Shigo da martabar VPN a cikin PowerShell tare da Add-VpnConnection

Babu wani cmdlet mai suna Import-VpnProfile, kuma wanda ya fi kama da shi, Add-VpnConnection, ba ya taɓa karanta fayil ɗin .ovpn ko .conf. Yana haɗa bayanan martaba na asali na Windows daga sigogin da ka bayar, wanda shi ya sa binciken farko a nan shi ne tsarin fayil ba layin umarni ba. Idan ƙofar tana magana da SSTP, IKEv2, L2TP/IPsec ko PPTP, Windows na iya mallakar bayanan martabar kuma sauran jerin suna aiki. Idan an ba ka fayil ɗin OpenVPN ko WireGuard, tsaya a mataki na farko: waɗannan abokan ciniki suna da nasu masu shigo da su.

Mataki 1: Tabbatar da bayanan martabar da Windows zai iya mallaka da gaske

A gudanar da Get-Command -Module VpnClient a kan na'urar kafin komai. Windows 10, Windows 11 da Server 2016 ko sabbin suna kawo wannan module ɗin; idan babu shi, babu rubutun da aka kwafa da zai sa wannan na'ura ta karɓi bayanan martaba na asali. Cmdlet ɗin da suka fi muhimmanci su ne Add-VpnConnection, Get-VpnConnection da Remove-VpnConnection, kuma jerin sigogin da ke cikin bayanan Add-VpnConnection ya cancanci karatu sau ɗaya gaba ɗaya.

Na asali yana nufin cibiyar VPN ta Windows ce ke ƙare ramin. Wannan ya haɗa da IKEv2, sau da yawa da takardar shaidar inji; SSTP, wanda TLS ne tare da tabbacin mai amfani ko takardar shaida a ciki; da L2TP/IPsec tare da maɓallin da aka raba tun farko. Fayil ɗin .ovpn rubutun OpenVPN ne, ba haɗin Windows ba: yana ɗauke da umarni kamar remote, cipher ko tls-auth waɗanda cibiyar Windows ba ta da masaniya da su. .conf na WireGuard labari ɗaya ne da PrivateKey da AllowedIPs; juya ɗayan zuwa ɗayan ba zaɓin siga ba ne amma wani aiwatar da rami daban.

Akwai reshe na uku. Idan mai gudanarwa ya ba ka takardar XML ta VPNv2 CSP ko bayanan martaba na Intune, wannan hanyar MDM ce, wadda cibiyar samarwa ke aiwatarwa ba Add-VpnConnection ba. Kada ka fassara waɗannan sunayen kumburi zuwa sigogin PowerShell; maimakon haka, tambaya wace hanya ce ke aiwatar da XML ɗin.

Mataki 2: Haɗa nau'in rami da hanyar tabbatarwa

-TunnelType da -AuthenticationMethod sigogi ne daban, kuma ƙofar tana kula da haɗin ne kawai. Ɗaya daidai ɗayan kuma ba daidai ba, za ka sami bayanan martabar da ba ya haɗawa da komai, ko kuma ya tsaya yayin da ramin ya riga ya tashi. Saita duka biyu a fili maimakon dogaro da tsoho da aka zaɓa don wata hidima.

• IKEv2 tare da MachineCertificate: abokin ciniki yana gabatar da takardar shaidar kwamfuta; saita -EncryptionLevel Required kuma.
• SSTP tare da Eap: farkon ramin TLS, sannan PEAP/MSCHAPv2 ko takardar shaida a cikin EAP. Wannan yana buƙatar XML na mataki 3.
• SSTP, L2TP ko PPTP tare da MSChapv2, Chap ko Pap: sunan mai amfani da kalmar sirri kawai, babu blobin EAP.
• L2TP tare da MSChapv2 da -Lt2pPsk: PSK ɗin yana rufe rabin IPsec, mai amfani yana rufe PPP; duka biyu dole su dace da uwar garken.

Splat yana ajiye ƙimomin a wuri ɗaya:

$p = @{
  Name                 = "Corp IKEv2"
  ServerAddress        = "vpn.example.com"
  TunnelType           = "Ikev2"
  AuthenticationMethod = "MachineCertificate"
  EncryptionLevel      = "Required"
  SplitTunneling       = $false
  DnsSuffix            = "corp.example.com"
}
Add-VpnConnection @p -PassThru

-PassThru yana mayar da abin da Windows ya rubuta yanzu, don haka za ka iya duba shi ba tare da kira na biyu ba. Idan sunan ya riga ya wanzu, cmdlet ɗin ya ƙi gudana; -Force yana rubuta shi, wanda shine kuskuren martani a kwamfutar tafi-da-gidanka ta samarwa, domin yana watsar da duk abin da wani ya saita da hannu a hankali.

Mataki 3: Miƙa kayan shaidar daidai

Kalmomin sirri, maɓallan da aka raba tun farko da blobin EAP su ne wurin da waɗannan rubutun suka fi karyewa. -EapConfigXmlStream yana son XmlDocument, ba hanya ba, don haka fara karanta ka juya fayil ɗin. Ba da zaren zai haifar da kuskuren juyawa da ke kama da matsalar tsari kuma yana sa mutane su sake rubuta XML ɗin da bai taɓa zama ba daidai ba.

$eap = [xml](Get-Content -Raw .\peap-mschapv2.xml)
Add-VpnConnection -Name "Corp SSTP" -ServerAddress "sstp.example.com" `
  -TunnelType Sstp -AuthenticationMethod Eap `
  -EapConfigXmlStream $eap -EncryptionLevel Required

Wannan XML ɗin ba abin ƙirƙira ba ne daga guntun bulogi. Yana ambaton nau'in hanyar EAP da tabbacin ciki, kuma ƙofar tana kwatanta duka biyu da manufofinta. Hanyar ciki da ba ta dace ba tana gazawa bayan kammala musafaha na TLS, wanda yake kama da kalmar sirri mara kyau kuma ba ita ba ce. Ɗauki XML ɗin daga wanda ke tafiyar da ƙofar, ko fitar da shi daga bayanan martabar da ke aiki tukuna.

Ga IKEv2 rabin takardar shaida bincike ne a cikin ma'ajiya. -MachineCertificateIssuerFilter yana ɗaukar abin takardar shaida, kuma Windows yana amfani da shi don nemo takardar shaidar abokin ciniki mai amfani a LocalMachine\My. Takardar shaida tana buƙatar maɓalli na sirri da sarkar da uwar garken ke amincewa da ita; idan ɗaya ya ɓace, tabbacin yana gazawa ba tare da cikakken bayani ba, don haka fara duba ma'ajiyar:

Get-ChildItem Cert:\LocalMachine\My |
  Where-Object { $_.HasPrivateKey -and $_.NotAfter -gt (Get-Date) } |
  Select-Object Subject, Issuer, Thumbprint, NotAfter

Ka riƙe asirai a wajen fayil ɗin rubutun. PSK da aka bayar a layin umarni ko aka gasa a cikin .ps1 yana ƙarewa a rubuce-rubuce, zaman da aka adana da ma'ajiyar da aka raba, kuma -RememberCredential yana adana shaidar mai amfani don gaba, yana mai da gwaji na lokaci ɗaya izini mai dorewa.

Mataki 4: Yanke shawara kan iyaka kafin gudun farko

Cmdlet ɗin ɗaya yana rubutu a cikin littattafan waya biyu daban. Ba tare da -AllUserConnection ba bayanan martabar naka ne kuma yana ƙarƙashin %APPDATA%\Microsoft\Network\Connections\Pbk\rasphone.pbk. Da shi, daga babbar taga umarni, bayanan martabar yana zuwa %ProgramData%\Microsoft\Network\Connections\Pbk\rasphone.pbk kuma kowane asusu yana iya gani, har da allon shiga.

Iyaka ba abin kwalliya ba ne. Bayanan martaba na dukan masu amfani shi ne abin da asusun hidima, aikin da aka tsara ko yanayin kafin shiga zai iya amfani da shi; bayanan martaba na kowane mai amfani ba ya ganuwa ga duka ukun. Ana karanta abubuwan ma daban: Get-VpnConnection yana lissafa shigarwar mai amfani na yanzu, Get-VpnConnection -AllUserConnection yana lissafa na dukan na'urar. Zaɓi ɗaya yanzu, kuma ɗauki canji na gaba a matsayin sharewa da sake ƙirƙira maimakon gyara:

# elevated prompt
Remove-VpnConnection -Name "Corp IKEv2" -Force
Add-VpnConnection -Name "Corp IKEv2" -ServerAddress "vpn.example.com" `
  -TunnelType Ikev2 -AuthenticationMethod MachineCertificate `
  -EncryptionLevel Required -AllUserConnection

Mataki 5: Gwada abin da rami ya kamata ya bayar da gaske

Alamar da aka haɗa tana tabbatar da cewa ramin ya tashi kawai, ba wani abu ba. Fara haɗawa daga layin umarni don gazawa ta zo a matsayin rubutu, ba taga tattaunawa ba, sannan karanta abin da Windows ya rubuta:

rasdial "Corp IKEv2"
Get-VpnConnection -Name "Corp IKEv2" |
  Select-Object Name, ServerAddress, TunnelType, ConnectionStatus, SplitTunneling
Get-NetRoute -DestinationPrefix "0.0.0.0/0"

Gazawar biyu da masu amfani ke bayarwa yayin da matsayi har yanzu yana cewa Connected su ne DNS da turawa. Warware sunan ciki ka duba wace uwar garke ta amsa; bayanan martaba ba tare da -DnsSuffix ba na iya yin rami daidai kuma duk binciken intanet ya kasa. Sannan duba hanyar da aka saba: da split tunneling a kashe, hanyar 0.0.0.0/0 mafi ƙarancin ma'auni ya kamata ta nuna zuwa haɗin VPN, kuma da ita a kunne sai dai prefixed ɗin da kake tsammani. Idan duka biyu sun yi daidai kuma zirga-zirga har yanzu yana mutuwa, matsalar ta wuce bayanan martabar, a cikin manufa ko matatar ƙofar.

Lokacin da haɗin ya kasa gaba ɗaya, lambar tana taƙaita matakin da za a koma:

• 691: ƙofar ta ƙi shaidar. Koma mataki 3, ba ramin ba.
• 809: musafahan IKEv2 bai taɓa kammala ba. Duba UDP 500 da 4500, da amincewar takardar shaida.
• 789: maɓallin da aka raba tun farko na L2TP/IPsec ya ɓace ko ba daidai ba.
• 868: sunan uwar garken bai warware ba. Gyara DNS kafin gyara bayanan martabar.

Ka riƙe umarnin da ke aiki kusa da saitunan da yake ɗauka, don mutum na gaba ya sake ginawa maimakon ya juya bayanan martabar baya daga UI. Idan dole ka sake ginawa, share shigarwar ka sake ƙirƙirar da sigogi ɗaya; gyaran bayanan martaba da aka yi rabin-rabin yana barin tsofaffin hanyoyi da yanayin tabbaci a baya. Kuma idan fayil ɗin bai taɓa zama na asali ba, koma ga abokin cinikin da ya mallake shi. .ovpn da aka yi wa ado a matsayin bayanan martabar IKEv2 ba shigo da shi ba ne, tikitin tallafi ne.