Ingabe udinga i-DNS eguquguqukayo yesiphakamiso se-VPN sasekhaya?

Iningi lezinkinga ze-VPN zasekhaya abantu abangibuza ngazo akuzona izinkinga ze-DNS, kodwa nokho baqala ngokuthenga ukubhalisela i-DNS eguquguqukayo. Ngaphambi kokuthi uhlele noma yini, nquma ukuthi igama lomsingathi liyona ngxenye ephukile ngempela yini. Isibuyekezi sibhala kabusha irekhodi lapho ikheli olunikwe umhlinzeki wakho lishintsha; alikwazi ukuvula imbobo, ukudlula i-NAT yenkampani yezokuxhumana noma ukwenza isikhathi esisebenzayo se-WireGuard sibone ukuthi indawo yaso yokugcina ishintshile. Izimo ezintathu zinquma ukuthi i-DNS eguquguqukayo iyisixazululo sonke noma umugqa owodwa kuphela waso.

Isimo sokuqala: ikheli lakho lishintsha ngempela

Amakheli ezindlu ashintsha ngezizathu ezivamile: i-modem iphinda iqondaniswe ngemva kokuphazamiseka kukagesi, umhlinzeki ulinganisa kabusha ichibi, ukuqashwa okusha kufika ngemva kokuphazamiseka isikhathi eside. Kwamanye imigqa ashintsha futhi ngokungavamile, futhi ngibonile ikheli elifanayo lihlala unyaka wonke; izinhlelo zebhizinisi zivame ukufaka eliqinileyo. Uma kungekho okushintshile ezinyangeni eziyishumi nambili, irekhodi elilodwa le-A olihlela ngesandla liyisidakamizwa esisodwa esincane okufanele usigcine siphefumula.

Kala esikhundleni sokuqagela. Funda ikheli le-WAN ekhasini lesimo se-router, bese uqhathanisa nalokho okubonwa yizwe langaphandle. Sebenzisa lokhu kusuka kumshini ose-LAN:

curl -fsS https://api.ipify.org; echo

Uma amanani womabili ehluka, kukhona okuthile okuhumushayo phambi kwe-router yakho futhi akukho sibuyekezi segama lomsingathi esizolungisa lokho. Ikheli elingaphakathi kwe-100.64.0.0/10 iyibanga elabiwe le-NAT yezinga lenkampani yezokuxhumana, futhi yisona sizathu esivamile sokuthi igama elibuyekezwe ngendlela efanele lisaphelelwa yisikhathi ngaphandle.

Isimo sesibili: amaklayenti aphinda afune igama

I-TTL emfushane iyingxenye abantu abayeqayo. Izixazululi eziphindayo zihlonipha i-TTL yerekhodi, kodwa izitaki zamaklayenti zigcina ngokuhlukile, futhi umhubhe osevele umile awuxazululi lutho kabusha. Ngesikhathi ulungisa amaphutha beka irekhodi kumasekhondi angu-60-300; lokho kunciphisa iwindi lapho kunikezwa khona impendulo endala, futhi akuhambisi isikhathi esixhunyiwe.

OpenVPN ixazulula kabusha umugqa remote vpn.example.net 1194 njalo lapho ixhuma kabusha, futhi resolv-retry infinite iwugcina uzama futhi esikhundleni sokuphuma lapho ukusesha kuhluleka. Kusiphakamiso, float ivumela isikhathi esisunguliwe ukuthi silandele uzakwabo okushintshile ikheli lomthombo wakhe. I-WireGuard iqondile kakhulu: wg-quick up ixazulula Endpoint lapho kusetshenziswa ukulungiselelwa, futhi iklayenti iyixazulula futhi lapho yakha kabusha umhubhe, ngakho ukuxhawulana okusaphumelela kukheli elidala kuqhubeka kuphumelela kuze kume.

Umehluko lowo wakha uhlelo. Uma amaklayenti exhuma lapho kudingeka, ukushintsha kwekheli kubiza ukuxhuma kabusha okukodwa. Uma egcina isikhathi sivulekile izinsuku, lindela ukuthi umhubhe ufe ekuxhawulaneni okulandelayo, futhi wenze iklayenti lizame futhi esikhundleni sokucabanga ukuthi lihlala limile.

Isimo sesithathu: indlela yokungena isavulekile

I-DNS eguquguqukayo ishintsha kuphela lapho igama likhomba khona futhi akukho okunye. Ukudluliswa kwembobo ku-router, umthetho we-firewall kumsingathi we-VPN kanye nemvume yomhlinzeki yamaphakethe angenayo konke kufanele kube khona ngaphambi kokuthi irekhodi libe nencazelo. Bheka ukuthi ukudluliswa kuqondise kuphi: uma kuboshwe ekhelini le-WAN esikhundleni se-interface, ukushintsha kwekheli kwephula ukudluliswa ngokuthula futhi irekhodi lithola icala.

Hlola ngaphandle. Ifoni ekudatheni kweselula okucishiwe i-Wi-Fi iyisivivinyo esithembekile esishibhile kunazo zonke; ikhompyutha ephathekayo kulelo LAN ayisiyo. Lapho igama lixazululeka ekhelini lakho lomphakathi futhi i-router ingenalo iluphu ye-NAT, isivivinyo sangaphakathi sehluleka kuyilapho irekhodi lilungile ngokuphelele, futhi lokho kuthumela iningi labantu ukuhlela irekhodi elingakaze libe nephutha.

Yini okufanele uyisebenzise lapho zontathu zigcwalisekile

I-ddclient iyisibuyekezi esimangaza kancane kumsingathi omncane. Ukulungiselelwa okuncane kushicilela ikheli elibonwa umhlinzeki, futhi lokho kugwema iphutha le-NAT ekabili:

protocol=dyndns2
use=web, web=https://api.ipify.org
server=updates.your-dns-provider.net
login=vpn-home
password=update-token
vpn.example.net

Yisebenzise kusuka kusibali sikhathi se-systemd njalo ngemizuzu embalwa esikhundleni somjikelezo we-shell, futhi bhala impendulo yomhlinzeki esikhundleni sokucabanga ukuthi kuphumelele. Phatha ubufakazi njengokhiye, ngoba yibo obunquma ukuthi iklayenti ngalinye lithunyelwa kuphi: sebenzisa ithokheni yokubuyekeza enomkhawulo esikhundleni sephasiwedi ye-akhawunti, gcina ifayela kumodemu engu-0600, futhi thumela izibuyekezo nge-HTTPS.

Qinisekisa ngaphambi kokuzibophezela

Ukusesha okukodwa kukutshela lokho okubonwa yizwe elisele, futhi kuphrinta i-TTL okufanele uyilinde ngemva koshintsho:

dig +noall +answer vpn.example.net @1.1.1.1

Qhathanisa lelo kheli nekheli le-WAN le-router. Uma kufana, igama lenza umsebenzi walo futhi okusahlulekayo ukufinyeleleka kokungena, ukhiye noma iklayenti elingakaxazululi futhi. Uma kuhlukile, isibuyekezi sishicilela i-interface engalungile, imvamisa ngoba besisebenza kumsingathi we-VPN ongemuva kwe-router esikhundleni sokuba se-router uqobo.

Gcina ukuhlehla okuthatha umzuzu: bhala ikheli lokugcina elisebenzile kanye ne-TTL yangaphambili, ukuze ukwazi ukushicilela kokubili ngesandla ngesikhathi umhlinzeki enentambama embi.

Lapho impendulo ingu-cha

Uma isimo sokuqala noma sesithathu sehluleka, yisinqumo esishintshayo hhayi ukulungiselelwa. Ngemuva kwe-NAT yenkampani yezokuxhumana, izinketho zakho ezingokoqobo ukucela umhlinzeki ikheli lomphakathi, ukuhambisa indawo yokungena ku-VPS encane enekheli elizinzile, noma ukusebenzisa isembozo esigcina umhlangano waso. Uma ikheli lizinze, yeqa isibuyekezi: irekhodi elilodwa le-A, irekhodi elilodwa le-AAAA uma usebenzisa i-IPv6, ukudluliswa kwembobo okufanayo.

Uma ikheli lishintsha ngesikhathi amaklayenti esaxhunyiwe, ukulungiswa kwangempela kuhlala kuklayenti: umqondo wokuxhuma kabusha kanye nesikhawu sokuzama futhi, hhayi isibuyekezi esisheshayo. Ukwengeza umhlinzeki wesibili kufihla isikhawu kuphela.

Ngaphambi kokuqhubeka, qinisekisa izinto ezine ngokulandelana:

• Ikheli elishicilelwa isibuyekezi lihambisana nekheli le-WAN le-router.
• I-TTL yerekhodi lifushane ngokwanele ukuthi ushintsho lubonakale emizuzwini embalwa.
• Ukudluliswa kwembobo kuboshelwe ku-interface, hhayi ekhelini eliqinile.
• Iklayenti langempela elilodwa lixhume kabusha futhi ladlulisa ithrafikhi kusukela koshintsho lokugcina.

Uma zine zigcwalisekile, shiya ukulungiselelwa njengoba kunjalo; ukwehluleka kwakho okulandelayo akusiyo inkinga yokuqamba amagama, ukhiye noma umthetho we-firewall. Uma okuthile kuhluleka, lungisa lowo mugqa ngaphambi kokwengeza enye ingxenye enyakazayo. RFC 2136 ichaza indlela yokubuyekeza ngokwayo, uma ufuna ukubona ukuthi idaemon ibeka ini ocingweni.