I-DNS ye-VPN ithatha konke ukusesha: lungisa i-dns-priority ku-NetworkManager

Xhuma i-VPN yasehhovisi futhi ngokuzumayo konke ukusesha kwamagama kuya ku-resolver yebhizinisi. Amagama omphakathi asaxazululwa, ngakho akukho okubonakala kuphukile kuze kuhluleke igama lephrinta yendawo noma irekhodi le-split-horizon libuyisele ikheli lasehhovisi. Kwezinye izilungiselelo ze-Fedora kwenzeka okuphambene: i-resolver yomhlinzeki iyaqhubeka iphendula ngemva kokuba i-tunnel ikhuphukile. Kokubili umbuzo owodwa — iyiphi i-resolver engumnikazi walo mbuzo — futhi ezinhlelweni ze-NetworkManager impendulo ihlala ezimfanelweni ze-DNS zokuxhumana ngakunye.

Ukuxhumana okubili, i-resolver eyodwa enqobayo

Ukuxhumana ngakunye kumemezela ukubaluleka kwe-DNS. Ukuxhumana okuvamile kungu-50 ngokuzenzakalela futhi okwe-VPN kungu-0, futhi inani eliphansi liyaphumelela. Yilokho kokuzenzakalela okuyisizathu sokuthi ukuxhumana kwe-VPN kudlule ngokuthula uxhumano lwentambo kuyo yonke i-domain ekufunayo: uziro unqoba amashumi amahlanu ngaphandle kokuthi ubani akukhethile.

Ukubaluleka kuhlela abantu abazongenela ukhetho. Akukhawuleli ukuthi umnqobi ubuzwa ngani. Ukuxhumana kwe-VPN okungenayo i-domain yokusesha kufuna konke, ngakho ukukukhetha kuthumela nemibuzo yomphakathi ku-tunnel futhi, kumklamo we-tunnel ehlukanisiwe, lapho i-resolver yebhizinisi idlulisela khona.

Ukubaluleka kunquma ukulandelana, uhlu lokusesha lunquma ubunikazi

nmcli -f connection.id,ipv4.dns,ipv4.dns-search,ipv4.dns-priority con show "Corp VPN"
resolvectl status
readlink -f /etc/resolv.conf

Uhlu lokusesha isitatimende sobunikazi. I-domain engenalutho efana ne-corp.example iba isijobelelo sokusesha ne-domain yokuqondisa. Ifomu lokuqondisa kuphela i-~corp.example lithumela ukusesha ngaphansi kwaleso sijobelelo kulokhu kuxhumana ngaphandle kokwengeza i-domain kumagama amafushane. Leyo tilde iwumehluko phakathi kokuthi «buza le sevikha» nokuthi «buza le sevikha bese uqeda ukuthayipha kwami».

Sebenzisa womabili amafomu lapho abasebenzisi bethayipha amagama amafushane omsingathi nalapho amarekhodi ehloswa ngamagama afanelekile ngokuphelele. Sebenzisa ifomu lokuqondisa kuphela lapho ufuna ukuhlukanisa ngaphandle kokushintsha indlela i-resolver eqedela ngayo igama elingenalutho.

Bese wenza ukukhetha kucace bese uphinda uvule ukuxhumana:

nmcli con modify "Corp VPN" ipv4.dns-priority -100
nmcli con modify "Corp VPN" ipv6.dns-priority -100
nmcli con modify "Corp VPN" ipv4.dns-search "~corp.example,corp.example"
nmcli con up "Corp VPN"

Ukubaluleka okungekuhle kuyindlela ebhaliwe yokuthi «khetha ukuxhumana» futhi ukusetha kokubili imindeni yamakheli kugcina ukuziphatha kufana kumsingathi onokuxhumana kwe-IPv6. Ukushintsha isimfanelo ngaphandle kokuphinda uvule ukuxhumana akushintshi lutho kulokho okusebenzayo manje, yingakho ukulandelana kuphetha nge-up ecacile.

Vumela i-systemd-resolved ibambe ukuhlukanisa

Isengezo se-dnsmasq esizenzakalelayo sithululela imibuzo ku-resolver eyodwa yendawo, ngakho ukuhlukaniswa ngekhonkco ngakunye kuhlala kukhubazekile. I-systemd-resolved iveza ukuhlukaniswa ngekhonkco ngakunye, futhi i-resolvectl query isho ikhonkco eliphendulile.

systemctl enable --now systemd-resolved
ln -sf /run/systemd/resolve/stub-resolv.conf /etc/resolv.conf
systemctl restart systemd-resolved NetworkManager
resolvectl query build.corp.example

Ngemva kwalokho ikhonkco lebhizinisi lithwala i-corp.example futhi i-resolver yomphakathi isebenzela okusele. Lapho umbuzo ufinyelela ikhonkco elingalungile, umyalo usho ikhonkco eliwuphendulile, futhi ukukwazi lokho kungcono kunokwazi ikheli kuphela.

Vumelanisa umklamo we-DNS nohlobo lwe-tunnel

Imiklamo yobumfihlo ethumela konke nge-tunnel akufanele ibe nohlu lokuhlukanisa, ngoba izobuyisela amagama omphakathi ku-resolver yendawo futhi ichithe inhloso. Imiklamo ye-tunnel ehlukanisiwe iyayidinga: ngaphandle kwayo i-resolver yebhizinisi ibona wonke umbuzo womphakathi, futhi isilungiselelo siyaphuka ngesikhathi i-tunnel iwa.

Bese kuba khona i-kill switch evimba i-DNS ngaphandle kwe-tunnel. Amagama ayaxazululwa ezingxenyeni ze-tunnel futhi ehluleka kuyo yonke enye indawo ngenkathi ukuxhumana kunempilo ephelele. Izimpendulo ezisebenzayo ukugunyazwa okucacile kwe-resolver ye-LAN noma i-cache yendawo edlulisela kuphela indawo yebhizinisi, futhi kokubili kuyisihlobo esinomnikazi hhayi isici esingalungile ku-tunnel.

Iphrofayela ebhala kabusha ukulungiselelwa kwe-resolver lapho isikhombisi siqala iziphatha ngendlela efanayo: lapho i-resolver yendawo ingafinyeleleki, kuyoxazululwa kuphela amagama aziwa yi-tunnel. Kungakhathalekile ukuthi iyiphi indlela esebenzayo, bhala phansi ukuthi yimaphi amagama okufanele asebenze esimweni ngasinye, futhi unikeze lolo hlu kumuntu ophethe imibiko.

Qinisekisa ngekhonkco ngakunye, bese uphinda ngemva kokuxhuma kabusha

Buza igama elilodwa langaphakathi nelilodwa lomphakathi, futhi bheka ukuthi umbuzo uya ngempela kuphi. Ikhasi lokuhlola ukuvuza likutshela ukuthi iyiphi i-resolver ephendulile, hhayi ukuthi isistimu ikhethe liphi ikhonkco, ngakho akusho lutho mayelana nokulandelana okusanda kukusetha.

Gijima imibuzo yomibili futhi ngemva kokunqamula nokuxhuma kabusha. Ukubaluleka kusetshenziswa futhi lapho ukuxhumana kusebenza, futhi isixhumanisi esidala esingokomfanekiso singasinda ekuthuthukisweni okungekho noyedwa okukhumbulayo. Lokho ofuna ukukubhala ekugcineni ukuthi iyiphi i-resolver engumnikazi wasiphi isijobelelo, kanye nokuhlola okusazosebenza nakusasa.