Kungani i-hotspot iqondisa kabusha i-DNS ngaphambi kokuxhumana kwe-VPN?
I-hotspot ibhala kabusha izingcingo kunethiwekhi yayo, futhi indawo yokugcina yegama lomsingathi ixazululwa ngaphambi kokuba kube khona umhubhe. Landelela ukuthi iyiphi i-resolver ephendule umbuzo ngamunye.
Ukujoyina inethiwekhi yehhotela kubeka izinqumo ezimbili ze-DNS phambi kwakho ngezikhathi ezihlukene: izingcingo ezenziwa idivayisi ngesikhathi sokungena, kanye nezingcingo ezenziwa lapho umhubhe usumiwe. I-hotspot ingaba nomthelela kwezokuqala ngokunethiwekhi eyilawulayo. Okwesibili kuncike kunqubomgomo yeklayenti uqobo, okuyinto ehlukile okufanele ihlolwe.
Hamba ngokuxhumana ngokulandelana, kusukela ekuqashweni kokuqala kwe-DHCP kuze kufike embuzweni owaxazulula igama langasese. Khona-ke ukwehluleka okubili okubonakala kufana kuthikithi lokusekela kuyahlukana ngokucacile: okunye kwenzeka ngaphambi kokuba kube khona umhubhe, kanti okunye kwenzeka ngaphakathi kuwo.
I-hotspot ingathinta ini futhi ingeke ithinte ini
Inethiwekhi yokufinyelela inikeza ikheli le-resolver nge-DHCP futhi ingavimba iphothi 53 elibheke kulelo kheli. Lokho kwanele ukuphendula yonke imicabango engavikelwe ngekheli lephothali noma ikhasi lokuvimba. Kwanele futhi ukuhlakaza iklayenti le-VPN elinendawo yokugcina ebhalwe njengegama lomsingathi.
I-hotspot ayikwazi ukwenza ukufunda noma ukubhala kabusha umbuzo lapho usuhamba ngaphakathi komhubhe osunguliwe, uma kucatshangwa ukuthi umhubhe uwuthwala ngempela. Ukuvimba kuncike ekuboneni umbuzo embhalweni ocacile.
Imibuzo ishiya umhubhe noma kunjalo ngezizathu ezingahlobene ne-hotspot: isethingi ye-DNS ephephile yesiphequluli, umthetho we-split-DNS ogcina isijobelelo sebizinisi kwi-resolver yasendaweni, noma iklayenti elilungiselelwe ukukhipha i-DNS emhubheni. Ngakunye kuyisinqumo ohlangothini lweklayenti, futhi ngakunye kubonakala njengokuphazamisa kwe-hotspot uma kubukwa ngaphandle.
| Path | Who answers | What a failure looks like |
|---|---|---|
| Lookup before the tunnel is up | The network's resolver | The client never reaches its endpoint |
| Lookup inside the tunnel | The resolver pushed by the client | Local policy or tunnel DNS is misconfigured |
| Browser secure DNS | A DoH provider over port 443 | Both the hotspot and the tunnel policy are bypassed |
Umbuzo wokuqala wenzeka ngaphambi kokuba kube khona umhubhe
Iklayenti elinikezwe igama lomsingathi kufanele liqale ukulixazulula, futhi ngaleso sikhathi awukho umhubhe ovikela umbuzo. Uma i-hotspot iphendula ngekheli lephothali, izingxoxo ziyahluleka noma zilenge. Uma ingenzi lutho, iklayenti libika iphutha legama futhi umhubhe awuqali neze. Yimuphi kule miphumela emibili ochaza ilogi yomhubhe engenalutho ebonakala ingenacala ngenye indlela.
Izinhlelo zokusebenza nazo ziqhuba ukuhlolwa kwazo koxhumano nokutholwa kwephothali, okuchazwe ku-RFC 8910 naku-RFC 8952, futhi lezo zicelo ziphuma ngaphambi kokuba noma iyiphi i-VPN isuke. Ukuzibona kulo ilogi ye-proxy kuwukuziphatha okulindelekile hhayi ubufakazi bokuvuza.
Isixazululo esingokoqobo ukunikeza iklayenti indawo yokugcina engadingi mbuzo. Uma lokho kungenakwenzeka, qala uqedele ukungena bese uxhumana ngemuva kwalokho.
Thola ukuthi iyiphi i-resolver ephendule
Buza uhlelo hhayi isiphequluli, futhi gijima umbuzo kabili: kanye nge-resolver esetshenziswa idivayisi manje, kanye ngakwelinye ikheli elingashintshi.
resolvectl query vpn.example.com dig +short vpn.example.com dig +short vpn.example.com @1.1.1.1
Impendulo evela kumyalo wokuqala ehlukile kowesithathu ikutshela ukuthi i-resolver yasendaweni ibuyisela enye into, futhi yilokho okwenziwa i-hotspot eqondisa kabusha. Ukwehluleka kowesithathu kanye nokuphumelela kowokuqala kukhombisa iphothali: i-resolver yasendaweni inikeze ikheli lokungena ngesikhathi iphothi 53 eliphumayo lilahlwa. Ukuphela kwesikhathi kukho kokubili kusho ukuthi inethiwekhi ilahla i-DNS kuze kuqedwe ukuqinisekiswa.
Phinda ngemuva kokuxhumana bese uqhathanisa. Impendulo egcinwe kunqolobane iyasinda ekushintsheni, ngakho sula inqolobane noma buza igama elisha lokubhekwa kwesibili.
Gcina izingcingo zakamuva endleleni obuzimisele
Iphrofayela yomhubhe ogcwele ebamba ne-DNS iwuhlelo olulula kakhulu: wonke umbuzo ovela kuyo yonke inhlelo uya ku-resolver edonswa umhubhe, futhi inethiwekhi yasendaweni ibona kuphela ithrafikhi ebethelwe. Kufakazele ngokuxazulula igama langaphakathi nelomphakathi ngemuva kokuxhumana, bese uqhathanisa zombili izimpendulo nalokho i-resolver yomhubhe ekubuyisela yodwa.
I-split-DNS idinga uhlu lwezizinda olubhalwe ngenhloso: izijobelelo zebizinisi ngomhubhe, konke okunye kwasendaweni, futhi akukho kuhlangana phakathi kokubili.
I-DNS ephephile yesiphequluli ingaphandle kwalowo mgomo, ngakho uma kufanele icishwe ukuze iphrofayela iziphathe ngendlela elindelekile, yicisha kuleyo phrofayela hhayi emshinini. Kwenze kuzilungiselelo zesiphequluli, hhayi ngokuhlela i-resolver yohlelo, ukuze ushintsho lubonakale ngokuzayo. Bhala impendulo, i-resolver kanye nesigaba sokuxhumana emgqeni owodwa kusivivinyo ngasinye. Umbiko othi i-DNS yehlulekile ku-Wi-Fi yehhotela uchaza uphawu olunezimbangela ezintathu ezihlukene okungenani.