I-VPN DNS ngokumelene ne-DoH yesiphequluli: okungeke kukutshele ukuhlolwa kokuvuza

Ikheli elivela ekuhlolweni kokuvuza likhombisa kuphela ukuthi iyiphi i-resolver ephendulile. Imibuzo ebethelwe, i-DNS ehlukanisiwe kanye nenqubomgomo yesiphequluli kunquma ukuthi amagama ayimfihlo asaxazululeka yini.

Ikhasi lokuhlolwa kokuvuza lithi i-DNS yakho ilungile, ibheji yesiphequluli ithi kuphephile, kanti i-wiki yangaphakathi ayikakalayishi. Zontathu zingaba yiqiniso ngesikhathi esisodwa, ngoba ikheli le-resolver akulona into efanayo nenqubomgomo eyayikhetha, noma indlela umbuzo owahamba ngayo. Lokho abantu abakubiza ngokuvuza kwe-DNS empeleni kuwumbuzo owodwa: iyiphi i-resolver eyathola igama, futhi lolo khetho lwaluhlosiwe? Ukuhlukanisa lokho kudinga izahlolo ezintathu, futhi eyedwa yokugcina ihlanganisa ukushintsha isilungiselelo.

Inkolelo yokuqala: ibheji isho i-resolver yakho

Ukuhlolwa kokuvuza kuxazulula igama lokuhlola bese kubika ikheli eliphendulile. Akubiki inqubomgomo eyakhetha leyo resolver, futhi lapho umbuzo usongwe ku-DNS over HTTPS, idivayisi ephakathi endleleni ayikwazi ukubona igama nhlobo. Imishini emibili ehluke kakhulu ikhiqiza ibheji elifanayo eliqinisekisayo: eyodwa lapho i-VPN yasunduza khona 10.8.0.1 futhi isiphequluli siyisebenzisa, nenye lapho isiphequluli sishaya indiva uhlu lwesistimu sathumela igama kumhlinzeki walo obethelwe ngomhubhe.

Umehluko ubaluleka ngaleso sikhathi lapho igama eliyimfihlo lihluleka khona. Ekuhlelweni kokuqala i-resolver ye-VPN iphendula isifunda senkampani; kwesibili isiphequluli asizange siyibuze, ngakho igama elifushane le-host alixazululeki futhi ukwehluleka kubonakala njenge-VPN ephukile. Ukuhlola akuyona enye into yokuhlolwa kokuvuza, kuwukufuna igama elaziwa yi-resolver eyodwa kuphela.

Inkolelo yesibili: isiphequluli siyaphuma emhubheni

I-DNS ikhetha ikheli, umzila uthwala ukuxhumana, futhi lezi zinto ezimbili ziyizingqimba ezihlukene. Umbuzo othunyelwe kumhlinzeki we-DoH womphakathi usengu-TCP port 443 uya ekhelini elingahlelwa umzila. Uma ithebula lakho lomzila lithumela umzila ozenzakalelayo emhubheni, lowo mbuzo nawo udlula emhubheni. Uhlobo lwe-resolver alunqumi indlela.

Lokho i-DoH yesiphequluli eyikushintshayo umamukeli wamagama. Leso siqumo sangempela sobumfihlo kanye nesiqumo sangempela senqubomgomo, kodwa akukona ukweqa umzila. Uma isidingo sakho siwukuthi amagama ahlale kumqhubi we-VPN, umbuzo obethelwe oya komunye umuntu wehluleka leso sidingo ngenkathi usasebenzisa umhubhe ukuxhumana kwangempela.

Inkolelo yesithathu: yonke i-VPN inqoba yonke isiphequluli

I-DNS ephephile esipheqululini inezimo, hhayi iswishi: ivaliwe, umhlinzeki ozenzakalelayo onokubuyela emuva, ithempulethi yangokwezifiso, noma inqubomgomo ephoqwa uhlelo lokusebenza noma inhlangano. Icala lokubuyela emuva yilona elikhiqiza imibiko ngezikhathi ezithile. Lapho indawo yokugcina ebethelwe ingafinyeleleki, isiphequluli singabuyela ku-resolver yesistimu, ngakho i-laptop efanayo ixazulula kahle igama eliyimfihlo ngoMsombuluko hhayi ngoLwesibili.

Ngaleso sikhathi esifanayo, iningi lamaklayenti e-VPN libeka i-resolver yesistimu lapho ukuxhumana kuvela futhi libuyisela eyangaphambilini lapho kuwa. Isiphequluli esiphethe i-resolver ebethelwe yangokwezifiso asikuboni nhlobo lokho kubuyiselwa. Yingakho iphrofayela efanayo iziphatha ngendlela ehlukile kumalaptop amabili nokuthi kungani resolv.conf ibonakala ilungile ngenkathi isiphequluli sisabuza komunye umuntu.

resolvectl status                 # per-link DNS servers and split-DNS domains
scutil --dns | head -30           # macOS resolver order for each domain
nslookup intranet.corp 10.8.0.1   # ask the VPN resolver directly

Zisebenzise ngenkathi uxhumekile, bhala amadomeni i-resolver ngayinye ewashoyo, bese uqhathanisa nalokho isiphequluli esikubikayo mayelana nesimo sayo. Idokhumenti ye-DoH yakwa-Mozilla iyincazelo enengqondo yendlela ukuziphatha okuzenzakalelayo nokokubuyela emuva kwesiphequluli okufanele kusebenze ngayo.

Isinqumo sinezinto zokufaka ezintathu, hhayi esisodwa

Amagama ayimfihlo, ukuthembela kumqhubi kanye nokufinyeleleka kunquma ukuhlelwa okulungile. Amagama aziwa yi-resolver ye-VPN kuphela aphoqa i-DNS ehlukanisiwe: isijobelelo esiyimfihlo siya ku-resolver esunduziwe, konke okunye kulandela noma yimuphi umgomo owukhethele amagama omphakathi. Ukuthembela kumqhubi kunquma ukuthi amagama omphakathi nawo kufanele aye kuleyo resolver noma enkonzweni ehlukile. Ukufinyeleleka kunquma ukuthi i-resolver yakho ebethelwe ekhethiwe iyasebenza yini kule nethiwekhi.

ConditionWhat it forces
Internal names must resolveSplit DNS: private suffixes to the VPN resolver, the rest to your chosen default
Queries must stay with one operatorPin both the system resolver and the browser mode, and disable fallback
Resolver only reachable through the tunnelKeep the pushed resolver; do not point DoH at an endpoint your routes exclude

Awekho kulezi zigqila ayisincomo somhlaba wonke. I-resolver ephethwe yi-VPN iqoqa ukubona kumqhubi lowo; inkonzo ehlukile yengeza omunye umamukeli wamagama abuziwe. Akukho kuhlelwa okufakazela okuthile mayelana nokugcinwa ngaphandle uma ufunda inqubomgomo.

Bhala isinqumo ngephrofayela ngayinye, ngoba lezi zilungiselelo ziyaduka. Iphrofayela eyasunduza i-resolver ngenyanga edlule ingase ingasunduzi lutho namuhla, futhi isiphequluli sizogcina ngenjabulo indawo endala yangokwezifiso esaphendula. Okufanele kube senothini ikheli le-resolver, izijobelelo eziziphethe kanye nesimo sesiphequluli, hhayi uhlobo lwenkonzo.

Hlola inqubomgomo ocabanga ukuthi uyilungisile

Hlola ngegama, hhayi ngebheji. Xazulula igama lomphakathi neliyimfihlo nge-resolver yesistimu, bese uphinda ngaphakathi kwesiphequluli ngesilungiselelo saso se-DNS ephephile esimweni ohlose ukusisebenzisa. Uma igama eliyimfihlo lihluleka esipheqululini kuphela, uthole ukungafani komamukeli ngaphandle kokuthinta nasisodwa isilungiselelo se-VPN.

Bese uphinda uxhume futhi uhlole ukubuyiselwa, ngoba yilapho iziphakamiso zokudlulisela zihlala khona: nqamula, qinisekisa ukuthi i-resolver yangaphambilini ibuyile, xhuma futhi, qinisekisa ukuthi eyesunduziwe ibuyile. Ekugcineni, hlola isiphequluli esinenqubomgomo ephethwe uma unayo, ngoba leso simo singasenqaba ngokuphelele ushintsho lwakho futhi sigcine ngasese i-resolver yangaphambilini.

Qala ngombuzo wesikhala samagama futhi uzogwema okuningi kwalokhu. Uma umshini kufanele ufinyelele amagama angaphakathi, i-resolver ebethelwe yesiphequluli iyisinqumo mayelana nengxenye yomphakathi kuphela, futhi ingxenye eyimfihlo ihlala kulokho i-VPN ekusunduzile.

Izihloko ezihlobene