Maɓallin kashewa yana ci gaba da toshe zirga-zirga bayan an cire VPN

Ramin ya tafi, alamar cibiyar sadarwa tana kama da ta al’ada, kuma babu abin da ke lodawa. Ka cire VPN, ko ka cire shi, ko ka sake kunna na’urar, kuma toshewar da za ta kare ka lokacin da aka yanke haɗin tana nan a tsaye. Tagar abokin ciniki ba za ta iya bayyana hakan ba, domin ba abokin ciniki ne ke toshe ka ba: an rubuta shawarar a cikin kernel da sunanka, kuma ba a bar wani abu da zai cire ta ba. A Windows wannan yanayi yana cikin Windows Filtering Platform; a Linux kuwa saitin ƙa’idoji ne a iptables ko nftables, sau da yawa tare da hoton da ake sake kunnawa lokacin tashi. Abin da ke gaba shi ne tsarin da nake amfani da shi: karanta yanayin, share mafi ƙarancin abin da ke bayyana gazawar, sannan nemo duk abin da yake ci gaba da mayar da shi.

Maɓallin kashewa yanayin kernel ne, ba saiti ba

Abokan ciniki na tebur suna aiwatar da toshewa ta hanyar ƙara tace-tace da ke hana zirga-zirga a wajen rami. A Windows waɗannan tace-tacen WFP ne a matakan juya hanyar haɗi da jigilar kaya, kuma wasu daga cikinsu na dindindin ne: ana rubuta su a cikin ajiyar manufofin Base Filtering Engine kuma ana mayar da su lokacin da na’urar ta tashi, kafin kowace manhajar VPN ta gudana. Abokan ciniki sun bambanta a lokacin da suke tsaftacewa. Wasu suna cire tace-tace lokacin cire haɗin, wasu kawai lokacin fita mai tsafta, wasu kuma kawai idan an fara kashe maɓallin kashewa. Cire shi yayin da toshewar ke aiki, ko kashe tsarin, kuma tace-tacen suna nan.

Daidai a Linux shine ƙa’idar jefawa ko ƙi a hanyar fita, wani lokaci ƙa’idar turawa, wani lokaci canji a manufar sarkar. Waɗannan ƙa’idojin suna rayuwa fiye da tsarin da ya ƙara su domin yanayin kernel ne: kashe abokin ciniki, sa shi ya faɗi, ko yanke wutar lantarki, kernel ɗin yana ci gaba da jefar da fakiti ba tare da wani abu da zai mayar da shi ba. Kunshin dorewa yana ƙara mataki na biyu na dindindin ta hanyar ɗaukar hoton saitin ƙa’idojin yanzu da mayar da shi lokacin tashi, don haka farkon na gaba yana farawa da toshewar da aka riga aka girka.

Karanta yanayin WFP kafin ka share wani abu

Windows yana zuwa da kayan aikin da kake buƙata. Gudanar da tashar umarni mai ɗaukaka ka zubar da yanayin dandali; zubar ɗin yana zuwa a matsayin wfpstate.xml a cikin babban fayil ɗin aiki.

netsh wfp show state
netsh wfp show filters
Get-Service bfe

Nemo a cikin XML sunan mai bayarwa da ya tafi, aikin Block, da matakin. Tace-tacen da ke kan juya hanyar haɗi da jigilar kaya su ne waɗanda ke karya zirga-zirgar yau da kullum; tacewar da ke kan matakin karɓar liƙewa ba yawanci ba ce sanadinka ba. Idan Base Filtering Engine ba ya gudana kwata-kwata, duba wani wuri, domin babu wani abu da zai iya tilasta waɗannan tace-tacen.

Duba kuma ganin bangon wuta na yau da kullum, domin yawancin mutane suna duba ɗaya ne kawai daga cikin biyun:

netsh advfirewall show allprofiles
Get-NetFirewallProfile | Select-Object Name,Enabled,DefaultInboundAction

Lokacin da bayanan da aka gina a ciki suna kunne kuma babu wata ƙa’ida da ta dace da zirga-zirgar da ke gazawa, toshewar tana zuwa daga mai bayarwa na ɓangare na uku ba daga bangon wuta na Windows ba. Wannan bambanci ne ke yanke shawarar wane kayan aiki za ka yi amfani da shi don gyaran.

Karanta ƙa’idojin Linux a cikin tsarin da za ka share da shi

iptables -S yana buga ƙa’idoji a cikin sigar da ake amfani da ita wajen ƙara su, wanda ke sa fitarwar ta zama mai yiwuwa a sake amfani da ita kai tsaye don sharewa. iptables -L -v -n yana ƙara ƙididdigan fakiti, kuma waɗannan ƙididdigan suna gaya maka ko ƙa’ida tana dacewa da buƙatun da suka gagara ko kuwa tana zaune kawai a cikin sarkar.

sudo iptables -S
sudo ip6tables -S
sudo iptables -t nat -S

Karanta manufofin sarkoki, ba ƙa’idoji kawai ba: -P OUTPUT DROP yana toshe zirga-zirga ko da babu wata ƙa’ida da ta dace. Bincika IPv6 daban, domin abokin ciniki da ke girka dukan iyalai biyu na iya barin toshewar IPv6 a wurin bayan ƙa’idojin IPv4 sun tafi, kuma alamar cutar a lokacin ta dogara da wane iri ne aikace-aikace ya fi so. Inda ake amfani da nftables, gudanar da nft list ruleset kuma; kayan aikin biyu suna tare ta hanyar matakin jituwa, kuma jeri ɗaya ba lalle ne ya nuna kowace ƙa’ida da za ta iya jefar da fakiti.

Share mafi ƙarancin abin da ke bayyana gazawar

A Windows mataki na farko har yanzu hanyar cirewar mai bayarwa ce: sake gudanar da mai girka ka yi amfani da gyara ko cirewa, ko gudanar da kayan aikin tsaftacewa idan mai bayarwa ya wallafa ɗaya. Sauran ayyuka da ayyukan da aka tsara suna da yawa, kuma aikin da ke fara abokin ciniki lokacin shiga yana sake girka tace-tacensa a tashin gaba. Cirewar da ta gagara yayin karanta maɓallin rijista na abokin ciniki yawanci yana nufin wata hidima ko aiki yana riƙe da shi, ba cewa rijistar ta lalace ba.

Get-ScheduledTask | Where-Object TaskName -like '*vpn*'
Get-Service | Where-Object DisplayName -like '*vpn*'

Tace-tacen dindindin su ne makoma ta ƙarshe. Suna zaune a ƙarƙashin HKLM\SYSTEM\CurrentControlSet\Services\BFE\Parameters\Policy\Persistent\Filter, ƙima ɗaya ga kowace tacewa da maɓallin GUID. Fara fitar da maɓallin, rubuta GUID ɗin da kake cirewa, share ƙimomin da suka mallaki abokin cinikin da ya tafi kawai, sannan sake tashi don injin ya sake gina yanayinsa. Kada ka share dukan maɓallin kuma kada ka kashe Base Filtering Engine: bangon wuta na Windows da Defender sun dogara da shi, kuma za ka musanya matsala da mafi muni.

reg export "HKLM\SYSTEM\CurrentControlSet\Services\BFE\Parameters\Policy\Persistent" C:\temp\bfe-backup.reg

A Linux, ɗauki layin da iptables -S ya buga ka maye gurbin -A da -D. Share ƙa’idar guda ɗayar da ka gano ya fi share sarkar gaba ɗaya, domin yana barin manufarka ta kasance cikakke.

sudo iptables -D OUTPUT -p udp -j REJECT

Idan jefawar tana cikin sarkar da mai amfani ya ayyana, fara share tsallakewar zuwa wannan sarkar sannan ka cire sarkar da -X. Sanya manufar sarkar zuwa ACCEPT yayin da ƙa’idojin jefawa har yanzu suna nan yana taimakon fakiti ne kawai da suka isa shawarar manufar. Share dukan alluna makoma ta ƙarshe ce: yana kuma cire ƙa’idojin da ka ƙara saboda wasu dalilai, kuma da ufw a kunne yana barin hidimar ta yi zaton tana da sarkokin da ba su wanzu kuma.

Nemo mai shi da ke mayar da shi

Bayan gyaran gaggawa, nemi duk abin da zai iya mayar da yanayin. A Linux, duba ko an kunna sashin dorewa, ko abokin ciniki yana da saitin mayar da bangon wuta lokacin shiga, da ko akwai ajiyayyen fayil ɗin ƙa’ida a ƙarƙashin /etc. A Windows, sake duba shigarwar farawa, ayyuka da ayyukan da aka tsara, sannan sake tashi ka sake karanta yanayin da umarnin da ka yi amfani da su a baya.

Idan toshewar ta dawo, sharewa ba ita ce maganin ba; mai shi ne. Rubuta wane abokin ciniki ko hidima ke girka ta ka kashe fasalin a can, maimakon yin yaƙi da shi a matakin bangon wuta bayan kowace cire haɗi.

Tabbatar da zirga-zirgar gaske, ba ping ɗaya ba

Gwada neman suna, haɗin TCP da sabon zaman burauza, sannan sake tashi ka maimaita waɗannan gwaje-gwaje uku. Ping da ke aiki yayin da HTTPS ke gazawa yana nuna tacewar matakin jigilar kaya ne ba cibiyar sadarwa ba, kuma toshewar da ke dawowa sai bayan sake tashi tana nuna mai shi da ba ka same shi ba tukuna.

Riƙe shaidun: maɓallin BFE da aka fitar, ko fitarwar iptables -S da aka kama kafin canjin. Kafin ka kira shi an gyara, tabbatar da matakin da ka cire abin daga gare shi, mai shin da zai iya sake girkawa, yanayin bayan tsaftataccen tashi ɗaya, da kuma cewa burauzar yau da kullum tana aiki ba tare da wani tsarin VPN yana gudana ba. Shafin littafin jagora na iptables(8) yana da ainihin tsarin sharewa da manufa idan kana rubuta tsaftacewar a matsayin script.