Amasayithi amabili, indawo eyodwa ye-DNS yangasese: ubani ongumnikazi wamarekhodi?

Wengeza umsingathi esayithini eluhlaza, uyaxazululeka kubasebenzisi abaluhlaza, futhi ihhovisi eliphuzi lisathola i-NXDOMAIN. Lokhu akukona ukwehluleka kwe-VPN futhi akusona isixazululi esiphukile; yisikhala sobumnikazi ngaphakathi kwendawo yangasese. Izinhlu zamarekhodi ezimbili ezihlelwe ngokuzimela azibi yindawo eyodwa ngenxa nje yokuthi amasayithi ayakwazi ukufinyelelana. Isixazululo wuhlelo lokushicilela, hhayi omunye umthetho we-firewall.

Isibonakaliso sisho umnikazi ongekho

Isayithi ngasinye cishe linesethulo sendawo, umbhala we-Pi-hole noma umugqa we-dnsmasq owengetwa othile ngesikhathi kudingeka igama. Irekhodi eluhlaza likhona kuphela kusixazululi esiluhlaza, ngakho iklayenti elisephuzi libuza isixazululi salo futhi lithola "alikho igama elinjalo" leqiniso. Impendulo endala ibukeka ngendlela ehlukile: umsingathi uthuthile, isayithi elilodwa lalubuyekeza ikhophi yalo, kanti elinye lisabuyisela ikheli elidala.

Awekho amaphethini akhiwa isikhathi eside ngokusula i-cache. I-cache yesixazululi esidlulisayo iyikhophi yempendulo esayithola ngesikhathi esithile, hhayi igunya elishicilela amagama amasha, ngakho i-cache esebenza namuhla ayisho lutho ngomsingathi wakusasa. Imibhalo ye-BIND ichaza indima yokuqala, yesibili, ephindaphindayo nedlulisayo ngokwehlukana ngenxa yalesi sizathu.

Ngakho umbuzo wokuklama mncane futhi ungaphenduleka: ubani angakha irekhodi, futhi lelo rekhodi lifinyelela kanjani isixazululi ngasinye okumele siphendule ngalo?

Inketho A: indawo eyodwa enegunya namasekhethi wesibili

Qalisa isiphakeli sokuqala se-internal.example.com futhi uvumele iziphakeli zesibili ezisekelwayo ukuthi zithole indawo esayithini ngasinye. Isixazululi esiphindaphindayo sesayithi ngasinye sibuza isiphakeli sesibili sasendaweni, ngakho izimpendulo zivela emthonjeni onegunya hhayi ku-cache, futhi ushintsho olwenziwe kanye ludluliswa esikhundleni sokuphinda lubhalwe.

Lolo hlelo ludinga izinqumo ezicacile okulula ukuzihlehlisa futhi kuyabiza ukuzidlula. Ubani angahlela indawo? Yiziphi iziphakeli ezivunyelwe ukuyidlulisa, futhi ngamaphi amakheli? Yini okufanele abaklayenti bayibone ngesikhathi umhubhe phakathi kwamasayithi uwile? Isiphakeli sesibili siyaqhubeka siphendula sisuka ekhophini yaso yokugcina, okuyisimilo esivame ukufunwa, kodwa kufanele kube ukukhetha okumenyezelwe hhayi isimanga ngesikhathi sokuphazamiseka.

Khakhela ukudluliswa kwendawo kuziphakeli zesibili ezaziwayo ngekheli futhi usebenzise amasiginesha okuthengiselana lapho ukusetshenziswa kusekela khona. Ukudluliswa okuvulekile kuyikhophi yesikhala sakho samagama angaphakathi kunoma ubani ongafinyelela imbobo.

Izindleko ukuxhumanisa: indlela eyodwa yokuhlela, ukubuyekezwa okukodwa koshintsho, nokuqonda okwabiwe mayelana nokuthi ubani osemsebenzini lapho irekhodi lingalungile.

Inketho B: isizinda esingaphansi sesayithi ngasinye

Thumela green.internal.example.com esayithini eluhlaza kanye no-yellow.internal.example.com kweliphuzi. Isayithi ngasinye siba negunya emagameni aso, futhi indawo yomzali ithwala kuphela amarekhodi okuthunyelwa. Ingxabano ngefayela elilodwa iyanyamalala, futhi ithimba lasendaweni lingengeza umsingathi ngaphandle kokulinda ushintsho olumaphakathi.

Ukuthunyelwa kufanele kube khona kumzali, namarekhodi e-NS akhomba kuziphakeli ezinamagunya esayithi. Ukudlulisela okunemibandela kwesizinda esingaphansi kuyindlela ehlukile evumelekile lapho ukuthunyelwa okuphelele kungenzeki, kodwa kuyisethingi yesixazululi hhayi iqiniso elishicilelwe, ngakho isixazululi ngasinye sidinga umthetho ofanayo.

Izindleko ziyashintsha esikhundleni sokunyamalala: indawo yomzali isadinga umnikazi, futhi ukwakha isayithi elisha manje ukushintsha ezindaweni ezimbili hhayi eyodwa.

Vumela isixazululi ngasinye silandele ukukhetha

Nikeza abaklayenti isixazululi esigunyaziwe kanye nesizinda sesikhangiso ngokusebenzisa ukuhlelwa okusekelwayo, futhi uqiniseke ukuthi isixazululi sinomzila we-VPN ovunyelwe oya kunoma iyiphi isiphakeli se-DNS esikude okufanele sibuze kuso. Izinhlelo zokusebenza nazo zidinga imizila eya emakhelini angasese lawo maphendulo awabuyiselayo, ngoba igama elifanele elingenayo indlela lisewukuxhumana okuphukile.

Uma i-Pi-hole ihlinzeka ngokuxazululwa kwendawo, bhala ukuthi imaphi amarekhodi akhona kanye nokuthi imiphi imibuzo eyidlulisayo. Izinhlu ezimbili ze-Pi-hole ezihlelwe ngokuzimela azikaphindaphindi. Ku-Pi-hole v6, imigqa ye-dnsmasq yangokwezifiso isethwa ngezinketho zohlangothi lomsingathi njenge-TOML, i-CLI noma izinto eziguqukayo zemvelo futhi ayivezwe nge-API; ukulayisha amafayela e-/etc/dnsmasq.d/ kuyinketho ehlukile evaliwe ngokuzenzakalela.

Bese uhlola kuzo zombili izinhlangothi ngegama okufanele libonakale yonke indawo:

$ dig +short newhost.green.internal.example.com @10.20.0.53
10.20.0.41
$ dig +short newhost.green.internal.example.com @10.30.0.53
10.20.0.41
$ dig SOA internal.example.com @10.30.0.53

Impendulo ye-SOA ikutshela ukuthi isixazululi esiphuzi sizibona sinegunya, sibuza okwesibili, noma sidlulisa nje. Lezi zindlela zokuklama ezihlukene ezinamathuba okwehluleka ahlukene, futhi impendulo ivame ukuthola ukuthi yikuphi okusebenzise ngempela.

Qeda ngamacala amathathu okwamukela: igama elilodwa elisuka esayithini ngasinye, irekhodi elilodwa elishintshiwe phakathi nehora, kanye nokuxhumana phakathi kwamasayithi kungatholakali. Ukuklama okudlula eyokuqala kuphela kunohlelo lokushicilela ephepheni kanye nesethulo sendawo emkhiqizweni.