![Wireguard VPN + OpenVPN VPN 导致 OpenVPN 隧道 DNS 解析失败](https://linux22.com/image/751176/Wireguard%20VPN%20%2B%20OpenVPN%20VPN%20%E5%AF%BC%E8%87%B4%20OpenVPN%20%E9%9A%A7%E9%81%93%20DNS%20%E8%A7%A3%E6%9E%90%E5%A4%B1%E8%B4%A5.png)
我有两个 VPN - 一个通过 wireguard 用于我的一般互联网流量,一个通过 openvpn(用于工作)。通过 openvpn 的 DNS 解析仅部分工作。
当两条隧道都通了之后:
A) systemd-resolve 需要“教导”使用 tun0。(以前当两个 VPN 都使用 openvpn 时,此功能有效。)
> systemd-resolve jenkins.staging.mycompany.com
jenkins.staging.mycompany.com: resolve call failed: All attempts to contact name servers or networks failed
> systemd-resolve -i tun0 jenkins.staging.mycompany.com
jenkins.staging.mycompany.com: 10.1.2.36 -- link: tun0
-- Information acquired via protocol DNS in 48.5ms.
-- Data is authenticated: no
> systemd-resolve jenkins.staging.mycompany.com
jenkins.staging.mycompany.com: 10.1.2.36 -- link: tun0
-- Information acquired via protocol DNS in 852us.
-- Data is authenticated: no
B) dig 开箱即用。nslookup 仅当我告诉它使用哪个 DNS 服务器时才起作用。curl 不起作用。
> curl jenkins.staging.mycompany.com:8080
curl: (6) Could not resolve host: jenkins.staging.mycompany.com
> dig jenkins.staging.mycompany.com
; <<>> DiG 9.11.5-P4-5.1ubuntu2.1-Ubuntu <<>> jenkins.staging.mycompany.com
;; global options: +cmd
;; Got answer:
;; ->>HEADER<<- opcode: QUERY, status: NXDOMAIN, id: 2834
;; flags: qr rd ra; QUERY: 1, ANSWER: 0, AUTHORITY: 1, ADDITIONAL: 1
;; OPT PSEUDOSECTION:
; EDNS: version: 0, flags:; udp: 1280
;; QUESTION SECTION:
;jenkins.staging.mycompany.com. IN A
;; AUTHORITY SECTION:
mycompany.com. 56 IN SOA [aws dns info]
;; Query time: 47 msec
;; SERVER: 172.16.0.1#53(172.16.0.1)
;; WHEN: Sat Apr 18 09:08:44 EDT 2020
;; MSG SIZE rcvd: 143
> nslookup jenkins.staging.mycompany.com
Server: 172.16.0.1 <- uses wrong dns server by default
Address: 172.16.0.1#53
** server can't find jenkins.staging.mycompany.com: NXDOMAIN
> nslookup jenkins.staging.mycompany.com 10.0.0.2
Server: 10.0.0.2
Address: 10.0.0.2#53
Non-authoritative answer:
Name: jenkins.staging.mycompany.com
Address: 10.1.2.36
我的理论是,wireguard 以某种方式从 systemd 窃取了 DNS 职责,因此我尝试将 openvpn 提供的 DNS 添加到客户端配置文件中:
[Interface]
PrivateKey = xxx
Address = 172.aa.bb.cc/32
DNS = 172.16.0.1 10.0.0.2
但这没有帮助。
我认为 systemd-resolve 的配置看起来不错(?):
> resolveconf status
Global
LLMNR setting: no
MulticastDNS setting: no
DNSOverTLS setting: no
DNSSEC setting: no
DNSSEC supported: no
Current DNS Server: 172.16.0.1
DNS Servers: 172.16.0.1
10.0.0.2
DNS Domain: staging.mycompany.com
production.mycompany.com
infrastructure.mycompany.com
DNSSEC NTA: 10.in-addr.arpa
...
31.172.in-addr.arpa
corp
d.f.ip6.arpa
home
internal
intranet
lan
local
private
test
Link 5 (tun0)
Current Scopes: DNS
DefaultRoute setting: yes
LLMNR setting: yes
MulticastDNS setting: no
DNSOverTLS setting: no
DNSSEC setting: no
DNSSEC supported: no
DNS Servers: 10.0.0.2
DNS Domain: staging.mycompany.com
production.mycompany.com
infrastructure.mycompany.com
答案1
我有一个建议,但我没有足够的声誉来发表评论,所以我将我的评论放在答案中。你看过你的 Wireguard 虚拟适配器和 OpenVPN 虚拟适配器的接口度量吗?我知道在 Windows 中,当我遇到你描述的问题时,我必须手动设置两者的接口度量,对于 OpenVPN 虚拟适配器,它必须低于另一个适配器的度量。