An toshe abokan cinikin VPN da profilin jama'a na bangon wutar Windows

Tunnel ɗinka yana aiki, ƙofa tana amsa ping, kuma rabon fayil ɗin har yanzu yana ƙarewa da lokaci. Wannan haɗin ba safai yake zama matsalar hanya ba: Windows ya sanya subnet ɗin adaftan VPN cikin profilin Jama'a, kuma kowace ka'idar izini da aka rubuta don Keɓaɓɓe ko Yanki ba ta taɓa aiki ba. Na gamu da wannan a kan kwamfutocin tafi-da-gidanka waɗanda ke isa ofis ba matsala da kuma a kan sabar RRAS waɗanda ke hidimar duk sauran abokan ciniki, kuma gyaran yana da gajere da zarar ka ambaci profilin da ake magana akai. Ga tsarin da nake aiki da shi, tare da binciken da zai gaya maka lokacin da za ka tsaya kafin mataki na gaba.

Gano wane profil ne zirga-zirgar ke shigowa da gaske

Bangon wutar Windows ba shi da yanayi ɗaya na duniya. Kowace interface da aka haɗa tana ɗauke da rukuni, kuma ana tace fakitin da ke shigowa bisa rukunin interface ɗin da suke shigowa, don haka profilin adaftan VPN ne ke yanke shawarar abin da abokin ciniki a cikin tunnel zai iya isa, ba adaftan Wi-Fi ko Ethernet da ke gefensa ba. Karanta gaskiyar biyu kafin ka canza kome:

Get-NetConnectionProfile | Select-Object Name, InterfaceAlias, NetworkCategory, IPv4Connectivity
Get-NetFirewallProfile -Name Public | Select-Object Name, Enabled, DefaultInboundAction

A daidaitaccen shigarwar OpenVPN ko WireGuard, adaftan VPN yana bayyana a matsayin hanyar sadarwa da ba a gane ba kuma ya faɗa cikin Jama'a, wanda shine tsoho ga kowace hanyar sadarwa da Windows ba zai iya rarraba ba: babu wani mai kula da yanki da ya amsa a kansa kuma babu wani profilin ƙofa da ya dace. Sunan interface ɗin ba shi da mahimmanci a nan, don haka kiran adaftan "VPN" ko "Corp" ba ya canza kome. DomainAuthenticated yana buƙatar na'ura da aka haɗa da yankin , wanda zai iya isa mai kula da yanki ta wannan interface ɗin; tunnel ɗin da aka raba wanda ke ɗauke da subnet ɗaya ba zai cika wannan ba.

Idan ka'idar da kake buƙata an riga an iyakance ta zuwa tafkin VPN kuma tana aiki ga rukunin da ka karanta yanzu, tsaya a nan: tacewa ba matakinka ba ce, kuma wuri na gaba da za a duba shine saitin sabis ɗin. Wannan binciken yana ɗaukar daƙiƙa goma kuma yana adana awa ɗaya na gyaran ka'idoji. Sunayen rukuni da abin da kowanne ya ƙunsa an rubuta su a cikin bayanin Get-NetConnectionProfile.

Tabbatar da tacewa, ba hanya ba, kafin ka gyara ka'idoji

Ping gwaji ne mai rauni. ICMP na iya wucewa yayin da ake watsar da tashar sabis ɗin, kuma mai masaukin zai iya amsawa daga LAN yayin da yake ƙin wannan buƙatar ta tunnel. Gwada tashar da abokin ciniki ke buƙata, daga abokin ciniki:

Test-NetConnection 10.8.0.1 -Port 445
Test-NetConnection 10.8.0.1 -Port 3389 -InformationLevel Detailed

Idan gwajin tashar ya kasa, raba matakan biyu. Lalacewar tunnel ko hanya yawanci tana bayyana a matsayin babu amsa kwata-kwata daga adireshin ƙofa, yayin da watsi da bangon wuta ke nuna ƙofa da ke amsawa da tashar sabis da ba ta amsawa. A kan sabar Windows da ke wallafa tafkin ta RRAS, gudanar da wannan gwajin daga abokin ciniki kuma karanta profilin sabar ɗin kanta: interface ɗin RAS na iya zama cikin rukunin da ka'idojinsa na shigowa ba sa taɓa ambaton kewayon abokan ciniki, kuma shi ya sa na'urar ke hidimar LAN ɗinta kuma tana ƙin kowane abokin ciniki a cikin tunnel.

Lokacin da sakamakon har yanzu ba shi da tabbas, yi rikodin watsi don profilin da ake magana akai kuma karanta su:

Set-NetFirewallProfile -Name Public -LogBlocked True `
  -LogFileName "$env:systemroot\system32\LogFiles\Firewall\pfirewall.log"

Shigarwar da ke ambaton adireshin abokin ciniki da tashar tare da DROP tabbatacce ne, kuma suna gaya maka wace ka'ida ce ta ɓace. Log ɗin da babu komai a ciki yayin da SYN ɗin abokin ciniki ba ya bayyana, yana nuni zuwa sama da mai masaukin, don haka koma zuwa tunnel, ka'idar NAT, ko hanyar tafkin kafin ka taɓa wani abu na bangon wuta.

Iyakance ka'ida ɗaya mai shigowa zuwa tafkin abokan ciniki

Gyaran shine ka'ida ɗaya mai shigowa ta izini wadda adireshinta na nesa shine tafkin, ba dukan duniya ba. Daga zamana mai ɗaukaka:

New-NetFirewallRule -DisplayName "VPN clients - SMB 445" `
  -Direction Inbound -Action Allow -Protocol TCP -LocalPort 445 `
  -RemoteAddress 10.8.0.0/24 -Profile Public

Lokacin da sabis ɗin fayil ɗaya ne na binary, fifita ka'idar da aka iyakance ga shirin tare da -Program maimakon jerin tashoshi; wannan yana iyakance bandaɗin ga tsari da kewayon tushe.

Zaɓin profil shine inda ake yin wannan kuskuren a wata hanya. -Profile Public ya isa lokacin da adaftan Jama'a ne kuma ya kasance Jama'a. -Profile Any ana iya kare shi lokacin da sabis ɗin dole ya yi aiki ko ta yaya Windows ke rarraba adaftan, amma kawai muddin iyakar nesa ta kasance. Abin da ba za a taɓa iya kare shi ba shine -RemoteAddress Any a cikin profilin Jama'a: wannan ka'idar tana bin kwamfutar tafi-da-gidanka cikin kowace hanyar sadarwar cafe da otal da ta shiga kuma tana buɗe tashar ga duk wanda ke raba wannan subnet.

Rubuta tafkin kusa da ka'idar. -RemoteAddress 10.8.0.0/24 yana daina dacewa a hankali ranar da aka sake lambobi tafkin VPN, kuma lalacewar tana kama da ainihin kuskuren, shi ya sa yake cin rana ta biyu. Ba da sunan ka'idoji bisa sabis ɗin da kewayon tushe, riƙe su tare da -Group, kuma sake karanta su duk lokacin da bayanin tafkin ya canza. Lissafin ka'idoji da za ka iya duba a kan allo ɗaya ya fi ka'idar daidai wadda babu wanda zai iya samu.

Canza rukunin kawai lokacin da rukunin shine shawarar

Mayar da interface ɗin zuwa Keɓaɓɓe ma yana aiki, kuma shine tsohon da ba daidai ba. Profilin Keɓaɓɓe yana ɗauke da dogon jerin ka'idojin izini da aka gina, waɗanda suka haɗa rabon fayil da firinta, gano hanyar sadarwa, tebur mai nisa da ƙari dangane da tushe, don haka sake rarraba adaftan VPN yana kunna su duka a lokaci ɗaya ga kowane abokin ciniki a cikin tunnel. Ƙa'ida ɗaya da aka iyakance tana ba da sabis ɗaya ga kewayon ɗaya. A kan kwamfutar tafi-da-gidanka da ke shiga hanyoyin sadarwa marasa aminci kuma, wannan bambancin ba kawai na ado bane.

Akwai lokuta da rarrabuwar gaske ba daidai ba ce: tunnel ɗin da ke kunne koyaushe ko tsakanin wurare wanda ke ɗauke da subnet ɗin ofis kayan more rayuwa ne amintacce, kuma yiwa wannan adaftan alama a matsayin Keɓaɓɓe shawara ce ta ƙira da ta halatta, wadda aka yanke sau ɗaya ta manufa ba kowace tikiti ba. Lokacin da ka yi haka, yi shi a fili:

Set-NetConnectionProfile -InterfaceAlias "OpenVPN TAP-Windows6" -NetworkCategory Private

A kan na'urar da aka sarrafa, fara duba ko Manufar Ƙungiya ko tushen MDM ya mallaki saitin. Idan ya mallaka, za a soke canjin gida a sabuntawa ta gaba, kuma gpresult /h zai ambaci manufar da ta mallaka; gyara shi a can, ba a ƙarshen ƙarshen ba.

Tabbatar daga ɓangarori biyu kuma bar sawu

Tabbatar da kwararar da mai amfani ya ruwaito, daga abokin ciniki, bayan canjin:

Test-NetConnection 10.8.0.1 -Port 445
Get-NetFirewallRule -DisplayName "VPN clients - SMB 445" | Get-NetFirewallAddressFilter | Select-Object RemoteAddress
Get-NetFirewallRule -DisplayName "VPN clients - SMB 445" | Get-NetFirewallPortFilter | Select-Object Protocol, LocalPort

Sannan rufe madauki a kan abubuwan da za su karye mako mai zuwa. Sake kunna mai masaukin kuma sake gwadawa, domin ka'idar da aka iyakance ga kuskuren profil tana ci gaba da aiki har sai adaftan ya dawo cikin wani rukuni. Gwada daga abokin ciniki na biyu, domin abokin ciniki ɗaya da ke riƙe da hayar da ta tsufa na iya ɓoye rashin daidaituwar tafkin. Ƙidaya ka'idojin da ka ƙara da waɗanda ka cire, domin keɓancewar juna shine hanyar da gyaran layi biyu ke zama manufar tacewa wadda babu wanda zai iya dubawa.

Kafin ka kira shi an gama:

• Profilin da aka ambata a cikin ka'idar shine profilin interface ɗin da zirga-zirgar ke shigowa.
• Iyakar nesa ita ce tafkin VPN, kuma wannan tafkin ya dace da abin da sabar ke bayarwa da gaske.
• Babu ka'idar da ka ƙara da ke amfani da -RemoteAddress Any a cikin profilin Jama'a.
• Ba a kashe kome don gwajin ya wuce ba, kuma kowane canjin rukuni yana rubuta wanda ya amince da shi.