I-DNS ehlukanisiwe ne-VPN: imithetho yesizinda akuyona imizila ye-IP
I-DNS ehlukanisiwe ikhetha isixazululi ngokwegama, futhi impendulo isadinga umzila. Hlola umthetho wesizinda nomzila ngokwehlukana, kupulatifomu oyisebenzisayo ngempela.
I-laptop yakho ixazulula i-intranet.corp ngomhubhe ngenkathi i-gitlab.com iqhubeka iya kusixazululi somhlinzeki, futhi lesi yisimo esisebenza ngendlela eyaklanywa ngayo. Izinqumo ezimbili ezihlukene zikwenzile lokhu: umthetho wokufana kwegama wakhetha isixazululi, futhi umzila waletha impendulo. Yephula noma yikuphi kukho kokubili futhi isiphequluli sizobonisa ukwehluleka okubonakala kufana ngaphandle. Imibiko eminingi ye-DNS ehlukanisiwe ichaza ukwehluleka kwesibili ngenkathi icaphuna ubufakazi mayelana nokokuqala.
Izingxenye ezimbili zihlala ezindaweni ezahlukene futhi ngokuvamile zihlelwa ngabantu abahlukene. Enye inqubomgomo ye-DNS exhunywe kuphrofayela ye-VPN, enye umzila okhishwa noma ogcinwa umhubhe. Ukuxazulula amaphutha kuyama lapho kungekho muntu ocacisa ukuthi iyiphi ingxenye eshukume ngempela.
Izinqumo ezimbili ezifihliwe esicelweni esisodwa
Ingxenye yegama iwukwakheka kwenqubomgomo, hhayi umzila. Ku-Windows kuyinqubomgomo yokuxazulula amagama kuphrofayela ye-VPN; emaplatfomu e-Apple iqoqo lamazinda afanayo entweni yezilungiselelo ze-DNS; ku-Linux isizinda somzila, umugqa wesixazululi esihlukanisiwe noma ukulandelana kwesishintshi sesevisi yegama. Ingxenye yomzila ukuhamba komzila okuvamile, okufakwa umhubhe noma ngesandla, futhi akwazi ukuthi igama lomsingathi iyini. Iphrofayela evumela isijobelelo inquma kuphela ukuthi ubani uzophendula; ayikwenzi impendulo ifinyeleleke.
Ukuhlolwa kwezimpawu okusheshayo kuyahlukanisa: faka ikheli esikhundleni segama. Uma ikheli lisebenza, umzila ulungile futhi umthetho awulungile. Uma ikheli nalo lihluleka, umthetho ungase ulungile futhi umzila ungekho.
Indlela ipulatifomu ngayinye eveza ngayo umthetho wegama ofanayo
Inhloso iyafana futhi amagama ezinkambu awafani. Isibonelo esikopishwe kusuka kwelinye iklayenti kuya kwelinye sihlaziywa ngokuhlanzekile futhi asilokothi sifane. Izimo ezintathu zibukeka kanje:
| Platform | Where the rule lives | What usually breaks |
|---|---|---|
| Windows | name-resolution policy on the VPN profile | precedence against the interface suffix list |
| Apple platforms | match domains on the DNS settings object | domains attached to the wrong extension |
| Linux | routing domain, split resolver, nsswitch order | the suffix written the wrong way round |
Isizinda sokufana noma somzila ukuhlolwa kwesijobelelo, ngakho i-intranet.corp ihlanganisa i-git.intranet.corp futhi ayihlanganisi i-corp.intranet, futhi ukuyihlanekezela yiphutha elivame kakhulu kukho konke ukulungiselela. I-Windows ithwala imephu njengenqubomgomo yokuxazulula amagama exhunywe kuphrofayela, nokulandelana kwayo kwephrimiyori uma kuqhathaniswa nanoma yiluphi uhlu lwesijobelelo okwase kukhona kusixhumi. Amaplatfomu e-Apple axhuma amazinda afanayo entweni yezilungiselelo ze-DNS yokunwetshwa kwenethiwekhi, futhi uhlelo luwasebenzisa kusixazululi ngasinye esinomkhawulo. Akukho kulawa mafomu okuwumzila, futhi akukho okungenza ikheli elingafinyeleleki lifinyeleleke. Isethenjwa inqubomgomo yokuxazulula amagama ye-Windows sibala amagama ezinkambu nemithetho yephrimiyori yaleyo pulatifomu, futhi akuwona lawo asetshenziswa amadokhumenti e-Apple noma e-systemd.
Impendulo elungile isadinga umzila
Impendulo yesixazululi iyikheli kuphela, futhi uhlelo lokusebenza kusamele lifinyelele lapho. Idizayini yomhubhe ohlukanisiwe ivamise ukusunduza i-10.20.0.0/16 futhi ibambe umzila ozenzakalelayo, ngakho igama langaphakathi liyaxazululeka bese ukuxhumana kulenga. Isimo esiphambene sivamile ngokufanayo: umzila ukhona, isixazululi esivamile siphendula igama langasese nge-NXDOMAIN, futhi ukwehluleka kubhalwa njengenkinga yomzila. Ukuhlola umzila kuqala kukushiya ubheke imizila yegama elalingeke laxazululeka.
Kukhona nesango lesithathu okungekho ngxenye eyihlanganisayo. I-ACL esangweni, umthetho we-firewall noma inqubomgomo yohlangothi lweklayenti kungadonsa ukuxhumana ngemuva kokuba zombili izinqumo zilungile. Uma igama lixazululeka, umzila ukhona futhi ukuxhumana kusaphela isikhathi, yeka ukuhlola i-DNS.
Ukuhlola amagama nemizila ngokulandelana okunqunyiwe
Khetha ukulandelana futhi unamathele kukho, kungenjalo uzoxosha isinyathelo esihluleke ekugcineni. Xazulula igama langaphakathi eliphelele elibhalwe phansi, qinisekisa ukuthi impendulo iyikheli elingathwalwa ithebula lomzila, bese uphinda ngegama elivamile ukufakazela ukuthi umhubhe awubambanga konke. Kusilawuli se-systemd umbuzo nesizinda somzila wesixazululi kuhlukaniswe umyalo owodwa:
resolvectl query intranet.corp
resolvectl domain
ip route get 10.20.5.10Iklayenti le-Windows libuza imibuzo emibili efanayo ngama-cmdlet ahlukene. Eyesibili ibika isixhumi uhlelo oluzosebenzisa ngempela:
Resolve-DnsName intranet.corp -Type A
Find-NetRoute -RemoteIPAddress 10.20.5.10Uma ukusesha kubuyisa ikheli futhi ukuhlolwa komzila kusho isixhumi somzimba, umthetho wegama usebenzile futhi umzila awusebenzanga. Uma igama elifushane lihluleka ngenkathi igama eliphelele lixazululeka, uhlu lwesijobelelo alulungile, hhayi isixazululi.
Lapho ukuqhathanisa kuvamise ukungalungi khona
Iphutha lokuqala ukubuza isixazululi esivamile esingahlobene ngokugama langasese futhi ufunde ukwenqaba njengobufakazi nge-VPN. Eyesibili ukucabanga ukuthi ukusesha okusebenzayo okuvamile kufakazela umzila wesixazululi somhubhe. Eyesithathu ukuthatha umhubhe ohlukanisiwe ne-DNS ehlukanisiwe njengesinqumo esisodwa sedizayini, kuyilapho ukusetshenziswa kungase kulunge kokunye futhi konakale kokunye. Iphutha ngalinye likhipha iziphetho eziqinisekile ekuhlolweni okungakaze kuzilolonge ingxenye esolwayo.
Isiphequluli esine-DNS yaso evikelekile singadlula umthetho wohlelo, yingakho ukuhluleka kwesiphequluli esisodwa ngenkathi esinye siphumelela akukhona ukuphikisana. Qhathanisa isixazululi esiphendulile, hhayi isiphequluli esikhale.
Lapho izingxenye zombili zibonakala, umbuzo osele umbuzo wenqubomgomo hhayi owezobuchwepheshe: yiziphi izikhala zamagama ezingezayo inhlangano, ubani ongumnikazi wempendulo ngayinye, futhi yiziphi kuzo okufanele zishiye umshini ngokuphelele. Bhala lokho eceleni kwephrofayela, ngoba umuntu olandelayo ozothinta umthetho uzokudinga.