Mai amfani da MikroTik VPN ya wuce gona da iri: iyakance ga mai masauki ɗaya da tashar ɗaya

Ramin yana tashi, shiga yana yin nasara, kuma kowane mai masauki a cibiyar sadarwa yana amsawa. Wannan ba VPN da ta lalace ba ce; VPN ce marar tsarin izini. RouterOS tana tabbatar da asusun sannan tana tafiyar da fakitinsa kamar na kowa, don haka dole bangon wuta ya samar da iyaka. Ƙara wannan iyaka ba tare da karya shiga ba shine dukan aikin.

Tabbatarwa tana ƙarewa inda izini ke farawa

Da zarar zaman PPP ya tashi, fakitin abokin ciniki suna shiga sarkar forward kamar zirga-zirga daga kowace fuska. Idan manufar forward ta na'urar tana da sassauci, mai ba da shawara yana gado wannan sassaucin lokacin shiga. Asusun bai taɓa ɗaukar iyaka ba, don haka babu abin da za a canza a asusun. An rubuta ka'idodin ga ma'aikata kuma sabon zaman ya shiga cikinsu kawai.

Duba wace hanya ne buƙatar ta shafi kafin ka rubuta komai. Zirga-zirgar zuwa ga masu masauki a bayan na'urar tana wucewa ta forward, yayin da zirga-zirgar zuwa na'urar kanta, ciki har da winbox da SSH, ke wucewa ta input. Iyakar da ke rufe forward kawai tana barin na'urar a buɗe ga abokin ciniki ɗaya.

Dukan sarkoki biyu suna buƙatar shawara, ko da shawarar ita ce a bar input a rufe. Wannan zaɓi na cikin buƙatar shiga ne, ba wani tunani na baya ba.

Haɗa zaman zuwa jerin da aka ambata

Bayanan martaba na PPP na iya saka adireshin da yake bayarwa a cikin jerin adireshi mai suna lokacin da zaman ya fara. Wannan yana mai da adireshin rami na wucin gadi wani abu da bangon wuta zai iya daidaitawa da suna, kuma shigarwar tana ɓacewa idan zaman ya ƙare. Sannan asusun yana gado iyakar daga bayanansa maimakon daga ka'idar da ke ɓoye adireshi da ƙarfi.

Ƙirƙiri bayanan martaba da farko, sannan ka ɗaure secret gare shi a fili. Secret da har yanzu ke nuni ga bayanan martaba na asali yana sake haifar da matsalar farko.

Ba da suna ga bayanan martaba da jerin domin ayyukansu su bayyana, kuma ka yi sharhi a kan duka biyu da maganar buƙatar. Bayanan martaba ɗaya na iya hidimtawa mutane da yawa da iyaka ɗaya, yayin da jerin ke ci gaba da gano kowane zaman da ke raye. Wannan ya fi arha don bita fiye da ka'ida ga kowane mutum.

/ppp profile add name=scoped-consultant remote-address=consultant-pool address-list=vpn-scoped-clients
/ppp secret add name=consultant password=... service=ovpn profile=scoped-consultant

Yi rijistar hidimar da aka yarda a cikin jeri ɗaya

Saka uwar garken da aka yarda a cikin jerin adireshinta maimakon saka adireshin cikin ka'idar tacewa. Ana iya bincika jerin, faɗaɗa shi da yin sharhi a kansa, kuma ka'idar da ke amfani da shi ba ta canzawa idan uwar garken ta ƙaura. Shigarwa ɗaya tana kama da wuce gona da iri har sai mai masauki na biyu ya zo, wanda yawanci yakan zo.

Daidaita jeri idan adireshin mai canzawa ne ko an raba nauyi, kuma daidaita adireshin kai tsaye idan an tanada shi kuma yana da ƙarfi. Kowace zaɓi ana karantawa a fili idan sharhin ya ambaci hidima da mai shi.

Iyakance yarjejeniya da tashar tare da mai masauki. Accept ga mai masauki ba tare da iyakance tasha ba yana buɗe kowace hidima da wannan mai masaukin ke gudanarwa, wanda ya fi faɗi fiye da yadda yawancin buƙatun shiga suke nufi. Tashar wani ɓangare ne na izini, ba cikakken bayani da za a ƙara daga baya ba.

/ip firewall address-list add list=vpn-targets address=10.0.0.10 comment="consultant RDP target"

Tsara tsallen kafin kowane babban accept

Ka'idar tsalle tana aika zirga-zirgar da aka tura daga jerin da aka iyakance zuwa sarkar sirri inda dukan manufar ta shiga layi uku. Ka'idar farko tana karɓar wurin da aka yarda da tashar, kuma ta ƙarshe tana jefar da duk sauran. Tsallen dole ya kasance sama da kowane babban accept a forward, domin accept da ya gabata yana nufin tsallen ba ya gudana. Riƙe accept na established da related kafin tsallen domin zirga-zirgar dawowa ta ci gaba da gudana.

Duba cewa babu ka'idar fasttrack da za ta iya ɗaukar wannan zirga-zirga ta wuce sarkar da aka iyakance. Fasttrack yana ƙetare sauran hanyar tacewa, kuma zaman da aka iyakance da aka yi fasttrack ba shi da iyaka kwata-kwata.

Maimaita shawarar ga sarkar input idan hidimomin na'urar da kanta ya kamata su kasance marasa isa. Iyakar da ke toshe zirga-zirgar da aka tura kuma ta bar winbox a buɗe rabin aiki ne kawai.

/ip firewall filter
add chain=forward action=jump jump-target=scoped-vpn src-address-list=vpn-scoped-clients
add chain=scoped-vpn action=accept protocol=tcp dst-address-list=vpn-targets dst-port=3389
add chain=scoped-vpn action=drop

Tabbatar da ma'auni da kasancewar cikin jeri

Daga abokin ciniki, gwada hidimar da aka yarda da ɗaya da dole ta kasa, sannan ka karanta ƙididdigar ka'idoji a kan na'urar. Ma'aunin accept da drop suna nuna wace hanya kowane fakiti ya bi, abin da abokin ciniki ba zai iya gani ba. Tabbatar kuma cewa adireshin zaman da ke raye ya bayyana a cikin jerin da aka iyakance.

Jerin da ba komai a ciki yana nufin asusun yana kan wani bayanan martaba ko bayanan martaban ya rasa saitin jerin adireshi. Ma'aunin drop da ke tashi tare da hidimar da aka yarda da ta kasa yana nufin wurin ko tashar ba su dace da abin da abokin ciniki ke aikawa ba.

Gwada hidima ɗaya da suna da adireshi kafin ka yanke hukunci. Rashin warware suna yana kama da tashar da aka toshe daga bangaren abokin ciniki. Sannan ka rubuta bayanan martaba, jerin biyu da hidimar da aka yarda guda ɗaya a cikin buƙatar shiga domin bita na gaba ta kwatanta maimakon sake ginawa.

/ip firewall filter print stats where chain=scoped-vpn
/ip firewall address-list print where list=vpn-scoped-clients