Ingabe i-DNS ye-VPN yakho isetshenziswa ngempela? Bamba umgwaqo 53 bese ubona

Buza iningi labantu ukuthi i-VPN client yenzani nge-DNS futhi bazothi ibeka isixazululi, ngakho imibuzo ihamba ngaphakathi kwethuluzi. Ukusunduza kuyiqiniso; umbono wokuthi kuba umbuzo awusiwona. Phakathi kokukhetha okusunduziwe nephakethe elisekhebula kunezigaba ezintathu, futhi ngasinye sihluleka ngokuzimela ngezindlela ezibonakala njenge-server ye-DNS eyephukile. Yingakho ikhasi lokuhlola ukuvuza nesiphequluli esisebenzayo kungase kungavumelani ngomshini oyedwa ngesikhathi esisodwa.

Ukukhetha okusunduziwe akulona umbuzo

Isigaba sokuqala ukuthi i-server inikeza izilungiselelo, isibonelo ukukhetha kwe-DNS okusunduziwe okusho isixazululi ngaphakathi kwethuluzi. Isigaba sesibili ukuthi iklayenti lisebenzisa lezo zilungiselelo ku-interface. Isigaba sesithathu ukuthi uhlelo lokusebenza luthumela umbuzo kulelo kheli ngempela. Ukwehluleka kwesigaba sesibili kushiya ukukhetha kubonakala kulo ochungechunge lokuxhumana kuyilapho uhlu lwezixazululi lungashintshi, futhi ukwehluleka kwesigaba sesithathu kushiya uhlu lwezixazululi olulungile ngokuphelele lungasetshenziswanga.

Ukuxazulula izinkinga okuningi kuhlanganisa lezo zintathu zibe ngokunye futhi kusole i-server ye-VPN, okuvame ukuba uhlangothi olulodwa olungafakazela ukuthi lwenze ingxenye yalo. Kunalokho funda isimo sakhona sesixazululi seklayenti, bese ubukela umbuzo owodwa uphuma. Lezo zimbono ezimbili zihlukanisa ukulungiselelwa nokuhamba komgwaqo kanye nenqubomgomo, futhi zithatha cishe imizuzu emihlanu. Gcina izithombe, ngoba unjiniyela olandelayo ufuna okwangaphambi nokwangemuva hhayi incazelo yako.

Hlola ukuthi i-interface ibamba ini ngempela

Kuma-Linux isixazululi sesistimu kungase kube yifayela elijwayelekile, i-NetworkManager noma i-systemd-resolved, futhi ukuthi iyiphi yazo eyihambisayo kunquma ukuthi iseva esunduziwe ihlala kuphi. Inqubo ye-OpenVPN kumugqa womyalo ayilushintshi isixazululi sesistimu ngokwayo, ngakho ukuhlanganiswa okubhaliwe i-script ye-up/down noma umphathi wokuxhumana osekwazi ukusebenzisa izilungiselelo. Ukusebenzisa kokubili kuyindlela ephumelelayo yokudala umncintiswano.

resolvectl status
cat /etc/resolv.conf

Kuma-Windows uhlu lungolwe-adapter ngayinye, ngakho i-adapter yethuluzi ingabamba amaseva angaphakathi kuyilapho i-adapter yomzimba igcina eyasekhaya futhi inqoba kwamanye amagama. Qhathanisa zombili izadaptha hhayi leyo ocabanga ukuthi iyasebenza.

Landela umbuzo owodwa uphuma emshinini

Thwebula zombili izinto zokuxhumana ngesikhathi esisodwa, bese uxazulula igama elilodwa okufanele lisebenzise isixazululi sangaphakathi. Leyo mbhangqwana yezithombe iphendula lokho okungeke kuphendulwe yinoma yikuphi ukuphuma kokulungiselelwa.

sudo tcpdump -ni tun0 port 53
sudo tcpdump -ni any port 53

Umbuzo obonakala ku-interface yomzimba futhi ungabe unke ubonakale ethuluzini usho ukuthi iklayenti likhethe isixazululi esingalungile. Umbuzo ongabonakali kukho kokubili usho ukuthi uhlelo lokusebenza luphendule kusuka kunqolobane, lubuze i-stub elalela ku-loopback, noma lusebenzise isixazululi esibetshelwe okungabonakali ukuhamba kwako njengomgwaqo 53 nakanye. Thwebula nezimpendulo, hhayi imibuzo kuphela, ngoba umbuzo ophuma ethuluzini ngempendulo evela kukheli lomphakathi uwukwehluleka okwehlukile ekutheni akukho mpendulo efikayo.

Ucingo lomlilo olwamukela i-DNS yalo kuphela

Amaklayenti okuhweba kwesinye isikhathi afaka imigqa yawo yokuhlunga. Iphethini eyodwa ebhaliwe ivumela i-DNS ukuya esixazululini sekhayenti uqobo futhi ilahle konke ukuhamba kwe-UDP kumgwaqo 53 okusele okuzama ukuphuma ku-interface engeyona i-loopback, kuhlanganise nokuhamba umsebenzisi akuhambisa ngamabomu kwenye indawo. Imibuzo ye-daemon inyamalala ngaphandle komkhondo, futhi lokho kufundwa njengokwehluleka kwesixazululi hhayi njengesihlungi.

sudo iptables -S OUTPUT
sudo iptables -S | grep -i -E 'dns|53'

Uma umthetho wokulahla uhlolwa ngaphambi kokukhishwa kwakho, umthetho owengeziwe awusoze wafinyelelwa, ngakho wufake endaweni yokuqala futhi ukhawulele indawo eya kuyo esixazululini osihlosile ngempela.

sudo iptables -I OUTPUT 1 -p udp --dport 53 -d 172.20.8.1 -j ACCEPT

Lokho kukhishwa kuwukuxilonga hhayi inqubomgomo. Uma umthetho womthengisi ungenzelwe, ukulungiswa okusekelwayo ukuhlela iklayenti ukuthi livumele leso sixazululi futhi kurekhodwe isinqumo, ngoba umthetho ofakiwe ngeke weqe ukuthuthukiswa kweklayenti okulandelayo.

Kungani ikhasi lokuvuza lifakazela okuncane kunalokho elibonakala kukho

Lokho ikhasi lokuhlola ukuvuza elikubonisayo isixazululi esikhulume nomsebenzisi wokuhlola, hhayi leso umshini wakho owabuzayo. Isidluliseli sendawo esiphindaphinda ngaphandle sibeka ikheli laso lokuphuma kulelo khasi, futhi imibuzo ebetshelwe ingase ishiye ikhasi lingenalutho ngokuphelele. Yomibili imiphumela ifundwa kabi, enye njengokuvuza kanti enye njengesiqinisekiso, futhi akukho kufunda okusuka ekuboneni.

Ubufakazi obuvikelekayo yisithombe: i-interface, ikheli lendawo eya kuyo, impendulo kanye nesigxivizo sesikhathi. Thatha esisodwa ngaphambi kokuthi ithuluzi likhuphuke nesinye ngemuva, bese uziqhathanisa ngokulandelayo lapho igama lihluleka. Leyo mbhangqwana isho futhi kumuntu olandelayo ukuthi ukwehluleka bekukusixazululini, ekuhambeni komgwaqo noma kunqubomgomo yokufinyelela yesixazululi uqobo.