Lindungi resolv.conf Dari DHCP Pada FreeBSD 10

• Metode 1: Gunakan pengaturan antarmuka statis
• Metode 2: Membuat resolv.conf tidak berubah
• Metode 3: Beri tahu FreeBSD dengan sopan untuk membiarkan pengaturan Anda sendiri

Jika Anda menjalankan resolver Anda sendiri, atau ingin menggunakannya dari penyedia pihak ketiga, Anda mungkin menemukan bahwa /etc/resolv.conffile Anda sedang ditimpa oleh DHCP. Ada beberapa cara untuk mengatasi masalah ini. Karena Anda mungkin ingin melakukan reboot untuk memastikan bahwa perubahan Anda tetap, dan karena Anda akan melakukan monkeying dengan pengaturan jaringan sejak awal, saya sangat menyarankan melakukan ini pada contoh pengujian dan / atau di luar puncak jam.

Nah, berikut adalah tiga metode, dari yang terburuk ke yang terbaik. Perhatikan bahwa semua metode dalam panduan ini ditulis untuk FreeBSD 10. Pengguna Linux dapat merujuk ke panduan ini .

Metode 1: Gunakan pengaturan antarmuka statis

Dalam pengujian terbatas saya, ini menghasilkan waktu boot yang sedikit lebih cepat karena Anda tidak perlu menunggu DHCP untuk menetapkan pengaturan jaringan Anda. Namun, saya telah melihat disebutkan dalam beberapa Vultr docs yang menggunakan pengaturan antarmuka statis disukai dan bahwa Anda harus tetap menggunakan DHCP. Saya berasumsi mereka punya alasan bagus untuk ini dan karenanya saya terus menggunakan DHCP sendiri. Namun demikian, jika Anda memutuskan untuk memilih rute ini, ikuti langkah-langkah di bawah ini.

• Tentukan IP server Anda, mask jaringan, dan gateway IP.
• Ubah /etc/rc.confuntuk menggunakan nilai-nilai ini, bukan DHCP.
• Mulai ulang untuk menguji pengaturan.

Tentukan IP / netmask / gateway

Dengan asumsi antarmuka Anda adalah vtnet0, lakukan hal berikut:

ifconfig vtnet0 | grep inet

Ini akan memberi Anda alamat IP dan netmask untuk server Anda:

inet 10.10.10.10 netmask 0xffffff00 broadcast 10.10.10.255

FreeBSD suka menggunakan hex untuk netmask. Di atas dikonversi menjadi 255.255.255.0jika Anda penasaran. Anda dapat menemukan tabel praktis di sini , tetapi jangan takut: Anda bisa menyalin alamat hex ke file konfigurasi Anda (atau mengubahnya menjadi desimal jika Anda mau).

Anda dapat menemukan gateway dengan beberapa cara. Ini dia:

route get default | grep gateway akan mengembalikan sesuatu seperti:

gateway: 10.10.10.1

Ubah /etc/rc.confdengan nilai baru

Berbekal IP, netmask, dan gateway, sekarang saatnya menambahkannya ke konfigurasi sistem. Saya sangat menyarankan untuk mencadangkan file ini sebelum membuat perubahan, karena akan membuatnya lebih mudah untuk dibatalkan jika Anda mengacaukannya. Nah, buka /etc/rc.confdi editor pilihan Anda, dan buat perubahan berikut:

# Comment out this line:
# ifconfig_vtnet0="dhcp"

# Add these lines:
defaultrouter="10.10.10.1"
ifconfig_vtnet0="inet 10.10.10.10 netmask 0xffffff00"

Obviously, you should be sure to substitute your actual IP, netmask, and gateway for my obvious fakes.

Reboot and test

Reboot your server using shutdown -r now and make sure that it comes back up properly. Perform whatever tests you deem necessary to ensure everything is working properly. If the network is inaccessible, login via console and revert your changes. If everything is fine, at this point you can put whatever you please into resolv.conf without fear of it being obliterated.

If for whatever reason you can't reboot, this should work, but I'd really do a proper reboot if I were you:

service netif restart && service routing restart

Method 2: Make resolv.conf immutable

This is a bit of a hack, but it's easily the quickest solution. I don't recommend it because I can't guarantee this won't cause some weirdness in the future when you upgrade to a new release of the operating system, and dhclient is likely going to complain a bunch. That said, a simple chflags schg /etc/resolv.conf is all that's needed. The file is now completely write-protected, even from root. You can verify like so:

vultr [~]# chflags schg /etc/resolv.conf
vultr [~]# ls -ol /etc/resolv.conf
-rw-r--r--  1 root  wheel  schg 50 Nov 29 06:28 /etc/resolv.conf
vultr [~]# echo "so very untouchable" >> /etc/resolv.conf
/etc/resolv.conf: Operation not permitted.

Undo with: chflags noschg /etc/resolv.conf

Method 3: Politely tell FreeBSD to leave your settings alone

This is by far the cleanest, most proper way to get this done. There are two approaches you can take:

Configure dhclient

Let's take the example from way up top, and say all you want to do is put your custom nameserver in resolv.conf and don't want to lose it every time DHCP does its thing. In my case, I want to use the caching resolver I installed that listens on localhost, so I edit /etc/dhclient.conf (which will likely be blank aside from comments) and add the following:

interface "vtnet0" {
    supersede domain-name-servers 127.0.0.1;
}

This will allow dhclient to do everything else you need it to do, but when the DHCP server sends it a list of nameservers to use, yours will supersede (as in, completely replace) the ones it offers. If you'd prefer to supplement (rather than replace) the ones offered, you can "append" or "prepend" instead of "supersede", as appropriate.

Incidentally, should you require more than one custom server, specify them like this:

supersede domain-name-servers 127.0.0.1, 127.0.0.2;

After making your changes, restart dhclient to have them go into effect immediately:

service dhclient restart vtnet0

Examine your /etc/resolv.conf and you should find it now has your custom nameserver(s) in it.

As of this writing, nameservers are the only thing Vultr's DHCP server has ever put into my resolv.conf, and the only thing I've cared to customize. However, if you ever need to override any other settings, consult the excellent manual for a comprehensive list:

man 5 dhclient.conf

There are great examples at the bottom that should give you an idea of what you can do. Off the top of my head, I can imagine you might want to add something like supersede domain-name "example.com"; if you normally have a line like that in your resolv.conf. Again, consult the docs.

Configure resolvconf

This is the simplest solution if you just want your resolv.conf to be left alone. Per the manual:

resolvconf manages resolv.conf(5) files from multiple sources, such as DHCP and VPN clients

Its configuration resides in /etc/resolvconf.conf, which likely doesn't exist on your system, so feel free to create it. To make your resolv.conf immutable, add this:

# prevent all updates to resolv.conf:
resolv_conf="/dev/null"

If you use unbound as your local caching resolver, that's the line it adds (along with a few for itself). That's basically tricking resolvconf into thinking your /etc/resolv.conf is located at /dev/null. Something slightly less mean, but equally effective, would be:

# disable resolvconf from running any subscribers:
resolvconf="NO"

If you want to do something more sophisticated than just turning it off, the man pages for resolvconf and resolvconf.conf have plenty of info.