WireGuard DNS DNAT: gcina indlela yokuphendula isebenza

I-DNAT ibhala kabusha indawo okuyiwa kuyo, hhayi umthombo. Nquma ukuthi i-resolver ephezulu ingaphendula kanjani ngaphambi kokufaka umthetho, futhi gcina ukufana ngakunye kuncane.

Ukuqondisa umbuzo we-DNS weklayenti le-WireGuard kwenye i-resolver kubonakala kuwumthetho owodwa kodwa kuziphatha njengezinqumo ezintathu. Indawo okuyiwa kuyo kufanele ibhalwe kabusha, iphakethe kufanele lidluliswe, futhi impendulo kufanele ithole indlela yokubuya ngaphakathi kwesimo sokuhumusha esidalwe yi-gateway. Uma weqa okwesithathu, umbuzo uphuma uhlanzekile kuyilapho iklayenti lilinda ingunaphakade.

Thatha isibonelo samaklayenti agunyaziwe ku-10.77.0.0/24 angena nge-wg0, abuza ikheli elimenyezelwe 10.77.0.1 futhi adinga i-resolver ku-203.0.113.53. Ikheli eliphezulu liyisibambeli sombhalo, hhayi isevisi esebenzayo.

Ukuqondisa kabusha umbuzo kushintsha indawo yawo kuphela

Umthetho we-NAT wendawo okuyiwa kuyo ku-PREROUTING ubhala kabusha ikheli ngaphambi kokuthathwa kwesinqumo somzila, ngakho iphakethe libe seliqondiswa endaweni entsha esikhundleni sendala. Ikheli lomthombo weklayenti alithintwa yilowo msebenzi. Yikho umthetho obonakala ugcwele usengakhiqiza ukuthula: isicelo manje siya kwi-resolver engakaze izwe ngobubanzi obuyimfihlo beklayenti. I-gateway ihumushe inkambu eyodwa futhi yazuza inkinga yesibili.

Zombili izindlela ze-DNS zidinga imithetho efanayo, ngoba iklayenti libuyela ku-TCP lapho impendulo isikwa.

Imithetho engezansi ikhetha isixhumanisi esisodwa esingenayo, ububanzi obubodwa bamaklayenti nekheli elilodwa lendawo yokuqala. Akukho okunye ku-gateway okuthintekayo, futhi umbuzo we-gateway uqobo awufani nakancane.

sysctl -w net.ipv4.ip_forward=1
iptables -t nat -A PREROUTING -i wg0 -s 10.77.0.0/24 -d 10.77.0.1 -p udp --dport 53 -j DNAT --to-destination 203.0.113.53:53
iptables -t nat -A PREROUTING -i wg0 -s 10.77.0.0/24 -d 10.77.0.1 -p tcp --dport 53 -j DNAT --to-destination 203.0.113.53:53

Indlela yokuphendula isinqumo esihlukile

Izinhlelo ezimbili zivumela impendulo ukuthi ibuye, futhi ukukhetha okukodwa kusenesikhathi kusindisa isikhathi sokulungisa. Noma i-resolver ephezulu inendlela yokubuyela ku-10.77.0.0/24 ngaleyi gateway, noma i-gateway ihumusha umthombo lapho iphuma ukuze impendulo ifike ekhelini elivele laziwa yiphezulu. Kokubili kuyasebenza; kukodwa kuphela okuhambisana nokulawula kwakho okuphezulu.

Umzila ufanelwe ukuzanywa kokuqala, ngoba ugcina ikheli leklayenti libonakala kwi-resolver futhi ugwema ungqimba lwesibili lokuhumusha. Lapho okuphezulu kungaphandle kokulawula kwakho, ukuhumusha umthombo kusixhumanisi esithile sokuphuma ukukhetha okungokoqobo.

Nciphisa lokho kuhumusha ngokuqinile njengokuqondisa kabusha, kungenjalo umthetho uzoba i-NAT yenjongo evamile kukho konke okuzihambelanayo ngengozi:

iptables -t nat -A POSTROUTING -s 10.77.0.0/24 -d 203.0.113.53 -o eth0 -p udp --dport 53 -j MASQUERADE
iptables -t nat -A POSTROUTING -s 10.77.0.0/24 -d 203.0.113.53 -o eth0 -p tcp --dport 53 -j MASQUERADE

Ukulandelela ukuxhumana kugcina imephu ibhangqwe, ngakho impendulo ibhalwa kabusha ibuyela ku-tuple yokuqala yeklayenti lapho ibuyayo. Ngaphandle komthetho wokuphuma, i-resolver ithumela impendulo yayo ekhelini eliyimfihlo engakwazi ukulifinyelela, futhi iklayenti libona isikhathi siphela esikhundleni sephutha.

Bhala imithetho incane kunalokho umsebenzi obonakala kukho

Imvume yokudlulisela ingeyobubanzi obufanayo. Vumela ukugeleza kusuka kuklayenti kuye kwi-resolver kanye nokuhamba kokubuya okuvele kwaziwa yi-conntrack, esikhundleni sokwamukela zonke izixhumanisi ze-DNAT emshinini. Ukwamukela konke kugunyaza futhi ukudluliselwa kwamachweba okungenasihlobo ne-DNS.

I-resolver ye-gateway uqobo iyindlela ehlukile yekhodi. Umbuzo okhishwe endaweni udlula ku-OUTPUT, ngakho ukuhlola kusuka ku-shell ye-gateway akuzivocavoci umthetho we-PREROUTING noma inqubomgomo yokudlulisela. Yikho ukuhlola kwendawo kungaphumelela kuyilapho wonke amaklayenti ehluleka, futhi okuphambene nakho kuvamile ngokufanayo.

Akukho lapha okuhlanganisa i-DNS phezu kwe-HTTPS kuchweba 443 noma i-DNS phezu kwe-TLS kuchweba 853, futhi akukho okuhlanganisa i-IPv6. Iklayenti eline-resolver ye-IPv6 elungisiwe lizokushaya indiva konke ukuhlelwa ngenjabulo.

Umbuzo omusha ufakazelani

Ukulandelela ukuxhumana kukhumbula amamephu angaphambili, ngakho umbuzo othunyelwe ngaphambi koshintsho lomthetho ungaphendulwa kusimo esidala futhi wenze umthetho omusha ubonakale uphukile. Qala ngechweba elisha lomthombo futhi, lapho iklayenti ligcina khona izimpendulo, ngegama elisha.

dig @10.77.0.1 example.com A +short
conntrack -L -p udp --dport 53 | head

Umyalo wokuqala ukhombisa ukuthi indlela yeklayenti iyaxazululeka yini, futhi owesibili ukhombisa ukuhumusha i-gateway ekufake ngempela, kuhlanganisa izinhlangothi zombili ze-tuple. Imephu ekhomba kwi-resolver efanele kodwa isibali sezimpendulo sinamathele kuziro iyinkinga yendlela yokubuya hhayi eyokuhlunga.

Qinisekisa ukuthi i-resolver iyawazi amagama owalindele ngaphambi kokubuyisela noma yini. Okunye okuphendula amagama omphakathi kodwa hhayi isifunda sakho esiyimfihlo yenza usesho olusebenzayo lube i-NXDOMAIN ebonakala njengomhubhe ophukile. Hlola i-resolver ngqo, kusuka ku-gateway, ngaphambi kokuthi indlela yeklayenti ihileleke. Futhi isithenjwa sezandiso ze-iptables ibhala umqondo we-DNAT ne-masquerade okuyimithetho encike kuwo.

Izihloko ezihlobene