Ungayibhala Kanjani I-DNS Yakho Ngaphandle Kokuthinta Irutha Yakho nge-DoH: Umhlahlandlela Ophelele

¿Ungayibhala kanjani i-DNS yakho ngaphandle kokuthinta umzila wakho usebenzisa i-DNS phezu kwe-HTTPS? Uma ukhathazekile ngokuthi ubani ongabona ukuthi imaphi amawebhusayithi oxhuma kuwo, Bethela imibuzo Yesistimu Yegama Lesizinda nge-DNS nge-HTTPS Kungenye yezindlela ezilula zokukhulisa ubumfihlo bakho ngaphandle kokuthi ulwe nomzila wakho. Nge-DoH, umhumushi oguqula izizinda zibe amakheli e-IP uyeka ukuhamba endaweni ecacile futhi adlule emhubheni we-HTTPS.

Kulo mhlahlandlela uzothola, ngolimi oluqondile futhi ngaphandle kwejagoni eningi, Iyini ngempela i-DoH, ihluke kanjani kwezinye izinketho ezifana ne-DoT, ukuthi ungayenza kanjani kuziphequluli nezinhlelo zokusebenza (okuhlanganisa i-Windows Server 2022), ungaqinisekisa kanjani ukuthi iyasebenza ngempela, amaseva asekelwayo, futhi, uma uzizwa unesibindi, ngisho nokuthi ungasetha kanjani isixazululi sakho se-DoH. Konke, ngaphandle kokuthinta irutha…ngaphandle kwesigaba sokuzithandela salabo abafuna ukusimisa ku-MikroTik.

Iyini i-DNS phezu kwe-HTTPS (DoH) nokuthi kungani ungase uyikhathalele

Uma uthayipha esizindeni (ngokwesibonelo, Xataka.com) ikhompuyutha ibuza isixazululi se-DNS ukuthi iyini i-IP yayo; Le nqubo ivamise ukuba embhalweni ongenalutho Futhi noma ubani okunethiwekhi yakho, umhlinzeki wakho we-inthanethi, noma amadivayisi aphakathi angakwazi ukuyiphenya noma ukuyikhohlisa. Lona umnyombo we-DNS yakudala: iyashesha, itholakala yonke indawo… futhi ibonakala kubantu besithathu.

Yilapho i-DoH ingena khona: Ihambisa leyo mibuzo ye-DNS nezimpendulo kusiteshi esibethelwe esifanayo esisetshenziswa iwebhu evikelekile (HTTPS, port 443)Umphumela uba ukuthi abasahambi “ebaleni,” kunciphisa amathuba okuba ubunhloli, ukudunwa kwemibuzo, nokuhlasela okuthile komuntu phakathi nendawo. Ngaphezu kwalokho, ezivivinyweni eziningi ukubambezeleka akubi kubi kakhulu futhi ingathuthukiswa ngenxa yokulungiselelwa kwezokuthutha.

Inzuzo eyinhloko ukuthi I-DoH ingavulwa ezingeni lesicelo noma lesistimu, ngakho-ke akumele uthembele kunkampani yakho yenethiwekhi noma umzila ukuze unike amandla noma yini. Okusho ukuthi, ungazivikela "kusuka kusiphequluli uphume," ngaphandle kokuthinta noma iyiphi impahla yenethiwekhi.

Kubalulekile ukuhlukanisa i-DoH ne-DoT (i-DNS kune-TLS): I-DoT ibethela i-DNS ku-port 853 ngqo phezu kwe-TLS, kuyilapho i-DoH iyihlanganisa ne-HTTP(S). I-DoT ilula ngombono, kodwa Kungenzeka kakhulu ukuthi ivinjwe ngama-firewall ezinqamula amachweba angajwayelekile; I-DoH, ngokusebenzisa i-443, yeqa kangcono le mikhawulo futhi ivimbele ukuhlasela okuphoqelelwe “kokubuyisela emuva” ku-DNS engabhaliwe.

Ekuyimfihlo: Ukusebenzisa i-HTTPS akusho amakhukhi noma ukulandelela ku-DoH; izindinganiso zeluleka ngokucacile ngokumelene nokusetshenziswa kwayo Kulo mongo, i-TLS 1.3 iphinde yehlise isidingo sokuqala kabusha izikhathi, inciphise ukuhlobana. Futhi uma ukhathazekile ngokusebenza, i-HTTP/3 phezu kwe-QUIC inganikeza ukuthuthuka okwengeziwe ngokuphindaphinda imibuzo ngaphandle kokuvinjwa.

Isebenza kanjani i-DNS, ubungozi obujwayelekile, nokuthi i-DoH ingena kuphi

Isistimu yokusebenza ngokuvamile ifunda ukuthi yisiphi isixazululi okufanele sisetshenziswe nge-DHCP; Ekhaya uvamise ukusebenzisa ama-ISP, ehhovisi, inethiwekhi yezinkampani. Uma lokhu kuxhumana kungabhaliwe (UDP/TCP 53), noma ubani oku-Wi-Fi yakho noma emzileni angakwazi ukubona izizinda ezibuzwayo, afake izimpendulo ezingamanga, noma akuqondise kabusha kusesho lapho isizinda singekho, njengoba kwenza abanye o-opharetha.

Ukuhlaziywa kwethrafikhi okujwayelekile kuveza izimbobo, ama-IP omthombo/indawo, kanye nesizinda ngokwaso esixazululiwe; Lokhu akuvezi nje kuphela imikhuba yokuphequlula, kwenza kube lula futhi ukuhlobanisa ukuxhumana okulandelayo, isibonelo, amakheli e-Twitter noma okufanayo, futhi kunqume ukuthi yimaphi amakhasi owavakashele.

Nge-DoT, umlayezo we-DNS ungena ngaphakathi kwe-TLS ku-port 853; no-DoH, umbuzo we-DNS uhlanganiswe esicelweni esijwayelekile se-HTTPS, ephinde ivumele ukusetshenziswa kwayo izinhlelo zokusebenza zewebhu ngama-API esiphequluli. Zombili izindlela zisebenzisa isisekelo esifanayo: ukuqinisekiswa kweseva ngesitifiketi kanye nesiteshi esibethelwe ngasemaphethelweni.

Inkinga ngamachweba amasha ukuthi kuvamile amanye amanethiwekhi avimba i-853, isofthiwe ekhuthaza ukuthi “ibuyele emuva” ku-DNS engabethelwe. I-DoH inciphisa lokhu ngokusebenzisa i-443, okuyinto evamile kuwebhu. I-DNS/QUIC nayo ikhona njengenye inketho ethembisayo, nakuba idinga i-UDP evulekile futhi ingatholakali ngaso sonke isikhathi.

Ngisho noma ubhala ngemfihlo ezokuthutha, qaphela nge-nuance eyodwa: Uma isixazululi siqamba amanga, i-cipher ayikulungisi.Ngale njongo, i-DNSSEC ikhona, evumela ukuqinisekiswa kobuqotho bempendulo, nakuba ukwamukelwa kwayo kungandile futhi abanye abaxhumanisi baphula ukusebenza kwayo. Noma kunjalo, i-DoH ivimbela abantu besithathu endleleni ukuthi bacuphe noma baphazamise imibuzo yakho.

Yenze isebenze ngaphandle kokuthinta irutha: iziphequluli namasistimu

Indlela eqonde kakhulu yokuqalisa ukwenza i-DoH isebenze esipheqululini sakho noma ohlelweni lokusebenza. Lena yindlela ovikela ngayo imibuzo eqenjini lakho ngaphandle kokuncika ku-router firmware.

i-Google Chrome

Ezinguqulweni zamanje ungaya kuzo chrome://settings/security futhi, ngaphansi kokuthi “Sebenzisa i-DNS evikelekile”, vula inketho bese ukhetha umhlinzeki (umhlinzeki wakho wamanje uma esekela i-DoH noma oyedwa osohlwini lwe-Google njenge-Cloudflare noma i-Google DNS).

Ezinguqulweni ezedlule, i-Chrome inikeze ukushintshwa kokuhlola: uhlobo chrome://flags/#dns-over-https, sesha okuthi “Vikela ukubheka kwe-DNS” kanye ishintshe isuke kokuzenzakalelayo iye kokuthi inikwe amandla. Qala kabusha isiphequluli sakho ukuze usebenzise izinguquko.

I-Microsoft Edge (i-Chromium)

I-Chromium-based Edge ifaka inketho efanayo. Uma uyidinga, yiya ku edge://flags/#dns-over-https, thola "Vikela ukubheka kwe-DNS" futhi inike amandla kokuthi Kunikwe amandlaEzinguqulweni zamanje, ukwenza kusebenze kuyatholakala futhi kuzilungiselelo zakho zobumfihlo.

I-Mozilla Firefox

Vula imenyu (phezulu kwesokudla) > Izilungiselelo > Okuvamile > skrolela phansi kokuthi “Izilungiselelo Zenethiwekhi”, cindezela Ukucushwa bese umaka"Nika amandla i-DNS nge-HTTPS”. Ungakhetha kubahlinzeki abafana ne-Cloudflare noma i-NextDNS.

Uma ukhetha ukulawula okuhle, ku- about:config lungisa network.trr.mode: 2 (osomathuba) isebenzisa i-DoH futhi ibuyisela emuva uma ingekho; 3 (strict) igunya lika-DoH futhi yehluleka uma kungekho ukwesekwa. Ngemodi eqinile, chaza isixazululi se-bootstrap njenge network.trr.bootstrapAddress=1.1.1.1.

I-Opera

Kusukela kunguqulo 65, i-Opera ihlanganisa inketho yoku vumela i-DoH nge-1.1.1.1. Iza ikhutshaziwe ngokuzenzakalelayo futhi isebenza ngemodi engosomathuba: uma 1.1.1.1:443 iphendula, izosebenzisa i-DoH; uma kungenjalo, iwela emuva kusixazululi esingabetheliwe.

Windows 10/11: I-Autodetect (AutoDoH) kanye neRegistry

IWindows inganika amandla i-DoH ngokuzenzakalelayo ngezixazululi ezithile ezaziwayo. Ezinguqulweni ezindala, ungaphoqa ukuziphatha kusuka ku-Registry: run regedit bese uya ku- HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Dnscache\Parameters.

Dala i-DWORD (32-bit) ebizwa EnableAutoDoh ngenani 2 y Qala kabusha ikhompyuthaLokhu kusebenza uma usebenzisa amaseva e-DNS asekela i-DoH.

I-Windows Server 2022: Iklayenti le-DNS eline-DoH yomdabu

Iklayenti le-DNS elakhelwe ngaphakathi ku-Windows Server 2022 lisekela i-DoH. Uzokwazi ukusebenzisa i-DoH kuphela ngamaseva asohlwini lwawo oluthi “I-DoH Eyaziwayo”. noma ukuthi uzengeze wena. Ukuyilungiselela kusuka kusixhumi esibonakalayo:

1. Vula Izilungiselelo zeWindows > Inethiwekhi ne-inthanethi.
2. Ngena I-Ethernet bese ukhetha isikhombimsebenzisi sakho.
3. Esikrinini senethiwekhi, skrolela phansi ukuze Izilungiselelo ze-DNS bese ucindezela Hlela.
4. Khetha "Manuwali" ukuze uchaze amaseva akhethwayo namanye.
5. Uma lawo makheli esohlwini olwaziwayo lwe-DoH, azovulwa "Ukubethela Okuncanyelwayo kwe-DNS" ngezinketho ezintathu:
   • Ukubethela kuphela (i-DNS phezu kwe-HTTPS): Phoqa i-DoH; uma iseva ingasekeli i-DoH, ngeke kube khona ukulungiswa.
   • Khetha ukubethela, vumela ukungabethelwe: Izama i-DoH futhi uma ihluleka, ibuyela emuva ku-DNS yakudala engabetheliwe.
   • Okungabethelwe kuphela: Isebenzisa umbhalo ovamile we-DNS.
6. Londoloza ukuze usebenzise izinguquko.

Ungakwazi futhi ukubuza futhi wandise uhlu lwezixazululi ze-DoH ezaziwayo usebenzisa i-PowerShell. Ukuze ubone uhlu lwamanje:

Get-DNSClientDohServerAddress

Ukuze ubhalise iseva entsha eyaziwayo ye-DoH ngesifanekiso sakho, sebenzisa:

Add-DnsClientDohServerAddress -ServerAddress "<IP-del-resolutor>" -DohTemplate "<URL-plantilla-DoH>" -AllowFallbackToUdp $False -AutoUpgrade $True

Qaphela ukuthi i-cmdlet Set-DNSClientServerAddress ayizithinti ukusetshenziswa kwe-DoH; ukubethela kuncike ekutheni lawo makheli akhona yini kuthebula lamaseva e-DoH aziwayo. Awukwazi okwamanje ukulungiselela i-DoH yeklayenti le-Windows Server 2022 DNS kusuka ku-Windows Admin Center noma nge sconfig.cmd.

Inqubomgomo Yeqembu ku-Windows Server 2022

Kukhona umyalelo othi “Lungiselela i-DNS phezu kwe-HTTPS (DoH)” en Configuración del equipo\Directivas\Plantillas administrativas\Red\Cliente DNS. Uma inikwe amandla, ungakhetha:

• Vumela i-DoH: Sebenzisa i-DoH uma iseva iyisekela; uma kungenjalo, umbuzo awubetheliwe.
• Vimbela i-DoH: ayisebenzisi neze i-DoH.
• Idinga i-DoH: iphoqa i-DoH; uma kungekho ukwesekwa, isixazululo siyehluleka.

Okubalulekile: Unganiki amandla okuthi “Dinga i-DoH” kumakhompyutha ajoyine isizindaUhla Lwemibhalo Olusebenzayo luncike ku-DNS, futhi indima Yeseva ye-Windows DNS Server ayisekeli imibuzo ye-DoH. Uma udinga ukuvikela ithrafikhi ye-DNS ngaphakathi kwendawo ye-AD, cabanga ukusebenzisa Imithetho ye-IPsec phakathi kwamaklayenti nezixazululi zangaphakathi.

Uma ungathanda ukuqondisa kabusha izizinda ezithile kuzixazululi ezithile, ungasebenzisa i I-NRPT (Ithebula Lenqubomgomo Yesinqumo Segama). Uma iseva yendawo isohlwini olwaziwayo lwe-DoH, lezo zingxoxo uzohamba nge-DoH.

I-Android, i-iOS ne-Linux

Ku-Android 9 nangaphezulu, inketho I-DNS Eyimfihlo ivumela i-DoT (hhayi i-DoH) ngezindlela ezimbili: “Okuzenzakalelayo” (osomathuba, kuthatha isixazululi senethiwekhi) kanye “Neqinile” (kufanele ucacise igama lomethuleli eliqinisekiswa ngesitifiketi; ama-IP aqondile awasekelwe).

Ku-iOS ne-Android, uhlelo lokusebenza 1.1.1.1 I-Cloudflare inika amandla i-DoH noma i-DoT kumodi eqinile isebenzisa i-VPN API ukuze ibambe izicelo ezingabhaliwe futhi badlulisele ngeshaneli evikelekile.

Ku-Linux, i-systemd-resolved isekela i-DoT kusukela ku-systemd 239. Ivaliwe ngokuzenzakalelayo; inikeza imodi engosomathuba ngaphandle kokuqinisekisa izitifiketi kanye nemodi eqinile (kusukela ngo-243) ngokuqinisekiswa kwe-CA kodwa ngaphandle kwe-SNI noma ukuqinisekiswa kwegama, okuyinto yenza buthaka imodeli yokuthembana ngokumelene nabahlaseli emgwaqweni.

Ku-Linux, macOS, noma iWindows, ungakhetha iklayenti le-DoH lemodi eqinile njenge cloudflared proxy-dns (ngokuzenzakalelayo isebenzisa 1.1.1.1, nakuba ungachaza ama-upstreams ezinye izindlela).

Amaseva E-DoH Aziwayo (iWindows) kanye nendlela yokwengeza okwengeziwe

I-Windows Server ihlanganisa uhlu lwezixazululi ezaziwa ngokusekela i-DoH. Ungayihlola nge-PowerShell bese wengeza okufakiwe okusha uma udinga.

Lezi yizo amaseva e-DoH aziwayo ngaphandle kwebhokisi:

Umnikazi Weseva	Iseva ye-DNS amakheli e-IP
I-Cloudflare	1.1.1.1 1.0.0.1 2606:4700:4700::1111 2606:4700:4700::1001
I-Google	8.8.8.8 8.8.4.4 2001:4860:4860::8888 2001:4860:4860::8844
I-Quad9	9.9.9.9 149.112.112.112 2620:fe::fe 2620:fe::fe:9

Ngoba Buka uhlu, gijima:

Get-DNSClientDohServerAddress

Ngoba engeza isixazululi esisha se-DoH nesifanekiso saso, isebenzisa:

Add-DnsClientDohServerAddress -ServerAddress "<IP-del-resolutor>" -DohTemplate "<URL-plantilla-DoH>" -AllowFallbackToUdp $False -AutoUpgrade $True

Uma uphatha izikhala zamagama eziningi, i-NRPT izokuvumela ukuba wenze kanjalo phatha izizinda ezithile kusixazululi esithile esisekela i-DoH.

Ungabheka kanjani ukuthi i-DoH iyasebenza

Ezipheqululini, vakashela https://1.1.1.1/help; lapho uzobona uma ithrafikhi yakho isebenzisa i-DoH nge 1.1.1.1 noma cha. Ukuhlola okusheshayo ukubona ukuthi ukusiphi isimo.

In Windows 10 (inguqulo 2004), ungakwazi ukuqapha ithrafikhi ye-DNS yakudala (port 53) nge pktmon kusuka kukhonsoli enelungelo:

pktmon filter add -p 53
pktmon start --etw -m real-time

Uma ukusakazwa okungapheli kwamaphakethe kuvela ku-53, kungenzeka kakhulu lokho usasebenzisa i-DNS engabetheliwe. Khumbula: ipharamitha --etw -m real-time idinga u-2004; ezinguqulweni zangaphambili uzobona iphutha "lepharamitha engaziwa".

Ongakukhetha: yilungiselele kumzila (MikroTik)

Uma ukhetha ukubeka phakathi ukubethela kumzila, ungakwazi ukunika amandla i-DoH kalula kumadivayisi e-MikroTik. Okokuqala, ngenisa impande ye-CA okuzosayinwa iseva ozoxhuma kuyo. Ukuze Cloudflare ungalanda I-DigiCertGlobalRootCA.crt.pem.

Layisha ifayela kumzila (ngokulihudulela kokuthi "Amafayela"), bese uya ku Uhlelo > Izitifiketi > Ngenisa ukukuhlanganisa. Bese, lungiselela i-DNS yomzila nge- Cloudflare DoH URLsUma isisebenza, irutha izobeka phambili uxhumano olubethelwe ngaphezu kwe-DNS engabetheliwe ezenzakalelayo.

Ukuze uqinisekise ukuthi konke kuhamba ngohlelo, vakashela 1.1.1.1/usizo kusuka kukhompyutha ngemuva kwerutha. Ungakwazi futhi ukwenza yonke into nge-terminal ku-RouterOS uma uthanda.

Ukusebenza, ubumfihlo obengeziwe kanye nemikhawulo yendlela yokwenza

Uma kukhulunywa ngesivinini, amamethrikhi amabili abalulekile: isikhathi sokulungiswa kanye nokulayisha kwekhasi kwangempela. Ukuhlolwa okuzimele (okufana ne-SamKnows) Baphetha ngokuthi umehluko phakathi kwe-DoH ne-DNS yakudala (Do53) useceleni kuzo zombili izinhlangothi; ekusebenzeni, akufanele uqaphele noma yikuphi ukunensa.

I-DoH ibhala ngemfihlo "umbuzo we-DNS," kodwa kukhona amasiginali amaningi kunethiwekhi. Ngisho noma ufihla i-DNS, i-ISP ingasho izinto ngoxhumo lwe-TLS (isb., i-SNI kwezinye izimo zefa) noma okunye ukulandelelwa. Ukuze uthuthukise ubumfihlo, ungahlola i-DoT, i-DNSCrypt, i-DNSCurve, noma amaklayenti anciphisa imethadatha.

Akuwona wonke ama-ecosystem asekela i-DoH okwamanje. Izixazululi eziningi zefa azinikezi lokhu., ukuphoqa ukuthembela emithonjeni yomphakathi (Cloudflare, Google, Quad9, njll.). Lokhu kuvula inkulumo-mpikiswano mayelana nokufakwa endaweni eyodwa: ukugxila emibuzweni yabalingisi abambalwa kuhlanganisa izindleko zobumfihlo nokuthenjwa.

Ezimweni zebhizinisi, i-DoH ingase ingqubuzane nezinqubomgomo zokuphepha ezisekelwe kuzo Ukuqapha noma ukuhlunga kwe-DNS (i-malware, izilawuli zabazali, ukuthobela umthetho). Izixazululo zifaka i-MDM/Group Policy yokusetha isixazululi se-DoH/DoT kumodi eqinile, noma ezihlanganiswe nezilawuli zezinga lohlelo lokusebenza, ezinembe kakhulu kunokuvinjwa okusekelwe kusizinda.

I-DNSSEC ihambisana ne-DoH: I-DoH ivikela ezokuthutha; I-DNSSEC iqinisekisa impenduloUkwamukela akulingani, futhi ezinye izisetshenziswa eziphakathi ziyakwephula, kodwa ukuthambekela kuhle. Endleleni ephakathi kwezixazululi namaseva agunyaziwe, i-DNS ngokwesiko ihlala ingabetheliwe; sekuvele kukhona ukuhlola okusebenzisa i-DoT phakathi kwama-opharetha amakhulu (isb., 1.1.1.1 namaseva agunyaziwe we-Facebook) ukuze kuthuthukiswe ukuvikeleka.

Okunye okuphakathi nendawo ukubethela kuphela phakathi i-router kanye nesixazululi, ishiya ukuxhumana phakathi kwamadivayisi nerutha kungabetheliwe. Iwusizo kumanethiwekhi anentambo avikelekile, kodwa ayinconyiwe kumanethiwekhi e-Wi-Fi avulekile: abanye abasebenzisi bangakwazi ukuhlola noma balawule le mibuzo ngaphakathi kwe-LAN.

Zenzele esakho isixazululi se-DoH

Uma ufuna ukuzimela okuphelele, ungaphakela esakho isixazululi. Unbound + Redis (L2 cache) + Nginx iyinhlanganisela edumile yokusebenzisa ama-URL e-DoH nokuhlunga izizinda ezinohlu olubuyekezwayo ngokuzenzakalelayo.

Lesi sitaki sisebenza kahle ku-VPS enesizotha (isibonelo, umgogodla owodwa/2 izintambo emndenini). Kukhona imihlahlandlela enemiyalo elungele ukusetshenziswa, njengale khosombe: github.com/ousatov-ua/dns-filtering. Abanye abahlinzeki be-VPS banikeza amakhredithi amukelekile kubasebenzisi abasha, ukuze ukwazi ukusetha isilingo ngezindleko eziphansi.

Ngesixazululi sakho esiyimfihlo, ungakhetha imithombo yakho yokuhlunga, unqume izinqubomgomo zokugcina futhi gwema ukufaka phakathi imibuzo yakho kubantu besithathu. Ngembuyiselo, uphatha ukuphepha, ukulungiswa, nokutholakala okuphezulu.

Ngaphambi kokuvala, inothi lokufaneleka: ku-inthanethi, izinketho, amamenyu namagama kushintsha njalo; abanye abaqondisi bakudala baphelelwe yisikhathi (Isibonelo, ukungena “kumafulege” ku-Chrome akusadingeki ezinguqulweni zakamuva.) Njalo hlola nesiphequluli sakho noma imibhalo yesistimu.

Uma usufinyelele kuze kube manje, usuvele uyazi ukuthi yenzani i-DoH, ukuthi ingena kanjani kundida ne-DoT ne-DNSSEC, futhi okubaluleke kakhulu, ungayisebenzisa kanjani manje kudivayisi yakho ukuvimbela i-DNS ekuhambeni endaweni ecacile. Ngokuchofoza okumbalwa kusiphequluli sakho noma ukulungisa ku-Windows (ngisho nasezingeni lenqubomgomo ku-Server 2022) uzoba nemibuzo ebethelwe; uma ufuna ukuyisa izinto ezingeni elilandelayo, ungahambisa ukubethela kumzila we-MikroTik noma wakhe esakho isixazululi. Okubalulekile ukuthi, Ngaphandle kokuthinta irutha yakho, ungavikela enye yezingxenye ezihletshwa kakhulu mayelana nethrafikhi yakho namuhla..