LocalSubnet a cikin ka'idar wuta ta SMB ba za ta rufe abokan cinikin VPN ba
Ka'idar izini ta LocalSubnet tana rufe subnet ɗin sabar kanta, ba tafkin VPN da aka yi masa hanya ba. Kwatanta adireshin tushen da sabar ke gani kafin faɗaɗa iyaka.
Kwamfutocin tebur na ofis suna isa ga rabon, masu amfani da VPN suna ƙarewa a lokaci, kuma asusu ɗaya yana aiki daga hotspot ɗin waya. Izinin rabo ba kasafai ne ya bambanta ba; adireshin da ya isa sabar fayil shi ne yawanci. Ka'ida da aka iyakance zuwa LocalSubnet tana shigar da subnet ɗin sabar da aka haɗa da kanta, kuma tafkin VPN da aka yi masa hanya daban ba ɗaya ne daga cikinsu ba. Zane-zane biyu suna rufe wannan gibin, kuma suna barin bayanai mabambanta sosai.
Zane-zane biyu, alama ɗaya
Zanen farko yana ƙara tafkin VPN ga yanayin adireshin nesa na ka'idar. Sabar tana ganin adireshin ramin kowane abokin ciniki, don haka bayananta na iya raba mai amfani na nesa da wani. Zanen na biyu yana tafiyar da zirga-zirgar VPN ta hanyar ƙofar da take fassara shi zuwa adireshin LAN kafin sabar ta gan shi. Wannan yana maido da haɗi kuma yana cire bambanci a mataki ɗaya.
Tebur ɗin yana bayanin matsayi maimakon adireshi, kuma prefix ɗinka ne ke yanke shawarar wane layi ya shafi. Buga ainihin ƙimar sabar maimakon kwafin misali daga rubutun blog:
Get-NetIPAddress -AddressFamily IPv4 | Select-Object InterfaceAlias, IPAddress, PrefixLengthTebur ɗin taimako ne na yanke shawara, ba maganar kowane turawa ba. Mai masauki da ƙarin mu'amala, hanyar haɗin wuri ta biyu ko wani abin rufe fuska yana da saitin gida daban.
| Path the packet takes | Address the server records | Filter scope that admits it | What the log can still tell you |
|---|---|---|---|
| Desktop on the server LAN | Its own LAN address | LocalSubnet or the LAN prefix | Which workstation connected |
| Client on the routed VPN pool | Its tunnel address | The VPN pool as a remote address | Which VPN account connected, if the pool is logged |
| Client behind source NAT at the gateway | The gateway's LAN address | The gateway address | Only that some VPN user connected |
| Site-to-site gateway | The remote gateway's tunnel address | The remote site's prefix | Which site connected, not which user |
Bayanin New-NetFirewallRule na Microsoft yana bayanin yanayin adireshin nesa da kalmar maɓalli LocalSubnet. Karanta shi kafin ka yanke shawarar cewa kalmar maɓallin tana nufin duk adireshin sirri, domin ba haka ba ne.
Kwatanta abin da sabar ke karɓa a zahiri
Karanta ka'idar da take aiki maimakon wadda wani ya tuna ya ƙirƙira. Tabbatar tana aiki, tana shafar bayanin da ke aiki, kuma yanayin adireshin nesanta ya dace da tushen da sabar ke gani. Ka'idar da ke aiki a bayanin Domain kawai ba ta yin komai lokacin da adaftan ya koma Public bayan canjin cibiyar sadarwa.
Get-NetFirewallRule -DisplayGroup 'File and Printer Sharing' | Get-NetFirewallAddressFilter
Get-NetFirewallProfile | Select-Object Name,Enabled,DefaultInboundActionUmarni na farko yana buga matatun adireshi da ke haɗe da ka'idodin rabon fayil, na biyun kuma yana nuna waɗanne bayanai suke aiki da yadda ake bi da zirga-zirgar shigowa da ba ta dace ba. Duba kuma ka'idar toshewa da manufar da ake sarrafawa ta tsakiya. Ka'idodin toshewa suna da fifiko akan ka'idodin izini, kuma manufar da ke kashe haɗa ka'idodin gida na iya barin sabon keɓancewar gida mara amfani.
Wannan shi ne yanayin da ka'idar ta yi kama da daidai a cikin na'ura amma ba ta da tasiri kan zirga-zirga. Duba sanya bayanin a lokaci guda, domin kwamfutar tafi-da-gidanka da ta shiga wata cibiyar sadarwa na iya ƙaura zuwa bayanin Public ba tare da kowa ya taɓa wutar ba.
Gwada jigilar kafin shiga
Raba isa ga wuri daga tabbatarwa. Mai sauraro a kan TCP 445 yana tabbatar da cewa sabis ɗin yana daure da tashar; ba ya tabbatar da cewa fakiti na nesa zai iya isa gare ta. Haɗin TCP da ya kammala, shi kuma, bai ce komai ba tukuna game da kafa zaman SMB ko izinin rabo. Gwada musafaha daga ɓangarorin biyu kafin ka gyara ka'ida.
Test-NetConnection -ComputerName files.corp.example -Port 445
Test-NetConnection -ComputerName files.corp.example -Port 445 -InformationLevel DetailedUmarni na farko yana ba da rahoton ko musafahar TCP ta yi nasara daga injin da ka gudanar da shi, na biyun kuma yana ƙara adireshin da aka warware da bayanan mu'amala. Gudanar da shi daga abokin cinikin VPN da kuma daga kwamfutar tebur ta ofis, sannan ka kwatanta. Ping ba ya amsa ko ɗaya daga cikin tambayoyin, domin ana iya toshe ICMP yayin da SMB a buɗe take, ko a ba da izini yayin da wutar ke watsar da 445.
Idan musafahar ta kasa daga VPN kawai, iyakar tushe ita ce babban wanda ake zargi. Idan ta yi nasara kuma rabon har yanzu ya ƙi ka, koma ga binciken zaman SMB da izini maimakon gyara ka'idodin wuta.
Lokacin da NAT na tushe ya cire bambancin
Da fassara a cikin hanyar, sabar ba za ta iya bambanta abokan cinikin VPN ɗaya-ɗaya da adireshi ba. Kowane mai amfani na nesa yana zuwa a matsayin ƙofar. Duk wani izini da ya dogara da bambanta su dole ne a aiwatar da shi inda har yanzu ana ganin ainihin su, wanda yawanci yana nufin mai tattara VPN ko wakili mai tabbatarwa. Ka'idar wuta na iya shigar da zirga-zirga; ba za ta iya maido da bambancin da fassara ta cire ba.
Da zarar an yarda da adireshin ƙofar, kowane mai amfani na nesa ana rubuta shi a ƙarƙashin adireshi ɗaya, don haka ka'idar tana ba da dukan tafkin ga duk wanda zai iya isa ƙofar. Idan shawarar kowane mai amfani tana da muhimmanci, riƙe adireshin asali a bayyane ko matsar da shawarar zuwa wani matakin da har yanzu ya san mai amfani. In ba haka ba kowane mai amfani na nesa yana gado izinin adireshin ɗaya da sabar ke iya gani, kuma hanyar dubawa ba za ta iya bambanta su daga baya ba. Wannan shawara ce ta ƙira, ba cikakken bayanin wuta ba.
Zaɓi da gangan tsakanin zane-zanen biyu. Iyakance ka'idar zuwa ainihin tafkin VPN lokacin da sabar dole ta ga wanda ya shiga, kuma ka yarda da hanyar da aka fassara kawai lokacin da sabar ba ta buƙatar wannan bayanin da gaske. Rubuta kewayon tushen da aka zaɓa kusa da ka'idar, domin mutumin da zai gyara wannan na gaba zai fara duban teburin adireshi.