ngumzuzu ofanayo.

Gcina okubonwayo kwahlukene kubhuku: ukushintshana kwekliyenti nerutha, ukushintshana kwerutha neseva ephezulu, kanye nokuhlelwa okwanquma okwesibili. Ushintsho lomkhondo lwakamuva luzosebenzisa lokho kushintshana kwesibili ngaphandle kwesixwayiso. Impendulo efika kwelinye ikheli ngaphandle kwendawo yokugcina ye-VPN ayikona ukuvuza ngokwayo; iba ukuvuza kuphela uma ukuhlelwa kukhethe lowo mkhondo ngephutha.