Sida loo hubiyo waxa VPN-ka Windows dhab ahaan u maraysto PowerShell
Tile VPN oo ku xiran ma caddeeyo daboolka. Akhri calanka profile-ka la kaydiyay, shaxda waddooyinka nool iyo xeerarka NRPT sidan.
Waxaan ku xidhay macmiilka VPN laptop Windows 11 ah, tile-kii wuxuu u gudbay Connected, wadaag fayl gudaha ah ayaa furmay, oo site dadweyne ayaa weli si toos ah uga soo rarayay Wi-Fi-ga xafiiska. Isku darkaas wuxuu u eg yahay tunnel jaban. Laakiin waa natiijada caadiga ah ee profile-ka qaar ka mid ah taraafikada u dira VPN-ka oo inta soo hadhay ku reeba adapter-ka jireed. Tunnelling qasban waxay beddeshaa waddada caadiga ah ee Windows doorbido; ma tirtirto waddooyin gaar ah oo ma ballanqaaddo in taraafikadu istaagi doonto marka xiriirku go'o. Waxa soo socda waa nidaamka aan raaco marka macmiilku sheego dabool: xaaladda macmiilka, profile-ka la kaydiyay, waddooyinka la dabaqay, xalliyaha, ka dib qulqullada dhabta ah.
Ka bilow macmiilka, ka dib jooji isku halaynta isaga
Macmiilku waa goobta saxda ah ee laga bilaabo kaliya sababtoo ah wuxuu kuu sheegaa profile-ka firfircoon. Fur sifooyinka xiriirka oo qor magaca saxda ah ee profile-ka, haddii loo abuuray isticmaalaha hadda ama qof kasta oo ku jira mishiinka, iyo adapter-ka soo muuqda ncpa.cpl kadib xiriirka. Laptop-kayga tijaabada adapter-ku wuxuu siday magaca profile-ka, taas oo ka dhigtay soo-saarka waddooyinka mid sahlan in la akhriyo. Mishiinada kale wuxuu u soo baxaa sidii gelitaan WAN Miniport oo magacu waxba kuuma sheego.
Waxa macmiilku kuu sheegi karin waa daboolka. Tile ku xiran wuxuu qeexaa xaaladda tunnel-ka, ma aha liiska meelaha loo socdo. Macmiillada dhinac saddexaad waxay sidoo kale hayaan qaab-dhismeedkooda, sidaas darteed profile-ka asalka ah ee Windows, iyo sifo kasta oo aad ka akhrido, waxaa laga yaabaa in aanay wax xiriir ah la lahayn waxa macmiilkaas rakibay. Haddii VPN-ku yimid AnyConnect, OpenVPN GUI, WireGuard ama wakiilka iibiyaha, hubinta PowerShell ee hoose inta badan ma khuseeyso oo waa inaad akhrido dejinta split-tunnel iyo waddooyinka macmiilkaas.
Akhri profile-ka la kaydiyay, ma aha tile-ka
Profile-ka asalka ah ee Windows (IKEv2, L2TP, SSTP ama mid MDM riixay) go'aanka split-tunnel ee la kaydiyay waa hal sifo:
Get-VpnConnection -Name 'Office' | Select-Object Name, ServerAddress, SplitTunneling, DnsSuffixKu dar -AllUserConnection marka profile-ka loo abuuray qof kasta oo qalabka ku jira. La'aanteed waxaad akhrinaysaa liiska isticmaalaha hadda, oo laga yaabo inuu madhan yahay ama uu hayo gelitaan kale oo magac la mid ah. Qiimaha False ee SplitTunneling waxay ka dhigan tahay in profile-ka loo kaydiyay tunnel buuxa: Windows wuxuu rakibaa waddo caadi ah oo maraysa adapter-ka VPN. True waxay ka dhigan tahay split tunnel, daboolkuna markaas wuxuu si buuxda ugu tiirsan yahay waddooyinka iyo xeerarka xallinta magacyada ee profile-kaas riixayo.
U qaado qiimahaas qaab-dhismeed ahaan, ma aha indho-indheyn. Wuxuu diiwaangeliyaa waxa profile-ku codsaday waqtiga xiriirka. Windows waxaa laga yaabaa inuu ku dhammaado waddooyin la dabaqay oo kala duwan, sababtoo ah waddo gaar ah oo interface kale, dejinta siyaasad ama gelitaan hadhay oo xiriirkii hore, sidaas darteed Boolean-ku kaligiis ma xalliyo su'aasha.
Isbarbar dhig qiimaha la kaydiyay iyo shaxda waddooyinka la dabaqay
Xiriirka kadib, liiso waddooyinka adapter-ka tunnel-ka halkii aad ka rogi lahayd shaxda oo dhan:
$vpn = Get-NetAdapter | Where-Object InterfaceDescription -match 'VPN|WAN Miniport'
Get-NetRoute -InterfaceIndex $vpn.ifIndex | Sort-Object DestinationPrefix
Find-NetRoute -RemoteIPAddress 10.20.4.15 | Select-Object -First 1Find-NetRoute waa qaybta faa'iidada leh. Waxay ka jawaabtaa su'aasha macmiilku waligiis ka jawaabin: meeshan loo socdo, interface kee iyo ciwaanka isha kee ayuu Windows dhab ahaan isticmaali doonaa? Ku socodsii host gudaha ah, host dadweyne ah iyo wax kasta oo aad u aragto inuu yahay ka-bax ula kac ah. Profile tunnel buuxa waa inuu muujiyaa interface-ka tunnel-ka ciwaanka dadweynaha. Profile split tunnel wuxuu halkaas inta badan muujiyaa adapter-ka jireed halka horgalayaasha gudaha weli loo xalliyo VPN-ka.
Laba dabin ayaa sharraxaya inta badan warbixinnada «wuxuu u maraa jiho khaldan». Horgalka ugu gaar ah ayaa had iyo jeer guuleysta, sidaas darteed /24 ku yaal adapter-ka jireed wuxuu ka adkaadaa waddo caadi ah oo VPN-ka ah si kasta oo mitirka tunnel-ku hooseeyo. Mitirku wuxuu kaliya go'aamiyaa isle'eg ka dhexeeya waddooyinka isla horgalka. Iyo IPv4 iyo IPv6 si gooni ah ayaa loo go'aamiyaa: profile daboolaya 0.0.0.0/0 wuxuu IPv6 kaga tagi karaa link-ga maxalliga ah, taas oo site laba-stack ah ka dhigta mid badh-tunnelaysan u eg. Kahor intaadan soo gabagabeyn in tunnel-ku wanaagsan yahay, hubi Get-NetRoute -AddressFamily IPv6.
| What you see | Most likely cause | Check next |
|---|---|---|
| Public traffic leaves the physical adapter while SplitTunneling reads False | A more specific route on that adapter wins over the tunnel default | Find-NetRoute for the exact destination, then look for a /24 or host route on the physical interface |
| Internal name fails, internal IP works | No NRPT rule for that namespace, or a broader rule matches first | Get-DnsClientNrptPolicy and the namespace order |
| A dual-stack site opens directly while IPv4 uses the tunnel | The profile covers only the IPv4 default route | The IPv6 route table on both interfaces |
| Routes look right but one app still goes direct | The app uses its own proxy, or the client keeps a per-app list | The app's proxy settings and the client's application list |
Xallinta magacyada si gooni ah u hubi NRPT
Magacyada gudaha ee guuldarraysta halka ciwaannada IP gudaha ay shaqeeyaan waxay tilmaamayaan siyaasadda xalliyaha, ma aha waddooyinka. Windows wuxuu go'aamiyaa DNS space kasta oo magac ah isagoo isticmaalaya shaxda siyaasadda xallinta magacyada, oo ka madax bannaan shaxda waddooyinka:
Get-DnsClientNrptPolicy -Effective | Select-Object Namespace, NameServers
Get-DnsClientServerAddress -InterfaceIndex $vpn.ifIndexMarka xeer ku beegan yahay *.corp.example, weydiimaha space-kaas magac waxay u tagaan server-yada DNS ee tunnel-ka xitaa haddii waddada xogta ee server-yadaas ay ku sii socoto adapter-ka jireed qaabka split tunnel. Taasi waa naqshadda, sababtaas darteedna imtixaan browser oo fura site dadweyne waxba kuma sheego magacyada gudaha. Haddii adapter-ku liisto server-yada la filayay laakiin raadinta weli meel kale u socoto, isbarbar dhig nidaamka xeerarka NRPT oo hubi in space magac gaar ah uu marka hore beegmo.
Xaqiiji qulqullada, ka dib go'aami waxa aad dhab ahaan codsatay
Ku mar meelaha loo socdo nidaam go'an si natiijooyinku u noqdaan kuwo la isbarbar dhigi karo mishiinada: ciwaan dadweyne, ciwaan gudaha, magac gudaha iyo hal ka-bax ula kac ah sida printer maxalli ah ama wicitaan fiidiyoow. Qor interface-ka iyo ciwaanka isha ee Find-NetRoute soo celiyo mid kasta. Kadib isbeddel kasta oo siyaasad, dib u xiriir oo ku celi isla afarta hubin; shaxda waddooyinka kadib dib-u-xiriirka ayaa ah caddaynta kaliya ee ah in profile-ka cusub dhaqan galay.
Kadib kala sooc waddooyinka iyo fulinta. Tunnelling qasban wuxuu doorbidaa tunnel-ka taraafikada daboolan inta uu kor yaal. Ma aha kill switch. Haddii shuruuddu tahay in waxba aanay ka bixin mishiinka marka tunnel-ku dhaco, taasi waa inay ka timaaddo naqshad xannibaysa: profile firewall oo ku xiran xaaladda tunnel-ka, profile had iyo jeer shidan oo leh shaandheeyayaal taraafik, ama ikhtiyaarka xiritaanka-marka-guuldarraysta ee macmiilka iibiyaha. Tunnelling qasban sidoo kale waa inuu ka tago ciwaanka server-ka VPN laftiisa mid laga gaari karo tunnel-ka dibaddiisa, xannibaadiisana magaca «qasab wax walba» waa dariiqa lagu kalsoonaan karo ee aad ku xidhanto xiriirka aad isku dayeyso inaad fuliso.
Kahor intaadan wax beddelin, ku mar liiskan. Shay kasta oo guuldarraysta wuxuu cidhiidhiyaa halka dhibaatada dhabta ah ku taal.
- Magaca iyo baaxadda profile-ka la xaqiijiyay,
-AllUserConnectionloo isticmaalay profile-yada mishiinka oo dhan. SplitTunnelingla akhriyay oo loo qaatay qaab-dhismeed, ma aha caddayn dabool.- Waddooyinka adapter-ka tunnel-ka si gooni ah loo liistay IPv4 iyo IPv6.
Find-NetRouteloo socodsiiyay hal meel dadweyne, hal gudaha iyo hal ka-bax.- Xeerarka NRPT la hubiyay kahor inta aan waddooyinka lagu eedeyn guuldarrada magaca.
- Shuruudda xannibaadda dib loo akhriyay: waddooyinka la doorbiday ma aha isku mid xannibaadda la fuliyay.
Go'aanka tunnel buuxa ama split wuxuu leeyahay mulkiilaha profile-ka, oo qoraallada waddooyinka Microsoft waxay sharraxaan dhaqanka Windows u fuliyo marka profile-ku dejiyo. Microsoft: tunnelling qasban iyo split waa tixraaca aan furan hayo inta aan akhrinayo soo-saarka.