Misa amasevisi amabili e-Linux alwela i-/etc/resolv.conf

I-DNS ihlala ibuyela esimweni sayo sangaphambili, ukuxhuma kabusha kwe-VPN kubuyisela emuva ukulungisa kwakho, futhi ekugcineni othile eqenjini uphakamisa ukuthi ifayela likhiywe. Leyo ndlela iyisibonakaliso, hhayi isisombululo: izingxenye ezimbili zombili zicabanga ukuthi ziphethe i-/etc/resolv.conf, futhi lowo obhala ekugcineni uyanqoba. Ukukhiya ifayela akuxazululi ukungqubuzana kobunikazi, kukufihla kuphela futhi kugcina kwephula ingxenye obuyifuna ngempela. Yenza izivivinyo ezine ngezansi ngokulandelana, futhi lungisa ukuhleleka ezingeni elikuphethe, hhayi efayeleni.

Isivivinyo 1: ingabe isixhumanisi esingokomfanekiso, futhi siya kuphi

Qala ngefayela ngokwalo, ngoba indlela oyihlelayo kungenzeka ukuthi ayilona ifayela nhlobo. Isixhumanisi esingokomfanekiso esiya kukhombisa yesikhathi sokusebenza yesixazululi siziphatha ngendlela ehluke ngokuphelele kusukela kufayela elivamile elibhalwa kabusha ngumbhalo wesikhombisi:

ls -l /etc/resolv.conf
readlink -f /etc/resolv.conf
cat /etc/resolv.conf

Isixhumanisi esiya endleleni ye-stub ye-systemd-resolved sisho ukuthi okuqukethwe kwefayela kuyakhiqizwa, futhi ukuhlelwa ngesandla kuzobhalwa phezu kwakho emcimbini olandelayo. Ifayela elivamile elinemigqa ye-nameserver ngokuvamile libhalwa yikhona iklayenti noma i-hook ye-DHCP esebenza lapho ixhuma. Kokubili kusemthethweni; okubalulekile ukwazi ukuthi yikuphi onakho ngaphambi kokushintsha noma yini.

Isivivinyo 2: iyiphi i-daemon esebenzayo

Thola ukuthi yini esebenza ngempela, hhayi ukuthi yini efakiwe. Kusatshalaliswa kwesimanjemanje kungaba nezixazululi eziningi, futhi esibamba umgudu 53 kusixhumanisi se-loopback yiso esiphendulayo:

systemctl status systemd-resolved --no-pager
resolvectl status
ss -lunp | grep ':53'

Umphumela wesimo usho amaseva e-DNS ngokuxhumanisa ngakunye kanye nezizinda zokuhamba komgudu, futhi yilowo oyimephu oyidingayo ye-split DNS. Uma amagama angaphakathi kufanele aye kuseva yangaphakathi futhi konke okunye kuye kwelinye elivamile, leyo nqubomgomo ihlala ezizindeni zokuxhumanisa ngakunye, futhi ukuyenza ibe lulaza ohlwini lwe-nameserver olungaguquki efayeleni kulahlekelwa yilowo mehluko ngokuthula.

Ukulungiselelwa kwe-NetworkManager ngokwako kunquma ukuthi iyiphi kulezi backend ezisetshenziswayo. Isilungiselelo sayo se-dns= efayeleni eliyinhloko lokulungiselela sikhetha phakathi kwesixazululi sayo sangaphakathi, i-dnsmasq, i-systemd-resolved ne-none, futhi ukusatshalaliswa kungenzeka ukuthi ikukhethele. Funda leso silungiselelo ngaphambi kokunquma ukuthi “ukulungisa i-DNS” kusho ukuthini kulesi sifaki.

Isivivinyo 3: yini iklayenti le-VPN evunyelwe ukuyibhala

Lapha ngokuvamile kuhlala ukungqubuzana. Iklayenti le-VPN elibhala kabusha ifayela lesixazululi ngqo lizolwa nayo yonke insizakalo eyondla nayo, futhi ohlulwayo ukuthi nguyena oqala ukusebenza. Izinguqulo ezintsha ze-OpenVPN zinganikeza izilungiselelo ze-DNS ku-systemd-resolved esikhundleni sokubhala kabusha ifayela, futhi lokho kuwukuziphatha ngokubambisana okukufunayo; imibhalo emidala namahuku abhalwe ngesandla ngokuvamile abiza ithuluzi elisizayo elidala noma avele abhale phezu kwefayela.

Isimo se-WireGuard siyefana ngokuma: ukulungiselelwa kwesixhumanisi ngokwako akulawuli i-DNS, amathuluzi azungezile ayakwenza lokho, ngomsizi wesixazululi noma ngokuhlanganiswa kwe-resolved. Uma kufakwe abasizi ababili abanjalo, bobabili bazozama ukuphoqelela umbono wabo womhlaba lapho ixhuma.

Funda amahuku e-up ne-down eklayenti esikhundleni sokuqagela. Imigqa embalwa ye-shell ku-/etc/openvpn/up.sh noma kukhombisa elifanayo ichaza ukuziphatha okubonakala kungahleliwe uma kungenjalo, futhi yilapho futhi ongayenza khona iklayenti ukuba libambisane esikhundleni sokuncintisana.

Isivivinyo 4: kulungisa kumnikazi, hhayi efayeleni

Lapho usuwazi umnikazi, lungiselela i-DNS ngokusebenzisa isixhumanisi esisekelwa yilowo mnikazi. Ku-systemd-resolved lokho kusho izilungiselelo zokuxhumanisa ngakunye nezizinda zokuhamba komgudu esikhundleni sefayela elingaguquki; ku-NetworkManager kusho izilungiselelo ze-DNS zephrofayela yokuxhuma kanye ne-backend ekhethiwe; kusatshalaliswa esisebenzisa ukuhlanganiswa kwe-resolvconf kusho ukubhala ngomsizi lowo.

Ungalenzi ifayela lingaguquki. Isici sokungaguquki simisa ukuvuselela kwe-DHCP okusemthethweni kanye nokubuyekezwa kwe-VPN kanye nalokho obukulwa nakho, futhi sishiya uhlelo esimweni lapho ukuthuthukiswa kwephakethe okulandelayo noma ukuxhuma kabusha kukhiqiza ukwehluleka okungeke kuchazwe muntu kusukela ekulungiseleleni. Kufihla ukungqubuzana kobunikazi, okuyikho kanye obukuzama ukukuxazulula.

Lapho izingxenye ezimbili kufanele ngempela zihlale ndawonye, zinike imisebenzi ehlukene. Vumela umphathi wenethiwekhi ukuba abe ngumnikazi wokulungiselelwa kwezinga lesixhumanisi, vumela iklayenti le-VPN ukuba lifake isandla nge-DNS nezizinda zokuxhumanisa ngakunye ngokuhlanganiswa okufanayo, futhi susa umbhalo wesithathu obhala ifayela ngqo. Imibhalo ye-systemd-resolved ichaza izindlela ezisekelwayo kanye nalokho okuvezwa yilelo ngalinye ku-/etc/resolv.conf. Khetha indlela ehambisana nenani lenqubomgomo okufanele uyigcine. Uma i-split DNS ibalulekile, ukuhleleka kwe-stub okunezizinda zokuxhumanisa ngakunye kuyayigcina, kanti indlela ekopisha amaseva asezingeni eliphezulu efayeleni iyayenza ibe lulaza ngokuthula.

Qinisekisa ngemuva kokuxhuma kabusha, hhayi ngemuva kokuhlela

Ifayela elibonakala lilungile ngokushesha ngemuva koshintsho lwakho alifakazi lutho, ngoba umcimbi olandelayo awukenzeki namanje. Qala ukulandelana obukade kuyephula: yehlisa futhi ukhuphule umhubhe, vuselela isivumelwano se-DHCP noma shintsha isixhumanisi, bese ufunda futhi lawo manani afanayo.

resolvectl query build.corp.example
resolvectl query example.com
resolvectl status | head -40

Bese uqinisekisa umehluko obalulekile: igama langaphakathi lixazululwa ngokusebenzisa iseva yangaphakathi kuyilapho igama lomphakathi lisaqhubeka nokusebenza. Ukulungiselelwa okuthumela konke kuseva yangaphakathi kubonakala kulungile kuze kube yilapho othile ezama ukufinyelela i-inthanethi ngomhubhe, futhi ukulungiselelwa okuthumela konke kowomphakathi kuveza amagama angaphakathi.

Rekhoda umnikazi, i-backend kanye nemodi yesixhumanisi esingokomfanekiso kumanothi okusatshalaliswa. Leso sigaba esisodwa siguqula ukuthuthukiswa kwephakethe esizayo kusuka emcimbini kuye entweni yokubuyekezwa, futhi sivimbela umuntu olandelayo ukuthi angaphinde athole ukungqubuzana okufanayo ngomyalo we-chattr.