WSL2 ba ya gādon VPN na kamfani, kuma wannan shine kuskuren
WSL2 yana aiki a cikin nasa cibiyar sadarwar kama-da-wane kuma ba ya gādon tarin VPN na mai masaukin. Raba gazawar sunaye daga gazawar hanya kafin ka gyara resolv.conf.
Wurin wiki na cikin gida yana buɗewa a Edge, yayin da git clone a cikin rarraba yana ƙarewa da lokaci. Wannan ganewar ɗaya galibi ana karanta shi a matsayin «VPN yana toshe WSL2», kuma sa'a mai zuwa tana tafiya wajen gyara /etc/resolv.conf. Karatun da ya fi amfani shi ne cewa WSL2 bai taɓa samun hanyar sadarwar mai masaukin ba: yana aiki a cikin VM na taimako da nasa adafta, nasa hanyoyi da fayil ɗin resolver da Windows ke ƙirƙira masa. Duk abin da ya biyo baya ya dogara da wanne daga cikin waɗannan uku kuke rasa.
VM ɗin yana da nasa tarin, ma'auni da resolver
A yanayin NAT na asali, rarrabar tana bayan maɓalli na kama-da-wane kuma tana isa intanet ta hanyar mai masauki, amma ba ta ganin adaftan mai masaukin. ip addr yana nuna mu'amala ɗaya da adireshi mai zaman kansa, ip route yana nuna hanyar asali ta wannan maɓallin, kuma /etc/resolv.conf fayil ne da aka ƙirƙira wanda ke nuni ga stub resolver da Windows ya zaɓa. Babu ɗaya daga cikin waɗannan da ke canzawa saboda abokin ciniki na VPN ya tashi a ɓangaren Windows.
Shi ya sa «burauza yana aiki» ke tabbatar da kaɗan. Burauza yana amfani da tarin mai masauki, rami da manufar resolver na mai masauki. Shell ɗinka yana amfani da wani tarin daban wanda kwatsam yake raba katin cibiyar sadarwa na zahiri. Suna daidaitawa a yanayi mai kyau kuma suna bambanta daidai lokacin da VPN ya sanya tacewa, ya sake rubuta jerin DNS ko ya ƙara hanya ga ɓangaren maɓallin kama-da-wane.
Gwaje-gwaje biyu ne ke yanke shawara a wace duniya kake, kuma dole ne a gudanar da su a cikin rarrabar:
getent hosts example.com
curl -sS -m 8 -o /dev/null -w "%{http_code}\n" 1.1.1.1
ip route
cat /etc/resolv.confGazawar sunaye yayin da adireshi na zahiri ke amsawa matsalar resolver ce. Gazawar sunaye da adireshi tare matsalar hanya ce, kuma babu wani gyaran resolver da zai taɓa ta. Shaida daga ɓangaren Windows ita ce ta gaba: Get-NetAdapter | Get-DnsClientServerAddress da route print -4 suna nuna ko ramin ya karɓi ɓangaren da VM ɗinka yake zaune.
Ƙarya ta farko: sabar DNS na kamfani suna gyara shi
Gyara fayil ɗin resolver shine shawara ta gargajiya, kuma tana daidai kusan rabin lokaci. Lokacin da ta yi daidai, ta yi daidai saboda takamaiman dalili: fayil ɗin da aka ƙirƙira yana nuni ga resolver wanda ya san sunayen jama'a kawai, don haka tambaya ga intranet.example.internal tana dawowa a matsayin babu shi ko da hanya tana lafiya.
Manne sabar VPN yana nufin dakatar da Windows daga sake ƙirƙirar fayil ɗin, domin duk fayil da ka rubuta da hannu ana maye gurbinsa a farkon na gaba:
[network]
generateResolvConf = falseAjiye wannan a matsayin /etc/wsl.conf, gudanar da wsl --shutdown daga Windows, sannan fara rarrabar kuma rubuta /etc/resolv.conf tare da sabar ramin farko da resolver na jama'a kawai a matsayin madadi. Wannan canji ne mai dorewa tare da kuɗin kulawa: fayil ɗin baya bin mai masauki kuma, don haka lokacin da adireshin DNS na kamfani suka canza rarrabar tana ci gaba da tambayar tsofaffin. Dole ne wani ya mallaki wannan fayil.
Ba ya yin komai kuma lokacin da gazawar ta fi girma. Idan curl zuwa 1.1.1.1 ya ƙare da lokaci, abokin ciniki na rami yana tace maɓallin kama-da-wane ko yana tura ɓangaren VM cikin rami, kuma ingantaccen resolver yana ba ka sunayen da har yanzu ba za a iya isa su ba.
Ƙarya ta biyu: canjin ma'auni yana dawwama
Lokacin da sunaye ke warwarewa amma zirga-zirga yana fita ta adaftar zahiri, ma'aunin mu'amala shine leda. Ba VPN adafta kuɗi mai yawa kuma ba WSL maɓalli kaɗan:
Get-NetAdapter | Where-Object InterfaceDescription -Match "AnyConnect" | Set-NetIPInterface -InterfaceMetric 4000
Get-NetIPInterface -InterfaceAlias "vEthernet (WSL)" | Set-NetIPInterface -InterfaceMetric 1Sannan ka tuna cewa a yawancin gine-ginen abokin ciniki ana sake ƙirƙirar adaftar rami a kowace haɗi kuma ma'aunin yana komawa ga tsohowarsa. Umarni na lokaci ɗaya gyara ne da ke ƙarewa a shiru, galibi cikin ƙarshen mako, kuma tikit ɗin yana dawowa da «yana aiki a makon da ya gabata». Aikin da aka tsara da ke tashi da taron VPN, ko rubutun da mai amfani ke gudanarwa bayan haɗi, shine gaskiyar sigar wannan gyaran.
Irin wannan ƙarewa tana aiki ga hanyoyin mai masauki da aka ƙara don prefix ɗaya mai taurin kai. Suna da amfani a matsayin bincike, domin suna gaya maka ko matsalar manufa ɗaya ce ko dukan hanya, amma ba gine-gine ba ne.
Ƙarya ta uku: gyara ɗaya yana rufe kowane ginin Windows
| Approach | What it actually does |
|---|---|
| Resolver pin | Fixes private names only; no effect on path failures |
| Sidecar distribution | Forwards traffic over a socket to a helper VM, so the switch's filter no longer matters |
| Mirrored networking | Gives the distribution the host's interface set; also enables DNS tunnelling |
wsl-vpnkit shine tsarin sidecar: ƙaramin rarraba yana mallakar hanyar ɓangaren mai masauki kuma yana tura wa sauran rarrabu ta hanyar soket na kama-da-wane, don haka zirga-zirgar aikace-aikace ta daina dogaro da maɓallin da aka tace. Yana buƙatar hanyar asali ta yi aiki, wato cire abubuwan da suka wuce networkingMode da dnsTunneling daga %UserProfile%\.wslconfig, dawo da generateResolvConf = true a kowace rarraba mai aiki da fara sabis ɗin a lokacin shiga.
Yanayin madubi shine zaɓi na gida a Windows 11 22H2 da baya, kuma saiti ɗaya ne da kashewa:
[wsl2]
networkingMode=mirroredA cikin rarrabar ip addr sannan yana lissafin adaftan mai masauki, ramin na iya bayyana a tsakaninsu, kuma tunnel ɗin DNS yana tura tambayoyi ta resolver na Windows ko da abokin ciniki ya sake rubuta jerin DNS. Ba duniya ba ne: wasu direbobin tacewa har yanzu suna watsar da hanyar madubi, kuma dokokin wutar Hyper-V na iya buƙatar izini bayyananne. Jagoran cibiyar sadarwa na WSL na Microsoft shine shafin da za a duba da gininka kafin amfani da girke-girke da aka rubuta don sabo.
Gwada abubuwa uku bayan kowane canji
Zaɓi tsari ɗaya ga kowace na'ura kuma rubuta shi, domin biyun suna haɗuwa mara kyau. Sidecar a saman yanayin madubi yana ninka turawa, kuma mai masaukin madubi mai tsohuwar shigar sidecar a .wslconfig yana son gazawa bayan haɓakawa ba kafin ba.
Duk abin da ka zaɓa, gwajin karɓa shine buƙatun uku ɗaya a cikin rarrabar: sunan ciki, sunan jama'a da adireshi danye. Sannan maimaita su bayan cirewa da sake haɗa ramin, da bayan wsl --shutdown. Gazawar sunan ciki shi kaɗai yana nufin manufar resolver; gazawar sunan ciki da na jama'a tare da adireshi mai aiki har yanzu yana nufin manufar resolver; gazawar komai yana nufin hanya.
Idan mai masauki ɗaya na ciki ya gaza yayin da sauran ke aiki, daina kallon resolver ka nemi hanyar da ta ɓace ga wannan prefix. Idan komai yana aiki har zuwa sake haɗi na gaba, ka sami gyaran da ya dogara da yanayin lokacin gudana, kuma dole ne a sake amfani da shi kai tsaye ko a maye gurbinsa da ɗaya daga cikin hanyoyin biyu na sama.