Kungani amagama abasingathi bangaphakathi axazululwa ku-dig kodwa ehluleka ku-curl ku-VPN

I-laptop yakho ise-VPN, i-dig service.internal.example iphendula ngekheli le-10.x, futhi i-curl isaphuma ne-Could not resolve host. Ithuneli akuyona inkinga: ihambise umbuzo we-dig ngaphandle kokukhononda. Umehluko ukuthi ngubani obuza umbuzo. I-dig ithumela umbuzo owodwa ku-seva eyodwa oyishoyo, kuyilapho i-curl idlula ochungechungeni lokusesha lwesistimu yokusebenza, futhi lolo chungechunge lunemithetho yalo yokuthi iyiphi i-seva ebuzwayo.

Ukusesha okubili kwegama elilodwa

I-dig iyi-stub resolver yayo. Ifunda i-/etc/resolv.conf, ikhetha i-nameserver, ithumela umbuzo owodwa we-A noma we-AAAA futhi iphrinta impendulo. Idlula i-nsswitch ngokuphelele futhi ayazi lutho ngendawo yoxhumano ngalunye egcinwa yi-systemd-resolved noma i-NetworkManager ngaphandle kwalelo fayela, yingakho impendulo ye-dig ingalunga kodwa ingakutsheli lutho ngalokho okuzobonwa uhlelo lwakho lokusebenza.

Izinhlelo zokubhala zishaya i-getaddrinfo, futhi i-getaddrinfo ihamba ochungechungeni olude: ukulandelana kwamamojula e-nsswitch, bese kuba umojula ophethe igama, futhi ekugcineni i-resolver eyakhiwe kusukela ekulungiselelweni kokuxhumana kwamanje. Kumshini we-systemd umbuzo uya ku-127.0.0.53 futhi i-systemd-resolved ikhetha i-seva ephezulu ngokuxhumana ngakunye ngokulandela isizinda sokuhamba esixhunywe ku-interface ye-tun.

Imiyalo emibili ihlukanisa lezo zendlalelo ngaphandle kokuqagela:

getent ahosts service.internal.example
resolvectl query service.internal.example

I-getent isebenzisa indlela efanayo ne-curl, ngakho ukwehluleka kwe-getent eceleni kwe-dig esebenzayo kubeka iphutha kunqubomgomo yokusesha hhayi ekuhambiseni kwamaphakethe. I-resolvectl query iphinde iphrinte i-interface kanye ne-seva ephezulu enikeze impendulo, lokho okubonisa ukuthi ingabe isixhumanisi sethuneli noma isixhumanisi esibonakalayo siwine isinqumo.

Funda i-resolver uhlelo lokusebenza oluyisebenzisa ngempela

I-/etc/resolv.conf iyakhiqizwa kumadeskithophu amaningi, futhi iklayenti le-VPN linezindlela ezintathu zokusebenzisana nayo: ukufaka i-nameserver phambili, ukubhala phezu kwefayela, noma ukunikeza amaseva ayo ku-NetworkManager bese ivumela i-daemon ukuthi iyibhale kabusha. Yiphethini yesithathu kuphela egcina i-DNS ngokuxhumana, ngoba amaseva ahlala exhunywe ku-interface esikhundleni sokwenziwa abe uhlu olulodwa lomhlaba wonke.

Kuzinhlelo ze-NetworkManager umphumela uncike ku-backend eseku-/etc/NetworkManager/NetworkManager.conf:

[main]
dns=systemd-resolved

Nge-dns=default amaseva eklayenti ahlanganiswa ku-resolv.conf ngokulandelana okunqobayo, futhi ukusesha okuyimfihlo kusengaya ku-resolver yomphakathi. Nge-backend eqonda ukuxhumana, systemd-resolved noma dnsmasq, amaseva ethuneli ahlala elinganiselwe ethunelini futhi kukhona kuphela amagama ahambisana nesizinda sakho sokuhamba. Lokho kulinganiselwa yikho okushiwo i-split DNS empeleni, futhi yiso leso sigaba esivame ukushoda lapho iklayenti lithi liyayisekela.

Funda isimo ngaphambi kokushintsha noma yini:

resolvectl status
resolvectl dns tun0

Ufuna ukubona i-interface ye-tun ifakwe ohlwini ne-DNS server kanye nesizinda sokuhamba sesijobelelo esiyimfihlo, sikhoniwe njenge-~internal.example. Ukungabikho kweseva kusixhumanisi kusho ukuthi iklayenti alithumanga lutho. Iseva engenasizinda isho ukuthi ukusesha konke kuya lapho noma akukho, kuye ngoklikayenti, futhi akukho kokubili okuyi-split DNS.

Lapho i-nsswitch iqeda ukusesha kusenesikhathi

Umlayini ojwayelekile wedeskithophu ubukeka kanje:

hosts: files mdns4_minimal [NOTFOUND=return] resolve [!UNAVAIL=return] dns myhostname

I-mdns4_minimal iphethe i-multicast DNS futhi ifuna lonke igama eligcina nge-.local. Isevisi ye-Kubernetes efana ne-api.infra.svc.cluster.local iphinde igcine nge-.local. Lapho imojula ye-mDNS ibika i-NOTFOUND, isenzo [NOTFOUND=return] siqeda ukusesha konke esikhundleni sokuqhubeka kumojula we-dns, ngakho igama alilokothi lithunyelwe ku-resolver ye-VPN. I-dig idlula ifayela ngokuphelele, futhi yiyo impela into eyenza lawa mathuluzi amabili angavumelani.

Lowo umahluko obukhali kakhulu kule nkinga, futhi wehlela egameni elilodwa efayeleni lokulungiselela elidala kune-VPN yakho. Ukushintsha isenzo sibe [NOTFOUND=continue] kugcina i-mDNS yamaphrintha namadivayisi endawo kuyilapho ivumela i-DNS ukuthi ibone igama. Ukufaka umlayini nge-hosts: files dns nakho kuyasebenza futhi kuqine kakhudlwana: kushiya ukuxazululwa kwe-.local kwiphrinta oyisebenzisayo ngempela.

Amagama ahlala kunethiwekhi eyodwa kuphela

Izifunda eziyimfihlo zinegunya endaweni eyodwa kuphela. Igama le-AWS elifana ne-ip-10-0-4-31.eu-west-1.compute.internal liphendulwa nge-resolver ye-VPC yaleyo ndawo, futhi kuphela ngesikhathi iphoyinti lakho lokugcina le-VPN likuleyo ndawo efanayo nensiza. Xhuma kuphoyinti lokugcina e-Frankfurt, buza igama le-compute.internal elivela e-Ireland, futhi akukho kulungiselelwa kwendawo okuzosiza: isifunda esigcina irekhodi asifinyeleleki ukusuka lapho.

Izizinda zokusesha zikhiqiza isithombe esibuyayo. I-service elingenalutho ligcwaliswa ngesijobelelo i-resolver ecabanga ukuthi siyasebenza, futhi ngesixhumanisi se-VPN isizinda sendawo singanqoba esomkhakathi. Buza ngephuzu ekugcineni ukuze ususe ukuqagela, getent ahosts service.internal.example., futhi uma lokho kusebenza kuyilapho igama elifushane lihluleka, ukulungiswa yi-sizinda sokusesha ethunelini, hhayi ikheli leseva.

Amaklayenti aphethwe yengeza indlela yesithathu ngaphezu kwe-resolver yesistimu. Iphrofayela ye-VPN ye-Windows ingathwala inqubomgomo yayo yokuxazulula amagama, imithetho nge-app ngayinye kanye nethebula le-NRPT elisebenza ngisho lapho ithuneli liphansi. Izinhlelo ezinengqondo yazo yokugcina ye-DNS, ezijwayelekile kuma-runtime e-.NET ne-Java, zigcina ukwehluleka okudala isikhathi eside ngemva kokulungiswa kochungechunge. Amaklayenti e-Apple alungiselela i-split DNS ngamazinda afanayo kuzilungiselelo ze-DNS esikhundleni se-resolv.conf, futhi i-Chromium noma i-Firefox kumodi ye-DNS evikelekile zingadlula i-resolver yesistimu ngamagama omphakathi. I-incwadi ye-Microsoft mayelana nokuxazululwa kwamagama e-VPN ichaza uhlangothi lwe-Windows lalelo zendlalelo lenqubomgomo.

Nquma ukuthi iyiphi indlela okufanele ilungiswe

Sebenza usuka kuphawu uye endleleni esikhundleni sokuzama ukulungisa ngokulandelana:

Imigqa emibili ithwala umthwalo omningi. Isikhathi sokuphelelwa yisikhathi siyinkinga yokufinyeleleka: i-resolver eyimfihlo ayiphenduli ngethuneli, ngakho hlola indlela eya ekhelini layo nokuthi i-DNS server kusixhumanisi iyona oyicabangayo. I-NXDOMAIN iyinkinga yegunya: okuthile kuphendule futhi akazi igama, lokho okukhomba esifundeni, esifundeni noma ku-resolver okwakungafanele yamukele umbuzo.

Umlayini wokugcina yiwona abantu abawushiyayo ngoba zombili izingxenye zibonakala ziyimpumelelo. Igama elifushane elixazululwa ngendlela ehlukile kune-FQDN ukungafani kwesijobelelo, futhi ukuxhuma kabusha ithuneli ngeke kushintshe ukuthi isijobelelo sini esithunyelwa yiklayenti.

Rekhoda isimo ngaphambi kokuhlela ifayela lokulungiselela, ukuze ukwazi ukuthi ukuhlela kwenze okuthile yini:

resolvectl status > before.txt
getent ahosts service.internal.example >> before.txt

Qhuba izivivinyo ngalokhu kulandelana futhi ume kokokuqala okwehlulekayo. I-getent ne-resolvectl query kufanele zivumelane; uma i-getent yehluleka kuyilapho i-dig iphendula, hlala ochungechungeni lokusesha futhi ungathinti ukuhamba. I-resolvectl status kufanele ibonise i-DNS server nesizinda sokuhamba ku-interface ye-tun. I-nsswitch akumele ibuye kusenesikhathi nge-NOTFOUND yesijobelelo osihlolayo. Igama kufanele libe negunya kunethiwekhi okuxhunywe kuyo iphoyinti lakho lokugcina, lihlolwe ngephuzu ekugcineni. Uhlelo lokusebenza akumele lugcine inqondo yalo yokugcina noma ukugqithisa kwe-DNS evikelekile.

Lungisa kuphela indlela yokuqala ehlulekayo, bese uphinda ugxumise imiyalo efanayo. Izinguquko ezimbili ngesikhathi esisodwa zikwenza ungakwazi ukusho ukuthi iyiphi ebalulekile, futhi ukuphazamiseka okulandelayo kuqala uphenyo kusukela kuqanda.