I-WireGuard ayikucoshi i-DNS: ukukhonza indawo eyimfihlo ye-BIND

Ukuxhawulana kuthwala okhiye kanye nama-IP avunyelwe, akukaze kuthwale isixazululi. Nakhu indawo eyimfihlo ye-BIND 9 esivele ilungile kanye nenqubomgomo yeklayenti ngokuxhumana ngakunye eyenza ixazululeke.

Uphakamise i-WireGuard, umhubhe udlulisa ithrafikhi, futhi igama langaphakathi alikaxazuluki. Isinyathelo esilandelayo ngokuvamile ukufuna isilungiselelo se-DNS kukho ukuhlelwa kwe-WireGuard, kube sengathi umlingani angacindezela isixazululi njengoba amanye ama-VPN enza. Awekho. Ukuxhawulana kuthwala okhiye, amakheli esixhumi kanye nama-IP avunyelwe, futhi akunayo inkambu yamaseva e-DNS noma yamazwekazi okusesha. Inqubomgomo yesixazululi ihlala kuklayenti, futhi yilapho isilungiso kufanele sibe khona.

Umhubhe nesixazululi yizivumelwano ezihlukene

I-WireGuard incane ngamabomu. Ihambisa amaphakethe kumakheli owayobalayo futhi iqinisekisa abalingani; konke okungaphezulu kwalolo ungqimba wumklamo wakho. OpenVPN ingacindezela i-dhcp-option DNS ngoba umsele wayo wokulawula uthwala ukuhlelwa, futhi lowo mehluko ukhubeka abantu abahamba phakathi kwalokhu kokubili.

Ngakho umhubhe osebenzayo awusho lutho mayelana nokuxazululwa kwamagama. Iklayenti ingaba nomzila ophelele oya ku-10.90.0.1 futhi isathumele imibuzo yayo kusixazululi somphakathi, yingakho uphawu lubukeka njengokuthi “i-VPN yephule i-DNS” ngenkathi i-DNS ingakaze ibhekiswe ku-VPN.

Khonsa indawo ngaphandle kokuba isixazululi esiphindayo

Uhlangothi lweseva yindawo encane enegunya, hhayi isixazululi esijwayelekile. Kulesi sibonelo isango ngu-10.90.0.1, amaklayenti ngu-10.90.0.0/24, futhi uhlelo lokusebenza olubalulekile kuwe luphendula ku-10.60.0.20.

Hlanganisa lezi zilungiselelo kubhulokhi ekhona ye-options esikhundleni sokwakha eyesibili:

options {
    listen-on { 127.0.0.1; 10.90.0.1; };
    listen-on-v6 { none; };
    allow-query { 127.0.0.1; 10.90.0.0/24; };
    allow-transfer { none; };
    recursion no;
};

Bese umemezela indawo kanye nefayela layo:

zone "corp.example" {
    type primary;
    file "/etc/bind/db.corp.example";
};
$TTL 300
@ IN SOA ns.corp.example. hostmaster.corp.example. ( 1 3600 600 604800 300 )
@      IN NS ns.corp.example.
ns     IN A  10.90.0.1
portal IN A  10.60.0.20

Qinisekisa ngaphambi kokulayisha kabusha, ngoba iphutha lomthetho ngesikhathi sokulayisha liwisa iseva yonke kuyo yonke indawo eyikhonzayo:

named-checkconf
named-checkzone corp.example /etc/bind/db.corp.example

Vula i-UDP ne-TCP 53 kusixhumi se-VPN kuphela. Ukushicilela igunya eliyimfihlo kusixhumi somphakathi kumema kokubili imibuzo nokubalwa, futhi i-allow-transfer kufanele ihlale ivaliwe ngaphandle uma eyesibili idinga ngempela.

Qondisa iklayenti kuyo, ngokuxhumana ngakunye

Thatha ukuthi uxhumano luphethwe yi-NetworkManager futhi isixazululi yi-systemd-resolved. Qala ngokufunda inqubomgomo ekhona, ikakhulukazi noma yisiphi isizinda sokuhamba somsuka, ngoba umugqa we-~. uzodlula lokho osuzokwengeza.

nmcli connection modify wg-office +ipv4.dns 10.90.0.1
nmcli connection modify wg-office +ipv4.dns-search '~corp.example'

I-tilde wuhlamvu olubalulekile. Iphawula isizinda njengomzila-kuphela: amagama ngaphansi kwe-corp.example aya kuseva ye-DNS yalokhu kuxhumana, futhi isizinda asifakwa njengesijobelelo sokusesha samagama amafushane. Ngaphandle kwayo, ukuthayipha i-portal kuqala ukuxazulula i-portal.corp.example, okuwusizo kuwe futhi kuyamangaza wonke umuntu. Gcina i-tilde ngaphakathi kwezicaphuno, ngoba eyodwa engenazo izicaphuno ukwanda kwe-shell okulindele ukukhomba kufolda lakho lasekhaya.

Sebenzisa ushintsho ngomphathi ongumnikazi wesixhumi, bese uxhuma kabusha uxhumano. Ungaqali isenzakalo sesibili se-wg-quick sesixhumi esifanayo; abanikazi ababili bazolwela imizila futhi oyedwa wabo uzokunqoba ngesikhathi esibi kunakho konke.

Qinisekisa umzila ngaphambi kwegama

Buza igama kuklayenti futhi uqinisekise impendulo kanye neseva eyikhiqizile:

resolvectl query portal.corp.example

Uma lokho kubuyisela i-10.60.0.20, isivumelwano se-DNS sesigcwalisiwe. Uma siphelelwa isikhathi, hlunguza kuqala umzila oya ku-10.90.0.1, bese umthetho wothango lomlilo, bese i-allow-query kuseva. Ukwehluleka kokuxazulula amagama kulolu hlelo cishe ngaso sonke isikhathi ukufinyeleleka noma i-ACL, hhayi ifayela lendawo. Sebenza usuka kuklayenti uya ngaphandle, ngoba iseva ayikwazi ukukutshela ukuthi kungani umbuzo ungakaze ufike.

Khumbula ukuthi uhlelo lokusebenza lusadinga umzila walo kanye nemvume yalo yensizakalo. Igama elixazululiwe elikhomba ekhelini elingafinyeleleki ukwehluleka okunye okugqoke izingubo ezifanayo.

Okungakabi okuzenzakalelayo

Izinhlelo zokusebenza ezinengqondo yazo yesixazululi ziyiziba ngokuphelele isixazululi sohlelo, futhi akukho nani le-nmcli elishintsha lokho. Ukusetshenziswa okuqinisekisa i-DNSSEC kudinga umklamo ocacile wenganiso yokuthembela endaweni eyimfihlo; impendulo akuwona umyalelo ojwayelekile wokucisha ukuqinisekisa. Hlola ngesofthiwe yeklayenti efanayo esetshenziswa abasebenzisi bakho, hhayi ngethuluzi elisebenzisa ngengozi isixazululi sohlelo. Igebe phakathi kwalokhu kokubili yiwo wonke umbiko wesiphambeko.

Amabutho amakhulu angenza le nqubomgomo yeklayenti izenzakalele ngohlelo lwawo lokuhlinzeka, kodwa inqubomgomo ihlala iyinto ehlukile enomnikazi. Incwadi yokubhekisela ye-BIND 9 ihlanganisa izilawuli zokulalela nokubuza ezisetshenziswe ngenhla, futhi iyindawo efanele yokuqinisekisa ukuziphatha kwenguqulo yakho efakiwe.

Isinyathelo esilandelayo: engeza ukukhushulwa kwenombolo yokulandelana kwendawo kanye nemiyalelo yokuhlola enqubweni yakho yezinguquko, ukuze ukuhlelwa kwerekhodi kungafinyeleli ekukhiqizeni kungahloliwe.

Izihloko ezihlobene