Tacewar zirga-zirgar VPN ko ƙa'idar IPsec: inda Windows ke tilasta tashar jiragen ruwa

Wani mai amfani da VPN na Windows ya kamata ya isa HTTPS a kan uwar garke kuma ba SMB a kan wannan uwar garken ba, kuma hanya ba za ta iya bayyana hakan ba. Duk buƙatun biyu suna ɗauke da adireshin manufa ɗaya, don haka prefix ɗin da ke tura zirga-zirga cikin rami yana ɗauke da kwararar da kake so ka ware. Raba su yana buƙatar ƙa'ida da ke duba wani abu mai zurfi fiye da manufa.

An gina niyya biyu daban-daban da hanyoyin Windows biyu daban-daban. Haɗa su yana samar da manufa da ke kama da cikakke yayin da take tilasta rabin abin da kake nufi.

Hanya ba za ta iya raba sabis biyu a adireshi ɗaya ba

Tushen hanyar VPN ya dogara ne a kan prefix: yana yanke shawara wace manufa za ta bi ta rami kuma wace za ta kasance a waje. Wannan shine kayan aiki da ya dace don ajiye wani subnet a ciki da wani a waje, kuma a tsarin sa ya makanta ga tashoshin jiragen ruwa. Tacewar zirga-zirga a kan bayanin VPN tana ƙara wani girma na biyu: tana daidaita protocol, adireshin nesa da tashar nesa ga abin da zai iya tsallake wannan interface. Ƙa'idar IPsec tana aiki a wuri na uku, tana bayyana wace kwarara ke buƙatar kariya da wanda suke tabbatarwa da shi. Ukun suna amsa tambayoyi daban-daban kuma babu ɗaya da ke maye gurbin sauran.

Fara da rubuta jumlar da ake so. Barin HTTPS kawai jumlar shiga ce, yayin da buƙatar IPsec ga HTTPS jumlar kariya ce, kuma biyun suna kaiwa ga tsari daban.

Takaitaccen shiga da buƙatar kariya sun bambanta

Takaitaccen shiga yana faɗin abin da zai iya amfani da interface, kuma ana aiwatar da shi ta barin wani saiti da ƙin duk sauran. Buƙatar kariya tana faɗin wace kwarara dole a ɓoye ta kuma a tabbatar da ita, kuma ana aiwatar da ita ta tattauna haɗin gwiwar tsaro da suka dace da su. Na farko yana samar da buƙata da aka toshe lokacin da wani abu ba ya cikin jerin, yayin da na biyu yana samar da haɗi wanda ko yana ɗauke da kariyar da ake buƙata ko kuma ba ya kafuwa. Ɗaukar ɗaya a matsayin ɗayan shine yadda manufa ke ƙarewa ba tare da toshe wani abu ba ko ba tare da kare wani abu ba.

Sakamakon a aikace shine jerin tacewa saiti ne a rufe. Da zarar an sami jeri a kan bayanin, zirga-zirgar da ke kan wannan interface da ba ta dace da wani shiga ba ana ƙin ta, don haka DNS, musayar tabbatarwa da duk wata dogaro da manhajar ke buƙata suna buƙatar shigarsu. Ƙara wata ƙa'ida mai faɗi don yin shiru da ƙin suna sake buɗe duk interface ɗin kuma a hankali yana soke takaitawa. Jerin ya kamata ya kasance gajere kamar yadda buƙatar ta yarda kuma cikakke kamar yadda manhajar ta buƙata.

Gina jerin tacewa a matsayin cikakken saiti

Bayanan VPNv2 suna ɗauke da jerin tacewa dabam da jerin hanyoyi, kuma shigarsa kaddarorin bayani ne ba umarni ba. Ga misalin HTTPS shigar tana buƙatar protocol 6, adireshin nesa da tashar nesa, waɗanda ake turawa ta hanyar sarrafawa ko ProfileXML ga nau'in bayanin da ake amfani da shi. ma'anar tacewar zirga-zirgar VPNv2 ta Microsoft ta bayyana cewa sharuɗɗa cikin ƙa'ida ɗaya suna haɗuwa yayin da masu gano ƙa'ida daban ke aiki a matsayin madadin.

TrafficFilterList/0/Protocol            = 6
TrafficFilterList/0/RemoteAddressRanges = 10.60.4.20/32
TrafficFilterList/0/RemotePortRanges    = 443
RouteList/0/Address                     = 10.60.4.0/24

Ƙimar tashoshi a cikin wancan jeri suna bayyana tashar sabis a ƙarshen nesa, kuma tashar gida ya kamata ta kasance ba takaitacce don kada a tace tashar tushen wucin gadi ta abokin ciniki. Yin haka a kife yana samar da ƙa'ida da ba ta dace da kome ba da wuyar warwarewa da ke ɗaukar rana.

Rubuta hanya da tacewa a matsayin shawarwari biyu daban. Hanya tana yanke shawara cewa ana isa wannan uwar garke ta rami, kuma tacewa tana yanke shawara wace sabis za ta iya amfani da wannan hanya.

Tabbatar da sakamakon biyu da buƙatu biyu

Gwada kwararar da aka yarda da kwararar da aka ƙi dabam, kuma karanta gazawa maimakon shafin da ya ɓace. Ƙin da ke zuwa da sauri shawarar manufa ce, yayin da ƙarewar lokaci ya fi yiwuwa hanya da ta ɓace ko sabis da ba ya saurara. Umarnin da ke ƙasa suna gudanar da buƙatun biyu kuma suna nuna ƙa'idodin da ke aiki.

Test-NetConnection 10.60.4.20 -Port 443
Test-NetConnection 10.60.4.20 -Port 445
Get-NetIPsecRule -DisplayName *Vpn*
Get-VpnConnection -Name Corp

Ƙin da sauri a gwajin SMB tare da nasarar gwajin HTTPS shine sakamakon da tacewa ya kamata ta samar. Ƙin a tashoshi biyu yana nufin jeri ya rasa wani abu da zaman ke buƙata, kuma ƙarewar lokaci a biyu yana nuna hanya maimakon tacewa. Idan kwararar da aka kare suna nuna babu haɗin gwiwar tsaro a fitowar IPsec, buƙatar kariya ba ta cika ba ko da haɗin ya yi nasara. Karanta fitowar huɗu tare, domin kowace ita kaɗai tana goyon bayan labari daban.

Yi rikodin bayanin da ke aiki, saitin ƙa'idoji da manufar ɗayan tare da sakamakon. Tarihin bayanin jituwa game da tsofaffin abokan ciniki na Windows ba ya bayyana abin da fasalulluka na bayanin da ake sarrafawa a yau ke tallafawa a wata ƙofa. Halin da ya danganta da sigar ya kamata ya kasance cikin rikodin ba cikin zato ba.