Shin Firewall yana toshe VPN? Bincike mataki-mataki

Ƙarewar lokaci ɗaya na VPN yana tabbatar da cewa babu wani amsa mai amfani da ta zo, kuma ba ya tabbatar da komai game da dalilin. Bayanin na iya ambaton tashar da ba daidai ba, uwar garken na iya kasancewa a kashe, ko kuma buƙatar na iya zuwa ba tare da hanyar dawowa mai aiki ba. Kowanne daga cikinsu yana barin wata alama daban, kuma alamar ce ke gaya maka wace doka za ka taɓa. Bi matakai huɗu da ke ƙasa cikin tsari. Tsaya da zaran ɗayansu ya bayyana alamar.

Mataki 1: tabbatar da uwar garken da jigilar bayanai

Karanta sunan uwar garken, jigilar bayanai da tashar daga bayanin mai aiki na yanzu maimakon daga gyara na gida. Tashar da aka canza a kwamfutar tafi-da-gida ba za ta iya ƙirƙirar mai sauraro a kan uwar garken jama’a ba, kuma wannan rashin daidaituwa yana haifar da ƙarewar lokaci daidai da toshewa. Idan bayanin ya bayar da wata hanyar jigilar da aka tallafa, rubuta ta a matsayin madadin ba a matsayin magani ba. Warware sunan kuma kwatanta amsar da adireshin da mai aikin ya wallafa.

Tsohon rikodin DNS yana aika abokin ciniki zuwa mai masaukin da bai taɓa amsawa ba. Wannan wata matsala ce da ke kwaikwayon matattara, kuma warware ta yana kashe tambaya ɗaya kawai.

Rubuta duka ƙimar biyu cikin tikitin. Kowace kwatance ta gaba tana amfani da su, kuma tikitin da ba shi da su yana sake fara binciken.

Mataki 2: tabbatar da hanya da kwatance ɗaya da aka sarrafa

Bar na’urar da bayanin ba su canza ba kuma gwada wata hanyar shiga da aka amince da ita. Idan ramin ya tashi a can, bambancin shine hanyar asali ko manufofinta. Idan wata na’ura da aka amince da ita ta yi aiki a hanyar asali, bambancin shine na’urar farko. Ɗaya daga cikin waɗannan kwatancen biyu kusan koyaushe yana yanke hukunci.

Fara kammala duk wata shiga hanyar sadarwa ta halal, domin tashar da ke kama ba ta zama kamar toshewa har sai an kammala ta.

Gwada tashar da kake amfani da ita a zahiri, kuma ɗauki sakamakon TCP a matsayin bayani game da TCP kawai.

Resolve-DnsName vpn.corp.example
tracert -h 8 -w 500 vpn.corp.example
Test-NetConnection vpn.corp.example -Port 443 -InformationLevel Detailed

Nasarar musafaha TCP a tashar 443 yana nufin mai sauraro ya amsa a can. Ba ya cewa komai game da mai sauraro na UDP a 51820, ko an kammala tattaunawar.

Mataki 3: karanta abubuwan tsaro na lokacin gazawa

Abubuwan firewall sune mafi ƙarfin hujja da ake da su, kuma suna ɗauke da wani sharadi da ya dace a faɗa da farko. An kashe rikodi a yawancin bayanan da aka saba, don haka duba ko bayanin da abin ya shafa yana rikodin jefawa kafin ka karanta rajista marar komai a matsayin hujjar rashin laifi. Idan rikodi yana kunne, abin da ya faru yana ambaton doka, alkibla da adireshi, wanda shine ainihin abin da canjin doka yake buƙata. Dokokin aikace-aikace da dokokin tasha daban-daban abubuwa ne, kuma manufar da aka sarrafa tana iya wuce saitin gida. Tabbatar wane abokin ciniki da wace sabis doka ta ke rufewa a zahiri.

Tattara yanayin bayanin da abubuwan da suka faru kwanan nan daga injin da ya gaza, ba daga mai masaukin maƙwabci ba.

Kwatanta lokacin abin da ya faru da lokacin gwajinka, domin sunan doka mai daidaito da tambarin lokaci daban lokaci ɗaya ne kawai.

Get-NetFirewallProfile | Select-Object Name, Enabled, DefaultInboundAction, LogBlocked
Get-NetFirewallRule -Enabled True -Direction Outbound | Where-Object DisplayName -match 'VPN'
Get-WinEvent -LogName 'Microsoft-Windows-Windows Firewall With Advanced Security/Firewall' -MaxEvents 20

A kan uwar garken da kake gudanarwa, tambaya ko buƙatar ta isa wurin mai sauraro kwata-kwata. Fakitin da ya zo ba tare da amsa ba matsala ce ta turawa ko hanyar dawowa. Buƙatar da ba ta taɓa bayyana ba matsala ce ta tacewa ko adireshi.

Mataki 4: gwada turawa bayan ramin ya tashi

Firewall na iya barin zaman ya wuce sannan ya hana duk abin da zaman yake son isa. Sysctl na turawa, dokokin NAT da hanyoyin dawowa duk suna bayan tabbatarwa, kuma babban keɓe ga tashar VPN ba ya gyara ɗaya daga cikinsu. Gwada manufa ɗaya ta ciki da manufa ɗaya ta intanet daban, domin yawanci suna gaza saboda dalilai daban-daban. Idan sunayen ciki sun gaza amma adireshi suna aiki, duba DNS da aka tura kafin kowace doka.

Gudanar da bincike uku da ke ƙasa a kan uwar garken yayin da abokin ciniki yana haɗe kuma yana ƙoƙarin buƙatar da ke gazawa.

Ma’aunai a kan fuskar ramin sune ainihin abin, domin suna nuna ko fakiti sun shiga kuma ko wani abu ya fita.

sysctl net.ipv4.ip_forward
nft list ruleset | grep -n -E 'forward|masquerade'
tcpdump -ni tun0 -c 10

Lokacin da fakiti suka iso kan ramin kuma babu abin da ya fita zuwa manufa, turawa ko NAT shine wanda ake zargi. Lokacin da babu abin da ya iso kwata-kwata, zaman yana a buɗe amma abokin ciniki ba ya aikawa, kuma wurin da za a duba shine teburin hanya na abokin ciniki.

Duba gyaran kuma cire abin da bai taimaka ba

Bayan gyaran da aka amince, sake maimaita ainihin gwajin da ya gaza kuma rubuta sakamakon a kan bayanin da na’urar guda. Sannan cire duk wani keɓe na wucin gadi da bai canza sakamakon ba, domin keɓewar da ba a yi amfani da su suna taruwa kuma kowanne shawara ce da babu wanda ya tuna ya yanke. Riƙe abin da ya rage a taƙaice: manufa ɗaya, tasha ɗaya, alkibla ɗaya, mai shi ɗaya.

Sake gudanar da umarni uku guda kuma kwatanta su da abubuwan da ka adana kafin canjin.

Test-NetConnection vpn.corp.example -Port 443 -InformationLevel Detailed
tracert -h 8 -w 500 vpn.corp.example
Get-NetFirewallRule -Enabled True | Where-Object DisplayName -match 'VPN' | Select-Object DisplayName, Action

Lokacin da hanyar sadarwar kwatance tana aiki, hanyar asali har yanzu tana gaza kuma abubuwan sun kasance babu komai, wanda ake zargi da ya rage shine hanya ba mai masauki ba. Mika wannan ga mai hanyar sadarwa a matsayin takamaiman bayani, tare da haɗe sakamakon kwatancen biyu. Wannan wuri ne mafi kyau don tsayawa fiye da bayanin firewall da aka kashe.