Kuskuren uwar garken DNS a cikin Windows VPN: awo, jeren haɗi ko ƙari

Windows abokin ciniki na iya samun rami mai aiki, ya ɗauki mai warwarewar kamfani, sannan ya ci gaba da aika sunaye na ciki zuwa na'urar gyaran gida. Hanyoyi uku daban-daban suke yanke shawarar wane uwar garke zai amsa, kuma suna kasawa a hanyoyi daban-daban. Ba sai ka gyara dukan ukun ba: alamar cutar ce ke gaya maka wanda ke cikin wasa. Bishiyar shawara da ke ƙasa tana ɗaukar minti kaɗan kuma tana hana sakamakon da aka saba, inda canjin awo, sake jera rajista da ka'idar NRPT suka sauka tare kuma babu wanda ya san wanene ya yi wani abu.

Hanyoyi uku suke yanke shawara, kuma yawanci ɗaya ba daidai ba ne

Awo na fuska yana jera adaftoci don wani gidan adireshi. Jeren haɗi ƙarƙashin Tcpip\Linkage lissafi ne na dukan na'urar na gane-gamen fuska wanda tsofaffin hanyoyin lissafi har yanzu suna duba. Tebur na Manufar Warware Suna (NRPT) yana ɗaure sararin suna da takamaiman uwar garke, kuma lissafin ƙari yana yanke shawarar ko za a faɗaɗa ɗan gajeren suna kwata-kwata. Ba su dogara da juna, shi ya sa ingantaccen mai warwarewa a adaftar VPN ke shan kashi a gaban zaɓi marar sabo a wani wuri.

Babu ɗaya daga cikin waɗannan hanyoyin da yake ɓangaren da ke hayin rami. Idan uwar garken da VPN ke turawa ba za ta iya warware sunan ba, kowane saiti a ɓangaren abokin ciniki ado ne kawai, don haka shawara ta farko ita ce ko mai warwarewar da kansa zai iya amsa idan an tambaye shi kai tsaye.

Shawara ta ɗaya: shin mai warwarewar da aka tura zai iya amsa kwata-kwata?

Tambayi uwar garke kai tsaye ka kwatanta da bincike na yau da kullum. Tazarar da ke tsakanin amsoshin tana raba matsalar zaɓi daga matsalar isa, kuma ita ce reshe mafi sauri a nan:

Resolve-DnsName intranet.corp.example -Server 10.20.0.10 -Type A
Resolve-DnsName intranet.corp.example -Type A

Idan na farko ya yi nasara kuma na biyu ya kasa, mai warwarewar yana isa kuma Windows yana zaɓe mara kyau; je ga shawarwarin sararin suna da tsari da ke ƙasa. Idan na farko ma ya kasa, babu abin da zai taimaka a abokin ciniki: duba ko UDP da TCP 53 suna isa uwar garke ta ramin, ko babu wutar bango ta baƙo a uwar garke da ke zubar da tafkin, kuma ko masu tura na uwar garken kansu suna cikin lafiya.

Tsaya a wannan reshe. Amfani da ka'idar NRPT a kan mai warwarewar da ba za ka iya isa ba yana haifar da irin wannan gazawa da ƙarin saitin da za a janye, kuma yana ɓoye ainihin kuskure a bayan ka'idar da ke kama da mai iko.

Shawara ta biyu: sararin suna ɗaya, ko kowace tambaya?

Iyaka ce ke yanke shawarar kayan aiki. Lokacin da sunayen kamfani kaɗai ke kasawa, ɗaure sararin sunan maimakon sake jera na'urar: ka'idar NRPT tana tura wannan ƙarin zuwa mai warwarewar rami kuma ta bar kome da kome. Lokacin da kowace bincike ta shafa, matsalar ita ce fifikon adafta na duniya, kuma awo shine wurin da za a fara domin ba ya canza wani saitin uwar garke.

Saita awo ga kowane gidan adireshi, a dukkan fuskoki biyu, sannan ka tabbatar da tsarin bayan haka:

Get-NetIPInterface | Select-Object ifIndex, InterfaceAlias, AddressFamily, InterfaceMetric
Set-NetIPInterface -InterfaceIndex 11 -InterfaceMetric 1 -AddressFamily IPv4
Set-NetIPInterface -InterfaceIndex 11 -InterfaceMetric 1 -AddressFamily IPv6

Maye gurbin 11 da ifIndex na adaftar rami daga layin da ke sama; idan 11 ita ce adaftar LAN, wannan umarni ɗaya yana saukar da hanyar da ba daidai ba. Ɗaga adaftar LAN a maimako yana kaiwa ga irin wannan tsari daga ɓangaren daya: netsh int ip set interface interface="Ethernet" metric=15, kuma netsh int ipv6 set interface interface="Ethernet" metric=15 ga gida na biyu, domin int ip yana taɓa IPv4 kawai.

Jeren haɗi shine makoma ta ƙarshe ba mataki na farko ba. HKLM\SYSTEM\CurrentControlSet\Services\Tcpip\Linkage yana riƙe da lissafin Bind na gane-gamen na'urori, kuma matsar da gane-gamen rami zuwa gaba yana canza wace adafta ake tambaya da farko, amma darajar rajista ce ta dukan na'urar ba tare da iyaka ga kowane sararin suna ba. Fitar da ita kafin gyara sannan ka sake haɗa ramin bayan haka domin tsarin ya yi aiki a yanayin da abokin ciniki yake tsammani.

Don sararin suna ɗaya, fifita kayan aiki mafi ƙunci:

Add-DnsClientNrptRule -Namespace ".corp.example" -NameServers 10.20.0.10
Get-DnsClientNrptRule | Select-Object Namespace, NameServers

Shawara ta uku: shin gyaran zai jure sake haɗi?

Awo da ke aiki har sai an sake haɗi na gaba ta waya ba a taɓa adana shi ba. L2TP/IPsec da sauran bayanan haɗi ana sake ƙirƙira su lokacin da haɗin ya fara, don haka adanar darajar tana rayuwa a cikin shigarwar littafin waya a matsayin IpInterfaceMetric, ba a kan fuskar da ke raye kawai ba. Wasu muhalli suna rubuta wannan filin da script saboda wannan dalili; wasu suna tura fifiko daga manufar gudanarwa kuma suna barin ƙarshen shi kaɗai.

Cache da rijista wani layer daban ne. Gudanar da waɗannan bayan ramin ya tashi yana gyara tsoffin shigarwari kuma yana sake rijista abokin ciniki, amma babu ɗaya da ke sake jera adafta:

ipconfig /registerdns
ipconfig /flushdns

Akwai maɓallin kashewa a cikin wannan layer. Kashe rijista mai motsi a kan adaftar jiki yana hana abokin ciniki tallata adireshinsa na ɓangaren VPN a ƙarƙashin sunan da ba daidai ba, wanda wani gyara ne daban da sabuntawar da ke sama.

IPv6 ya cancanci nasa layi a cikin shawarar. Idan adaftar jiki tana da adireshin IPv6 na duniya yayin da rami ke ɗauke da IPv4 kawai, Windows na iya fifita hanyar da ba ta rami ba don warware suna. Duba wannan gida daban, domin awo da aka saita don IPv4 ba ya faɗin kome game da shi:

Get-NetIPInterface -AddressFamily IPv6 | Select-Object ifIndex, InterfaceAlias, InterfaceMetric

Kashe IPv6 a kan adaftar LAN yana cire wannan hanya da ka'idar tare da ita; canjin awo a fuskar IPv6, ko ka'idar NRPT don sararin sunan kamfani, yana riƙe gidan kuma yana gyara fifikon. Zaɓi mafi ƙunci sai dai idan ka yanke shawarar cewa wannan mahada bai kamata ya sami IPv6 ba.

Tabbatar da tushen da aka ambata, kuma ka riƙe mai shi ɗaya

Tabbatar da kayan aiki da ke ba da rahoton wane tushe ke aiki, ba kawai ko shafi yana lodawa ba:

ipconfig /all
Get-DnsClientServerAddress -AddressFamily IPv4
Resolve-DnsName fileserver.corp.example -Server 10.20.0.10 -Type A

Sannan ka raba tacewa daga zaɓi, domin daga cikin manhaja suna kama da juna. block-outside-dns na OpenVPN yana toshe tashar 53 a sauran adaftoci; ba ya zaɓar mai warwarewa. Idan yanzu kowace tambaya ta kasa, mai tacewa na iya toshe uwar garken da za a iya isa gare ta kawai; idan ana watsi da mai warwarewar da aka saita, tsarin ko ka'idar sararin suna ba daidai ba ne. Canza duka biyu lokaci ɗaya yana sa tambayar da aka toshe da tambayar da aka watsi ba za a iya bambanta su ba.

Riƙe mai shi ɗaya don manufar DNS: bayanin VPN, manufar gudanarwa, ko ka'idar NRPT, ba biyu daga cikinsu ba. Kafin ka rufe shi:

• Mai warwarewar da aka tura yana amsa idan an ambace shi kai tsaye, kuma bincike na yau da kullum yana amfani da shi.
• Ka'idar ko awo da ka canza yana rufe gidan adireshin da ke ɗauke da tambayoyin a zahiri.
• Saitin yana jure katsewa da sake haɗi, ko ka matsar da shi cikin bayanin da aka adana.
• Daidai hanyar ɗaya ce mai iko, kuma an bar sauran yadda suke.

Ɗauki tsarin a matsayin yanayin muhalli ba abin da za ka kammala ba. Sake duba shi bayan sake haɗi da bayan sabuntawar Windows da ke taɓa tarin hanyar sadarwa, domin kowane ɗaya daga cikinsu na iya mayar da adaftar jiki gaba.