Firewall-ku ma xannibayaa VPN-ka? Hubin tallaabo tallaabo ah

Hal waqti-dhaaf VPN ah wuxuu caddeeyaa in aan la helin jawaab la isticmaali karo, waxna kama caddaynayo sababta. Profilku wuxuu sheegi karaa deked khaldan, serverku wuu xirnaan karaa, ama codsigu wuxuu iman karaa isagoon lahayn waddo soo-noqod shaqaynaysa. Mid kasta oo ka mid ah wuxuu ka taga raad ka duwan, raadkaana waa kan kuu sheegaya sharciga aad taabato. Soco afarta tallaabo ee hoose si taxane ah. Iso jooji isla markii midkood calaamadda sharraxay.

Tallaabada 1: xaqiiji serverka iyo gaadiidka

Akhri magaca serverka, gaadiidka iyo dekedda profilka hadda ee hawlwadeenka, ee kama akhri beddel maxalli ah. Deked lagu beddelay kombuyuutarkaaga ma abuuri karo dhegeyste server dadweyne ah, isma-aannaantaasina waxay soo saartaa waqti-dhaaf la mid ah xannibaadda. Haddii profillku bixiyo gaadiid kale oo la taageeray, u qor sidii beddelka halkii aad u qori lahayd xal. Xalliso magaca oo la barbardhig jawaabta cinwaanka hawlwadeenku daabacay.

Diiwaan DNS duugoobay wuxuu macmiilka u dirayaa martigeliyaha aan waligiis jawaabin. Taana waa cillad kale oo matalaysa shaandheyn, oo ka reebisteedu waxay qaadanaysaa hal weydiin.

Qor labada qiime tigidhka. Barbardhig kasta oo dambe ayaa isticmaala, tigidh la'aantoodna wuxuu dib u bilaabaa baaritaanka.

Tallaabada 2: caddee wadada hal barbardhig la kontoroolay

Ka tag qalabka iyo profilka isbeddel la'aan oo isku day shabakad kale oo la aamini karo. Haddii tunnel-ku halkaas kor u kaco, farqi waa wadada asalka ah ama siyaasadeeda. Haddii qalab labaad oo la ansixiyay ku shaqeeyo shabakadda asalka ah, farqi waa qalabka kowaad. Mid ka mid ah labadan barbardhig ayaa had iyo jeer go'aansan.

Marka hore dhammee gelitaan shabakadeed sharci ah, sababtoo ah portal qafilan wuxuu u eg yahay xannibaad ilaa la dhammeeyo.

Tijaabi dekedda aad dhab ahaan isticmaasho, oo natiijada TCP u qaado sidii macluumaad ku saabsan TCP oo keliya.

Resolve-DnsName vpn.corp.example
tracert -h 8 -w 500 vpn.corp.example
Test-NetConnection vpn.corp.example -Port 443 -InformationLevel Detailed

Gacan-qaadasho TCP oo guulaystay dekedda 443 waxay ka dhigan tahay in dhegeyste halkaas ka jawaabay. Wax ma sheegayo dhegeystaha UDP ee 51820, iyo sidoo kale ma sheegayo haddii wada-hadalku dhammaaday.

Tallaabada 3: akhri dhacdooyinka amniga ee xilliga guuldarada

Dhacdooyinka firewall-ku waa caddaynta ugu xoogga badan ee la heli karo, waxayna wataan digniin ay mudan tahay in marka hore la sheego. Diiwaangelintu waa dammaan yihiin profilo badan oo caadi ah, marka hubi haddii profillka la xiriira uu diiwaangeliyo tuurista ka hor inta aadan akhrin diiwaan madhan sidii caddayn aan waxba galabsan. Marka diiwaangelintu shidantahay, dhacdadu waxay sheegtaa sharciga, jihada iyo cinwaannada, taas oo si sax ah u tahay waxa beddelka sharci u baahan yahay. Sharciyada codsiga iyo sharciyada dekedda waa walxo gaar ah, siyaasad maamulan ayaa ka sarraysiin karta dejinta maxalliga ah. Xaqiiji macmiilka iyo adeegga uu sharci dhab ahaan daboolayo.

Soo aruuri xaaladda profilka iyo dhacdooyinka dhawaa mishiinka guuldarraystay, ee kama soo aruuri martigeliyaha deriska ah.

La barbardhig waqtiga dhacdada waqtiga isku-daygaaga tijaabada, sababtoo ah magac sharci oo iswaafaqsan oo leh shaabaddii waqti kale waa shil.

Get-NetFirewallProfile | Select-Object Name, Enabled, DefaultInboundAction, LogBlocked
Get-NetFirewallRule -Enabled True -Direction Outbound | Where-Object DisplayName -match 'VPN'
Get-WinEvent -LogName 'Microsoft-Windows-Windows Firewall With Advanced Security/Firewall' -MaxEvents 20

Serverka aad maamusho, weydii haddii codsigu uu gaadhay dhegeystaha. Baakidh yimaada isagoon jawaab lahayn waa mushkilad gudbin ama waddo soo-noqod. Codsiga aan waligiis soo muuqan waa mushkilad shaandheyn ama cinwaaneyn.

Tallaabada 4: tijaabi gudbinta ka dib marka tunnel-ku kaco

Firewall-ku wuxuu ogolaan karaa kulanka oo weli diidi karaa wax kasta oo kulanku rabo inuu gaadho. Sysctl gudbin, sharciyada NAT iyo waddooyinka soo-noqodka dhammaantood waxay ka dambeeyaan xaqiijinta, ka-tagista ballaaran ee dekedda VPN midkoodna ma hagaajiso. Tijaabi hal meel oo gudaha ah iyo hal meel oo internet ah si gooni gooni ah, sababtoo ah badanaa waxay ku guuldarraystaan sababo kala duwan. Haddii magacyada gudaha ay guuldarraystaan laakiin cinwaannadu shaqeeyaan, eeg DNS la riixay ka hor sharciga.

Ku socodsii saddexda hubin ee hoose serverka inta macmiilku xiran yahay oo isku dayayo codsiga guuldarraysta.

Tiriyayaasha interface-ka tunnel-ka ayaa ah qodobka, sababtoo ah waxay muujinayaan haddii baakidhku soo galay iyo haddii wax baxay.

sysctl net.ipv4.ip_forward
nft list ruleset | grep -n -E 'forward|masquerade'
tcpdump -ni tun0 -c 10

Marka baakidhku yimaado tunnel-ka oo wax u jeedo meesha loo socdo ma baxaan, tuhmanaha waa gudbin ama NAT. Marka waxba yimaadaan, kulanku wuu kacay laakiin macmiilku ma dirayo, meesha la eegona waa shaxda waddooyinka macmiilka.

Hubi hagaajinta oo ka saar waxa aan caawin

Ka dib hagaajin la ansixiyay, ku celi isla tijaabadii guuldarraystay oo qor natiijada isla profilka iyo qalabka. Kadib ka saar wax kasta oo ka-tagid ku meel gaar ah oo aan natiijada beddelin, sababtoo ah ka-tagista aan la isticmaalin way ururaan oo mid kastaa waa go'aan aan cidna xusuusan. Waxa hadhay ku hay cidhiidhi: hal meel, hal deked, hal jihaad, hal milkiile.

Dib u socodsii isla saddexda amar oo la barbardhig natiijooyinka aad kaydsatay ka hor isbeddelka.

Test-NetConnection vpn.corp.example -Port 443 -InformationLevel Detailed
tracert -h 8 -w 500 vpn.corp.example
Get-NetFirewallRule -Enabled True | Where-Object DisplayName -match 'VPN' | Select-Object DisplayName, Action

Marka shabakadda barbardhiggu shaqeyso, shabakadda asalka ah weli guuldarraysato oo dhacdooyinku madhan yihiin, tuhmanaha hadhay waa wadada ee ma aha martigeliyaha. U dhiib milkiilaha shabakadda sidii hadal cad, adigoo lifaaqaya labada natiijood ee barbardhigga. Taasi waa meel ka wanaagsan in lagu istaago profil firewall oo la damiyay.