Yadda za a duba abin da VPN a Windows ke yi wa hanya da gaske a PowerShell

Na haɗa abokin ciniki na VPN a kwamfutar tafi-da-gida ta Windows 11, tilin ya koma Connected, an buɗe rabon fayil na ciki, kuma wani shafi na jama'a yana ci gaba da lodawa kai tsaye daga Wi-Fi na ofis. Wannan cakuda yana kama da gurɓataccen rami. Amma wannan shine al'ada na bayanin da ke tura wasu zirga-zirga ta VPN ya bar sauran a kan adaftar zahiri. Tilasta rami yana canza wace hanya ta asali Windows ke fifita; ba ya shafe hanyoyi na musamman kuma ba ya yin alkawarin zirga-zirga zai tsaya idan haɗin ya karye. Abin da ke gaba shine tsarin da nake bi sa'ad da abokin ciniki ya yi iƙirarin ɗauka: yanayin abokin ciniki, bayanin da aka ajiye, hanyoyin da aka yi amfani da su, mai warwarewa, sannan ainihin kwarara.

Fara daga abokin ciniki, sannan ka daina dogara gare shi

Abokin ciniki shine wurin da ya dace don farawa kawai domin yana gaya muku wane bayani ke aiki. Buɗe halayen haɗin kuma rubuta ainihin sunan bayanin, ko an ƙirƙira shi don mai amfani na yanzu ko don kowa a na'urar, da wace adafta ke bayyana a ncpa.cpl bayan haɗawa. A kwamfutar gwajina adaftar tana ɗauke da sunan bayanin, wanda ya sa karanta fitar hanyoyi ya zama mai sauƙi. A wasu na'urori yana bayyana a matsayin shigarwar WAN Miniport kuma sunan ba ya gaya muku komai.

Abin da abokin ciniki ba zai iya gaya muku shi ne ɗauka. Tilin da aka haɗa yana bayyana yanayin rami, ba jerin wurare ba. Abokan ciniki na wasu kamfanoni ma suna riƙe nasu tsarin, don haka bayanin asali na Windows, da kowace sifa da za ku karanta daga gare shi, na iya rashin alaƙa da abin da wancan abokin ciniki ya shigar. Idan VPN ya zo ta AnyConnect, OpenVPN GUI, WireGuard ko wakilin mai siyarwa, gwaje-gwajen PowerShell da ke ƙasa galibi ba su aiki kuma a maimakon haka ya kamata ku karanta saitunan split-tunnel da tafarkin wancan abokin ciniki.

Karanta bayanin da aka ajiye, ba tilin ba

Don bayanin asali na Windows (IKEv2, L2TP, SSTP ko wanda MDM ya tura) shawarar split-tunnel da aka ajiye sifa ɗaya ce:

Get-VpnConnection -Name 'Office' | Select-Object Name, ServerAddress, SplitTunneling, DnsSuffix

Ƙara -AllUserConnection lokacin da aka ƙirƙiri bayanin don kowa a na'urar. Ba tare da shi ba kuna karanta jerin mai amfani na yanzu, wanda zai iya zama fanko ko ya riƙe wani shigarwa mai kama da suna. Ƙimar False a cikin SplitTunneling tana nufin an ajiye bayanin a matsayin cikakken rami: Windows yana shigar da hanyar asali ta adaftar VPN. True yana nufin split tunnel, kuma ɗauka sai ya dogara gaba ɗaya ga hanyoyin da ƙa'idodin warware suna da bayanin ke turawa.

Ɗauki wannan ƙimar a matsayin tsari, ba lura ba. Tana rubuta abin da bayanin ya nema a lokacin haɗawa. Windows na iya ƙarewa da hanyoyin da aka yi amfani da su daban, saboda wata hanya ta musamman ta wata mu'amala, saitin manufa ko shigarwar da ta rage daga haɗin da ya gabata, don haka Boolean ba ya warware tambayar shi kaɗai.

Kwatanta ƙimar da aka ajiye da teburin hanyoyin da aka yi amfani da su

Bayan haɗawa, jera hanyoyin a adaftar rami maimakon gungurawa dukan teburin:

$vpn = Get-NetAdapter | Where-Object InterfaceDescription -match 'VPN|WAN Miniport'
Get-NetRoute -InterfaceIndex $vpn.ifIndex | Sort-Object DestinationPrefix
Find-NetRoute -RemoteIPAddress 10.20.4.15 | Select-Object -First 1

Find-NetRoute shine rabin mai amfani. Yana amsa tambayar da abokin ciniki ba ya taɓa amsawa: don wannan wuri, wace mu'amala da wace adireshin tushe Windows zai yi amfani da su da gaske? Gudanar da shi don mai masauki na ciki, mai masauki na jama'a da duk abin da kuke ɗauka a matsayin keɓe da gangan. Bayanin cikakken rami ya kamata ya nuna mu'amalar rami don adireshin jama'a. Bayanin split tunnel yawanci yana nuna adaftar zahiri a can yayin da ƙayyadaddun ciki har yanzu ana warware su zuwa VPN.

Tarko biyu suna bayyana yawancin rahotannin «yana tafiya gefen da ba daidai ba». Mafi ƙayyadadden prefix koyaushe yana cin nasara, don haka /24 a adaftar zahiri yana doke hanyar asali a VPN komai ƙarancin awo na rami. Awo yana warware daidaito ne kawai tsakanin hanyoyi na prefix ɗaya. Kuma IPv4 da IPv6 ana yanke shawara daban: bayanin da ke rufe 0.0.0.0/0 na iya barin IPv6 a mahaɗin gida, wanda ke sa shafin mai tarin yawa biyu ya zama kamar rabin rami. Duba Get-NetRoute -AddressFamily IPv6 kafin ku yanke shawarar cewa ramin yana da kyau.

Duba warware sunaye daban da NRPT

Sunayen ciki da suka kasa yayin da adiresoshin IP na ciki ke aiki suna nuna manufar mai warwarewa, ba tafarkin ba. Windows yana yanke shawarar DNS kowace sararin suna ta teburin manufar warware sunaye, wanda ya bambanta da teburin hanyoyi:

Get-DnsClientNrptPolicy -Effective | Select-Object Namespace, NameServers
Get-DnsClientServerAddress -InterfaceIndex $vpn.ifIndex

Lokacin da wata ƙa'ida ta dace da *.corp.example, tambayoyin wancan sararin suna suna zuwa sabar DNS na rami ko da hanyar bayanai zuwa waɗannan sabar a yanayin split tunnel tana kan adaftar zahiri. Wannan shine ƙira, kuma shi ya sa gwajin burauza da ke buɗe shafin jama'a ba ya gaya muku komai game da sunayen ciki. Idan adaftar tana jera sabar da ake tsammani amma bincike har yanzu yana zuwa wani wuri, kwatanta tsarin ƙa'idodin NRPT kuma duba ko wani sarari na musamman ya dace da farko.

Tabbatar da kwarara, sannan yanke shawara abin da kuka nema da gaske

Bi wuraren a cikin tsari tabbatacce domin sakamako ya zama kwatankwaci tsakanin na'urori: adireshin jama'a, adireshin ciki, sunan ciki da keɓe ɗaya da gangan kamar firinta na gida ko kiran bidiyo. Rubuta mu'amala da adireshin tushe da Find-NetRoute ke mayarwa ga kowanne. Bayan kowane canjin manufa, sake haɗawa kuma maimaita waɗannan gwaje-gwaje huɗu; teburin hanyoyi bayan sake haɗawa shine kawai hujjar cewa sabon bayanin ya fara aiki.

Sannan raba tafarkin daga tilastawa. Tilasta rami yana fifita rami ga zirga-zirgar da aka rufe yayin da yake tsaye. Ba kill switch ba ne. Idan buƙata ita ce babu abin da zai fita daga na'urar lokacin da ramin ya faɗi, dole ne ya fito daga ƙirar da ke toshewa: bayanin firewall da ke daure da yanayin rami, bayanin koyaushe-a-kunne mai tace zirga-zirga ko zaɓin abokin ciniki na mai siyarwa na rufewa-lokacin-kasawa. Tilasta rami kuma dole ne ya bar adireshin sabar VPN kanta a isa waje da rami, kuma toshe shi da sunan «tilasta komai» hanya ce abin dogaro ta kulle kanku daga haɗin da kuke ƙoƙarin tilastawa.

Kafin canza komai, bi wannan jerin. Kowane abin da ya kasa yana ƙunsa inda ainihin matsalar take.

• An tabbatar da suna da iyakar bayanin, an yi amfani da -AllUserConnection don bayanan dukan na'urar.
• An karanta SplitTunneling kuma an ɗauke shi a matsayin tsari, ba hujjar ɗauka ba.
• An jera hanyoyin adaftar rami daban don IPv4 da IPv6.
• An gudanar da Find-NetRoute don wata hanya ta jama'a, ɗaya ta ciki da ɗaya ta keɓe.
• An duba ƙa'idodin NRPT kafin a zargi hanyoyi da gazawar suna.
• An sake karanta buƙatar toshewa: tafarkin da aka fi so ba ɗaya yake da toshewar da aka tilasta ba.

Shawarar cikakken ko split rami ta mai bayanin ce, kuma bayanan tafarki na Microsoft suna bayyana halin da Windows ke aiwatarwa lokacin da bayanin ya saita shi. Microsoft: tilastawa da split rami ita ce tushen da nake buɗewa yayin karanta fitar.