Kungani i-Pi-hole v6 iziba imibuzo ye-DNS evela kumaklayenti e-WireGuard

I-Pi-hole v6 ithola umbuzo we-DNS embobeni 53 bese inquma ukuthi iphakethe elifikile livunyelwe ukuphendulwa yini. Kusisibambeli se-WireGuard leso sinqumo sesibili ngokuvamile siyisizathu sokuthi iklayenti lithole isikhathi esiphelile kuyilapho isixazululi sibonakala siphilile kusukela ku-LAN. Umbobo uvulekile, i-FTL iyasebenza, noma kunjalo akukho okubuya ku-10.90.0.1. Izinto ezintathu zisebenzisana ngaphambi kokuba impendulo iphume: dns.interface, dns.listeningMode kanye ne-firewall engaphambi kwakho kokubili.

Isokhethi elalelayo ayinqumi ukuthi ubani uthola impendulo

I-FTL ivula izilaleli ze-UDP ne-TCP embobeni 53. Ekumisweni okuzenzakalelayo isokhethi ivamise ukuba yi-wildcard, ngakho ss -lunp | grep :53 ibonisa 0.0.0.0:53 kanye ne-[::]:53 kungakhathaliseki ukuthi amaklayenti e-VPN ayasebenzelwa yini. Isokhethi ye-wildcard iyamukela iphakethe, bese i-FTL isebenzisa imithetho yayo yesixhumi nomthombo ngaphambi kokuphendula. Yingakho "umbobo uyalalela" kufakazela okuncane mayelana neklayenti lethumbu.

Funda ukumisa okusebenzayo esikhundleni sefayela ocabanga ukuthi liyasebenza. pihole-FTL --config dns.interface kanye pihole-FTL --config dns.listeningMode zishicilela amanani asebenzayo, futhi angahluka kufayela lesibambeli uma i-container, okuguquguqukayo kwemvelo noma umphathi wokuthunyelwa ephethe leso silungiselelo. Incwadi yokumisa ye-Pi-hole FTL ibala izimo nokuthi iyiphi yazo encike kusixhumi.

I-LOCAL ibuza ukuthi yisiphi isethi engaphansi, i-SINGLE ibuza ukuthi yisiphi isixhumi

I-LOCAL, okuzenzakalelayo, iphendula imibuzo ikheli lomthombo layo eliyingxenye yesethi engaphansi emiswe kwesinye sezixhumi zesibambeli. I-wg0 elula ene-10.90.0.1/24 iyadlula lolo vivinyo, ngoba iklayenti eliku-10.90.0.2 lihlezi ngaphakathi kwesethi engaphansi yethumbu. Iklayenti eliqondisiwe ngaphesheya kontanga, noma elikhohlwe ngemuva kwe-NAT kwesinye isiqalo, ayidluli, nakuba iphakethe lafika ku-wg0, futhi awukho umbuzo obonakalayo kungobo yomlando.

I-SINGLE ishintsha umbuzo. Yamukela imibuzo efika kusixhumi esishiwo ku-dns.interface, kufaka phakathi i-loopback, futhi iziba isethi engaphansi yomthombo. Yileso simo esihlala njalo kuthopolojini ye-VPN ehlanganisiwe noma eqondisiwe. Setha kokubili okhiye ndawonye, ngoba isimo esingenaso isixhumi esishiwo awusona isiqondiso esiphelele:

sudo pihole-FTL --config dns.interface "wg0"
sudo pihole-FTL --config dns.listeningMode "SINGLE"

I-BIND ishintsha isokhethi, futhi lokho kunezindleko

I-BIND ayihlungi isokhethi ye-wildcard; ibopha umbobo 53 kuphela kumakheli akhona kusixhumi esishiwo, ngakho i-kernel iyenqaba amaphakethe afika kwenye indawo. Inamandla ukwedlula i-SINGLE futhi ayisona isifaniso sayo. Izindleko zibonakala ekuqaleni: uma i-wg0 ingekho phezulu lapho i-FTL iqala, kungenzeka kungabi nakheli lokubopha, futhi isixazululi singasebenza ngaphandle kwesilaleli kuze kuvele isixhumi bese i-FTL iqala kabusha.

Khetha i-BIND lapho ulawula ukulandelana kokuqala, isibonelo iyunithi ye-systemd ehlelwe ngemuva kwesixhumi se-WireGuard, nalapho ufuna i-kernel ilahle amaphakethe adukile ngaphambi kokuba i-FTL iwabone. Khetha i-SINGLE lapho ithumbu liza futhi lihamba, noma lapho isixhumi sidalwa ithuluzi eliqala ngemuva kwe-FTL.

I-firewall iyisango lesibili

Isimo se-FTL esifanele sisahluleka uma i-firewall yesibambeli ilahla umbobo 53 ku-wg0. Vumela ibanga lomthombo we-VPN kuzo zombili izimiso futhi ugcine uhlangothi lwe-inthanethi luvaliwe. Ku-nftables, nechunge lwe-input elikhona kuthebula le-inet filter, imithetho ibonakala kanje:

sudo nft add rule inet filter input iifname "wg0" ip saddr 10.90.0.0/24 udp dport 53 accept
sudo nft add rule inet filter input iifname "wg0" ip saddr 10.90.0.0/24 tcp dport 53 accept

Engeza imithetho ye-IPv6 efanayo uma ithumbu lithwala i-IPv6, futhi uyibeke ngaphambi kwenqubomgomo ye-drop yochunge. Uma isibambeli sisebenzisa i-ufw noma i-firewalld, veza ukufana okufanayo kulowo mphathi esikhundleni sokuhlanganisa amathuluzi. Ungadlulisi umbobo 53 usuka kurutha we-inthanethi; amaklayenti kufanele afinyelele ikheli le-VPN lesixazululi ngethumbu.

Izindlela ezimbili zihlala zehlukene. Imibuzo yamaklayenti iphela ku-FTL. Ukusesha kwe-FTL uqobo okuya phezulu kuphuma ngokuhambisana nethebula yokuqondisa yesibambeli, engase isebenzise ithumbu noma ingalisebenzisi, ngakho isixazululi esiphendulayo kodwa esingabuyiseli lutho olusizo siyinkinga yaphezulu. Ukuphatha kwewebhu ne-API kulalela emimoyeni yazo futhi kudinga umkhawulo wazo.

Qinisekisa impendulo nokwenqatshwa

Kusuka kuklayenti le-VPN, buza ikheli lesixazululi kuzo zombili izimiso: dig @10.90.0.1 example.com kanye dig +tcp @10.90.0.1 example.com. Bese uhlola umbhalo wemibuzo kusixhumi sokuphatha ukuze uqinisekise ukuthi i-FTL irekhode umbuzo. Isikhathi esiphelile sekhayenti ngaphandle komugqa kumbhalo sikhomba ku-firewall noma isihlungi sesixhumi; umugqa ongenampendulo ukhomba ekuxazululweni kwaphezulu.

Hlola indlela engemihle kusuka kusibambeli esingaphandle kwe-VPN. dig @10.90.0.1 example.com kufanele siphelelwe yisikhathi, futhi ss -lunp kusixazululi akufanele sibonise umbobo 53 uboshelwe ekhelini lomphakathi. Qala kabusha insizakalo kanye, bese uqala kabusha isibambeli futhi uqinisekise ukuthi isixazululi sisaphendula lapho i-wg0 ibonakala futhi. Umbuzo osebenza kuphela kuze kube ukuqala kabusha okulandelayo awusona ushintsho oluqediwe.