Tunnel ɗin raba hanya ɗinku yana isa manhaja amma ba uwar garken DNS ɗinta ba

Tura subnet ɗin manhaja shine bayyanannen ɓangaren tunnel ɗin raba hanya, kuma ba shine dukan aikin ba. Resolver ɗin yakan zauna a wani adireshi daban da manhajar da yake yi wa hidima, don haka tunnel mai aiki zai iya barin binciken a wajensa. Profil ɗin da ke ɗauke da 10.80.0.0/16 kuma babu wani abu zai aika tambayar 10.90.0.53 ta hanyar mu'amala ta gida, inda babu wani yanki na sirri. Ƙara hanyar resolver ɗin, sannan ka duba rabin na biyu na matsalar: wace uwar garke abokin ciniki ke zaɓa a zahiri.

Tatsuniya: hanya ɗaya tana rufe dukan sabis ɗin

Tunnel ɗin raba hanya jeri ne na wuraren da za su bi ta hanyar haɗin, ba bayanin sabis ba. Subnet ɗin manhaja da adireshin resolver biyu ne daban-daban, kuma profil na iya ɗaukar ɗaya ba tare da ɗayan ba. Idan hakan ya faru, ana iya isa manhajar da adireshi yayin da sunanta ya kasa, wanda ke kama da gazawar DNS maimakon gibin turawa.

Subnet ɗin da ke kewaye da resolver ɗin ma ba a rufe shi kai tsaye ba. Hanyar host zuwa adireshi ɗaya ta isa ga wannan resolver kuma ba ta buɗe maƙwabtansa. Wannan shine ma'anar hanyar host: siriri a tsari, kuma mai sauƙin mantawa idan sabis na gaba ya bayyana a cikin subnet ɗaya.

Dole abu uku su tabbata domin binciken ya yi aiki: abokin ciniki ya tura adireshin resolver ta cikin tunnel, ƙofar shiga ta karɓi kuma ta tura wannan buƙatar, kuma resolver ɗin ya karɓi tushen da ya samu. Amsar kuma dole ta dawo ta hanyar da aka amince da ita. Idan ɗaya daga cikinsu ya ɓace, alamar iri ɗaya ce, don haka ya dace a rubuta teburin adireshi kafin a taɓa tsari.

Gano waɗanne adireshi profil ɗin ya kamata ya ɗauka

Jera wuraren a tsari: hanyar sadarwar manhaja, adireshin resolver, da ƙarshen jama'a wanda ke ƙare tunnel ɗin kansa. Na uku ba zai taɓa turawa cikin tunnel ba, domin haɗin waje yana buƙatar hanyar da ta wanzu kafin tunnel ɗin.

Haɗa duka UDP da TCP don DNS, tunda ana sa ran aiwatarwa su goyi bayan TCP tare da UDP, kuma hanyar TCP da aka toshe tana haifar da gazawa a hankali, wani ɓangare maimakon tsarkakakku. Idan ana ba da yankin sirri ta IPv6 ma, keɓancewar host daidai tana amfani da adireshin IPv6 da prefix kuma wani shigarwa ne dabam.

Yi rikodin abin da profil ɗin ya riga ya rufe kafin ƙara wani abu. Hanyar da aka maimaita ba ta da lahani, amma hanyar da ba a zata ba tana gaya maka an tsara profil ɗin don wani shirin adireshi daban da wanda aka ba ka.

Ƙara hanyar host ta hannun mai hanyar haɗin

Don profil na asali na Windows da ake sarrafawa a gida, hanyar ta haɗin ce maimakon teburin turawa na gama-gari na na'urar. Ka fara duba ƙarin, sannan ka yi amfani da shi da irin iyakar da profil ɗin ke amfani da shi.

Add-VpnConnectionRoute -ConnectionName 'Office VPN' -DestinationPrefix '10.90.0.53/32' -WhatIf
Get-VpnConnection -Name 'Office VPN' | Select-Object -ExpandProperty Routes

Umarni na farko yana duba canjin ba tare da shigar da komai ba, kuma na biyu yana lissafa hanyoyin da profil ɗin ke ɗauka a yanzu. bayanin Add-VpnConnectionRoute na Microsoft yana rubuta iyakokin kowane mai amfani da na dukan masu amfani; profil na dukan masu amfani yana buƙatar nasa siga ta iyaka, kuma umarnin kowane mai amfani a kan profil na dukan masu amfani yana gazawa ko ya sauka a wuri mara kyau.

Lokacin da ake sarrafa profil ɗin ko ya fito daga abokin ciniki na mai siyarwa, canjin na wannan mai shi ne. Tattara hanyar tsarin dindindin a kan manufar haɗin yana aiki har sai an sake amfani da manufar kuma hanyar ta ɓace, wanda yakan faru a lokacin kiran tallafi maimakon a lokacin gwaji. Wannan gazawar shiru ce: hanyar tana ɓacewa, sunan ya daina warwarewa, kuma babu wanda ya haɗa al'amuran biyu. Saka canjin a rikodin mai shi don sake amfani na gaba ya ɗauke shi maimakon ya goge shi.

Bayan amfani, sake haɗa profil ɗin maimakon ɗauka cewa hanyar ta yi tasiri. Canje-canjen hanya a kan haɗi mai rai ba koyaushe ake ɗaukarsu ba, kuma sake haɗawa yana sake haifar da yanayin da masu amfaninku za su kasance a zahiri.

Duba wace resolver abokin ciniki ya yi amfani da ita a zahiri

Hanya tana sarrafa fakiti da aka aika zuwa resolver. Ba ta yanke shawara waɗanne sunaye za a aika a can ba, kuma wannan zaɓi wata hanya ce dabam. A Windows, ingantattun dokokin sararin suna na iya zaɓar resolver ga kowane yanki, yayin da saitunan DNS na profil ke bayar da tsoho. Waɗannan matakai biyu na iya samun sabani ba tare da haifar da wata kuskure ba, don haka tambaya kai tsaye rabin shaida ne kawai.

Get-DnsClientNrptPolicy
Resolve-DnsName app.svc.example -Server 10.90.0.53 -Type A

Umarni na farko yana buga manufar sararin suna da ke aiki, kuma na biyu yana tambayar resolver ɗin sirri kai tsaye sunan manhajar. Amsa kai tsaye tana tabbatar da hanya da resolver suna aiki; ba ta tabbatar da cewa binciken manhajar da kansa ya zaɓi wannan uwar garken ba. Kwatanta shi da bincike na yau da kullum na wannan sunan da amsar da manhajar ke samu.

Yi la'akari da ajiya da DNS mai aminci a matakin burauza, wanda zai iya ƙetare resolver ɗin tsarin gaba ɗaya don sunayen da mai amfani ya buga. Ƙarin bincike wata alama ce ta yaudara: yana faɗaɗa gajeren suna zuwa cikakken cancanta kuma ba shi da alaƙa da wace uwar garke ke amsawa.

Kammala da sake haɗawa da maimaita binciken na yau da kullum, sannan tabbatar da cewa burauzar ta yau da kullum har yanzu tana bin manufar da aka amince da ita. Maye gurbin resolver ɗin sirri da na jama'a don a warware sunan da ba shi da alaƙa ba gyara ba ne, kuma yana motsa tambayoyin sirri a shiru zuwa inda ba a taɓa nufin su je ba.