Kungani amagama e-DNS ayimfihlo ehluleka kumaklayenti e-VPN nokuthi kuqondwe kuphi

Uvula i-laptop ekamelweni lehhotela, uqalisa iklayenti, ubhala igama leseva yamafayela yangaphakathi, bese ungezu lutho. Ithuneli libika ukuthi lixhunyiwe, futhi i-ping eya ekhelini elikuleso subnet iyaphendula, ngakho ukuthutha uqobo kuhle. Igama kuphela elihlulekayo, futhi leso sikhala sinciphisa inkinga ezindaweni ezimbili: iyiphi isixazululi iklayenti eliyibuzile nokuthi ingabe impendulo eliyitholile ingabuya ngethuneli. Lungisa okukodwa futhi ushiye okunye, futhi iphutha lizovele linyakaze.

Ngaphambi kokuhlela noma yiliphi iphrofayela, qinisekisa ukuthi iklayenti lenza ini ngegama. Ku-Linux, resolvectl query files.corp.example likhombisa ukuthi yiluphi uxhumano futhi iyiphi isixazululi eyakha impendulo. Ku-Windows, Resolve-DnsName files.corp.example likhombisa iseva eyaphendula nekheli eyalibuyisela.

Funda impendulo ngaphambi kokushintsha noma yini

Uma igama libuya njenge-NXDOMAIN kumamillisecond ambalwa, umbuzo awuzange ufinyelele isifunda sakho futhi isixazululi somphakathi noma sehhotela yiphendulile. Uma libuya ngemuva kokuma isikhathi eside, kukhona okulahla iphothi le-UDP 53 endleleni futhi iklayenti lagcina libuyele kokunye. Uma liphendula ngekheli elifanele kodwa uxhumano lusamile, ukusesha kuhle futhi inkinga yakho isekuhambiseni noma kusevisi ngokwayo.

Lokho kwahlukanisa kathathu konga ihora lokucabanga. Kukutshela futhi ukuthi kufanele ngabe uyayithinta i-VPN noma cha: igama elixazululeka ekhelini langaphakathi elifanele selivele likufakazile ukuhamba kwesixazululi, ngakho umsebenzi osele usendleleni yedatha.

Sabalalisa isixazululi siphume ngaphakathi kwethuneli

Amaklayenti ahlukana ngamaqembu amabili. Elinye iqembu iseva ingalinikeza isixazululi ngesikhathi kusungulwa uxhumano; elinye ligcina isilungiselelo kufayela lendawo okungeke kube khona i-gateway engalishintsha kude.

OpenVPN liseqenjini lokuqala. Kuseva, push "dhcp-option DNS 10.8.0.53" ne-push "dhcp-option DOMAIN corp.example" yehla ngomzila wokulawula, kodwa kuphela uma ukucushwa kweklayenti kusasebenza pull. Iklayenti elihlelwe ngesandla elithwele pull-filter ignore "dhcp-option" ngeke lizibone, futhi lowo mugqa owodwa uchaza inani elimangalisayo lamacala athi «iseva iyayicindezela kodwa i-laptop yami ayivumelani».

I-WireGuard iseqenjini lesibili, ngoba iphrothokholi ayinakho nhlobo ukuxoxisana kwezinketho. Isixazululi nesizinda sokusesha kungena kubhloko engu-[Interface] yeklayenti uqobo njenge-DNS = 10.8.0.53, corp.example. I-wg-quick ikusebenzisa nge-resolvconf noma nge-systemd-resolved, futhi ku-Windows iklayenti elisemthethweni lifaka imithetho ye-NRPT ekhona kuphela ngesikhathi ithuneli limile: Get-DnsClientNrptPolicy iyizabalaza, okwenza kube indlela esheshayo yokubona ukuthi iklayenti lake lasebenzisa ifayela lakho.

I-IPsec/IKEv2 isephakathi. Isengezo se-attr se-strongSwan singabuya nesixazululi se-DNS esithathwe echibini, futhi iklayenti le-Windows livame ukukwamukela, kodwa iphrofayela ebopha isixazululi sayo samagama iyawina kunoma yini enikezwa i-gateway. Kuklayenti le-Linux isinyathelo sesandla esilinganayo yi-resolvectl dns wg0 10.8.0.53 elandelwa yi-resolvectl domain wg0 '~corp.example'; kokubili kuyanyamalala kanye ne-interface, okuyikho kanye okufunayo kusilungiselelo esiboshelwe ethunelini.

Khawulela isijobelelo esikhundleni sokugwinya yonke imibuzo

Ukuqondisa lonke uhlu lwezixazululi zeklayenti kuseva yakho yangaphakathi kulula futhi ngokuvamile akulungile. Khona-ke wonke igama lomphakathi lixazululwa ngokuphuma kwesikhungo sakho sedatha, ama-CDN abuya namakheli akude, futhi ukuphazamiseka okukodwa kwesixazululi kuhamba nokuphequlula komsebenzisi.

Thumela ngaphakathi kuphela isijobelelo esiyimfihlo. Ku-systemd-resolved, isizinda esiqala nge-~ senzelwe ukuhambisa kuphela, ngakho i-~corp.example isho ukuthi imibuzo engaphansi kwaleso sijobelelo iya kumaseva alolo xhumano ngenkathi konke okunye kuqhubeka kusebenzisa inethiwekhi ebonakalayo. I-Windows yenza okufanayo ngemithetho ye-NRPT ekhawulelwe esikhaleni samagama, futhi i-macOS ngefayela lesixazululi elengeziwe ngaphansi kwe-/etc/resolver/.

Amagama e-multicast afanele aphendulwe ngokwawo. Amagama e-.local ayi-link-local ngokwakhiwa (RFC 6762) futhi i-interface ye-tun yephuzu-kuphuzu ayithwali lelo qembu le-multicast, ngakho ukwengeza isixazululi somphakathi ngeke kuwaveze futhi ukubuza isixazululi sangaphakathi se-unicast ngawo kubuyisa i-NXDOMAIN. Isibonisi esifana ne-avahi esimweni sokubonisa singaxhumanisa izingxenye ezimbili, kodwa leso yisinqumo sohlangothi lweseva okungekho klayenti elingasicela. Uma iphrinta noma i-NAS kufanele ifinyeleleke ngegama, yinikeze irekhodi le-A esifundeni sakho.

Fakazela ukuthi impendulo ingabuya

Impendulo efanele ekhomba ikheli elingafinyeleleki ibukeka njenge nkinga yesixazululi kuze kube yilapho uhlola umzila. Buza inhliziyo yekhompyutha ukuthi impendulo ingaya kuphi: i-ip route get 10.20.5.20 isho i-interface futhi, ngokuwusizo kakhulu, ikheli lomthombo elizolisebenzisa.

Qaphela ikheli lesixazululi uqobo. Iklayenti eline-DNS = 10.8.0.53 eduze kwe-AllowedIPs = 10.20.0.0/16 lithumela imibuzo yalo ngaphandle nge-NIC ebonakalayo, lapho ifela khona buthule, ngoba isixazululi asikho ngaphakathi kwanoma yisiphi isiqalo esifunwa ithuneli. Lokho kungafani kuyiphutha lesizathu esisodwa elivame kakhulu kuyo yonke le ndawo, futhi akubonakali ngaphandle uma uqhathanisa isilungiselelo se-DNS neziqalo ezivunyelwe umugqa ngomugqa.

Izikhawu ezigqagqanayo zibangela iphutha eliphambene. Impendulo ilungile, umzila ukhona, futhi ukhomba kuseva okungeyona, ngoba i-192.168.0.0/24 ekhaya icace kakhulu kunomzila wethuneli oya esikhaleni esifanayo. Phinda ukhombe uhlangothi olulodwa noma usunduze umzila omncane, bese uqinisekisa i-firewall nomzila wokubuya wesisebenzi, futhi amanothi e-strongSwan mayelana nokudlulisela ahlanganisa uhlangothi lwe-sysctl lwalowo mzila.

Amatifikeyiti awukuhlola kobunikazi okwahlukile abantu abakubeka ku-DNS. Uma isiphequluli sibika ukungafani kwegama esikhundleni sephutha lokuxazulula, ukusesha sekusebenzile futhi i-SAN kusitifikeyiti yiyo edinga ukulungiswa. Hlola i-HTTPS ngeligama, hleze nge-IP enqunu.

Phinda uhlole kusuka kuklayenti, hhayi ku-gateway

Hlola ngaphakathi kohlelo lokusebenza umsebenzisi akhalangayo ngalo, ngoba ukusesha emugqeni womyalo akufakazeli ukuthi isiphequluli sithatha umzila ofanayo. I-DNS ephephile ye-Chrome ne-network.trr.mode ye-Firefox kungadlula ngokuphelele isixazululi sohlelo, futhi uma kwenze njalo, igama eliyimfihlo liyahluleka noma licathamele esixazululini somphakathi. Ukuqhathanisa i-resolvectl query ne-dig @10.8.0.53 files.corp.example esetshenziswe ngesandla kukutshela ukuthi yikuphi kwalokhu kokubili okwenzekile.

Bese unqamula futhi uxhume kabusha ngaphambi kokusho ukuthi sekulungisiwe. Izilungiselelo ezifakwe ngesandla ku-interface zinyamalala kanye ne-interface, futhi iphrofayela eyayibonakala ilungile kuphela ngenxa yoshintsho lwendawo olukhohliwe izohluleka ekukhishweni okulandelayo.

Uhlu lokuhlola olufushane lwemishini elandelayo: igama lixazululwa ngesixazululi sethuneli, isijobelelo sikhawulelwe hhayi umhlaba wonke, ikheli lesixazululi lingaphakathi kweziqalo ezivunyelwe, iseva esempendulweni iyaphendula kuphothi lesevisi, futhi isitifiketi sihlanganisa igama elibhalwe umsebenzisi.