Soo dejinta profile VPN-ka PowerShell iyadoo la isticmaalayo Add-VpnConnection

Ma jiro cmdlet Import-VpnProfile, oo midda ugu dhow, Add-VpnConnection, waligeed ma akhrido fayl .ovpn ama .conf. Waxa uu ka dhisaa profile Windows asli ah parameters-ka aad ku dhex geliso, taas darteed hubinta koowaad halkan waa qaabka faylka ee ma aha khadka amarka. Haddii gateway-gu ku hadlo SSTP, IKEv2, L2TP/IPsec ama PPTP, Windows ayaa milki kara profile-ka oo liiska intiisa kale khuseeyaa. Haddii lagu siiyay fayl OpenVPN ama WireGuard, ku joogso tallaabada koowaad: macaamiisha laftoodu ayaa milkiya importers-kaas.

Tallaabada 1: Xaqiiji profile-ka Windows si dhab ah u milki karo

Ku socodsii Get-Command -Module VpnClient mishiinka ka hor wax kasta oo kale. Windows 10, Windows 11 iyo Server 2016 ama ka dambeeya waxay leeyihiin module-kan; haddii uu maqan yahay, ma jiro script la koobiyeeyay oo ka dhigi doona host-kan inuu aqbalo profile asli ah. Cmdlets-ka muhiimka ah waa Add-VpnConnection, Get-VpnConnection iyo Remove-VpnConnection, liiska parameters-ka ku yaal tixraaca Add-VpnConnection waxa uu mudan yahay hal akhris oo buuxa.

Asli macnaheedu waa in Windows VPN stack-ku dhammeeyo tunnel-ka. Taasi waxay daboolaysaa IKEv2, inta badan oo leh shahaado kombuyuutar; SSTP, oo ah TLS oo leh xaqiijin isticmaale ama shahaado gudaha; iyo L2TP/IPsec oo leh fure horay loo wadaagay. Faylka .ovpn waa script OpenVPN, ma aha xiriir Windows: waxa uu qaadaa tilmaamo sida remote, cipher ama tls-auth oo Windows stack-ku aanu wax fikrad ah ka lahayn. Faylka .conf ee WireGuard waa isla sheekada oo leh PrivateKey iyo AllowedIPs; mid kan kale u beddelashada ma aha doorasho parameter, balse waa hirgelin tunnel oo kale.

Waxa jira laan saddexaad. Haddii maamule kuu dhiibo dukumeenti XML VPNv2 CSP ama profile Intune, taasi waa jidka MDM, oo uu dabaqo stack-ka provisioning-ka ee ma aha Add-VpnConnection. Ha u turjunin magacyada noodhadhkaas parameters PowerShell; taa beddelkeeda weydii mekanism-ka keeni kara XML-kaas.

Tallaabada 2: Isku lammaan nooca tunnel-ka iyo habka xaqiijinta

-TunnelType iyo -AuthenticationMethod waa parameters gaar ah, oo gateway-gu waxa uu danaynayaa oo kaliya isku-darka. Mid si sax ah u dhig oo kan kalena khalad ka dhig, waxaad helaysaa profile aan meelna ku xirmayn, ama ku hakada iyadoo tunnel-ku hore u kacday. Labadaba si cad u dhig, halkii aad ka aamini lahayd qiimaha caadiga ah ee loo doortay adeeg kale.

• IKEv2 oo leh MachineCertificate: macmiilku waxa uu soo bandhigaa shahaado kombuyuutar; sidoo kale dhig -EncryptionLevel Required.
• SSTP oo leh Eap: marka hore tunnel TLS, ka dib PEAP/MSCHAPv2 ama shahaado gudaha EAP. Tan waxay u baahan tahay XML-ka tallaabada 3.
• SSTP, L2TP ama PPTP oo leh MSChapv2, Chap ama Pap: magac isticmaale iyo furaha sirta ah oo caadi ah, EAP blob la'aan.
• L2TP oo leh MSChapv2 iyo -Lt2pPsk: PSK waxa uu daboolaa qaybta IPsec, isticmaalaha waxa uu daboolaa PPP; labaduba waa inay server-ka la mid noqdaan.

Splat waxa uu qiimayaasha ku hayaa hal meel:

$p = @{
  Name                 = "Corp IKEv2"
  ServerAddress        = "vpn.example.com"
  TunnelType           = "Ikev2"
  AuthenticationMethod = "MachineCertificate"
  EncryptionLevel      = "Required"
  SplitTunneling       = $false
  DnsSuffix            = "corp.example.com"
}
Add-VpnConnection @p -PassThru

-PassThru waxa uu soo celiyaa shayga uu Windows hadda qoray, sidaas darteed waxaad baari kartaa isaga oo aan wicitaan labaad samayn. Haddii magacu hore u jiray, cmdlet-ku waxa uu diidayaa inuu socdo; -Force ayaa dib u qoraa, taas oo ah fal-celin khaldan laptop wax soo saar ah sababtoo ah waxa ay aamusnaan u tuurtaa wax kasta oo qof gacanta ku habaystay.

Tallaabada 3: U dhiib qalabka aqoonsiga si sax ah

Furaha sirta ah, furaha horay loo wadaagay iyo EAP blobs waa halka scripts-yadani inta badan ka jabaan. -EapConfigXmlStream waxa uu doonayaa XmlDocument, ma aha dariiqa, sidaas darteed marka hore akhri oo beddel faylka. Gudbinta string waxa ay soo saartaa khalad beddelis oo u akhran kara dhibaato schema oo dadka ku kaxaysa inay dib u qoraan XML aan waligiis khaldanayn.

$eap = [xml](Get-Content -Raw .\peap-mschapv2.xml)
Add-VpnConnection -Name "Corp SSTP" -ServerAddress "sstp.example.com" `
  -TunnelType Sstp -AuthenticationMethod Eap `
  -EapConfigXmlStream $eap -EncryptionLevel Required

XML-kaas ma aha wax laga male-awaalay qayb blog ah. Waxa uu magacaabaa nooca habka EAP iyo xaqiijinta gudaha, gateway-gu labadaba waxa uu la barbardhigaa siyaasaddiisa. Hab gudaha ah oo aan is waafaqsanayn waxa uu guuldaraystaa ka dib marka TLS handshake dhammaado, taas oo si sax ah u eg furaha sirta khaldan oo aanay ahayn. XML-ka ka qaado kan maamula gateway-ga, ama ka dhoofi profile hore u shaqeeya.

IKEv2 qaybta shahaadadu waa raadin kaydka. -MachineCertificateIssuerFilter waxa uu qaataa shay shahaado, Windows-na waxa uu isticmaalaa si uu u helo shahaado macmiil oo la isticmaali karo LocalMachine\My. Shahaadadu waxay u baahan tahay fure gaar ah iyo silsilad uu server-ku aamino; marka mid kamid ah maqan yahay, xaqiijintu waxay guuldaraysataa iyada oo aan faahfaahin faa'iido leh lahayn, sidaas darteed marka hore hubi kaydka:

Get-ChildItem Cert:\LocalMachine\My |
  Where-Object { $_.HasPrivateKey -and $_.NotAfter -gt (Get-Date) } |
  Select-Object Subject, Issuer, Thumbprint, NotAfter

Sirta ka fogee faylka script-ka. PSK lagu gudbiyay khadka amarka ama lagu dubay .ps1 waxa uu ku dhammaadaa transcripts, fadhiyo la kaydiyay iyo keyd la wadaago, -RememberCredential-na waxa uu kaydiyaa aqoonsiga isticmaalaha mustaqbalka, isaga oo tijaabo hal mar ah u beddela oggolaansho waaraya.

Tallaabada 4: Go'aanso baaxadda ka hor socodka koowaad

Isla cmdlet-kaas waxa uu wax ku qoraa laba buug oo taleefan oo kala duwan. -AllUserConnection la'aan profile-ku adigaa iska leh oo waxa uu ku nool yahay %APPDATA%\Microsoft\Network\Connections\Pbk\rasphone.pbk. Isaga oo leh, oo ka yimaada prompt la kiciyay, profile-ku waxa uu tagaa %ProgramData%\Microsoft\Network\Connections\Pbk\rasphone.pbk oo waxa uu u muuqdaa akoon kasta, oo ay ku jirto shaashadda gelitaanka.

Baaxaddu ma aha qurxin. Profile loogu talagalay dhammaan isticmaalayaasha waa kan akoon adeeg, hawl la qorsheeyay ama xaalad ka hor gelitaan ay isticmaali karaan; profile hal isticmaale ah waa mid aan saddexdaasba u muuqan. Shayada waxaa sidoo kale loo akhriyaa si kale: Get-VpnConnection waxa uu taxaa qoraallada isticmaalaha hadda, Get-VpnConnection -AllUserConnection waxa uu taxaa kuwa mishiinka oo dhan. Mid hadda dooro, oo isbeddel dambe u qaado tirtirid iyo dib u abuurid, ma aha tafatir:

# elevated prompt
Remove-VpnConnection -Name "Corp IKEv2" -Force
Add-VpnConnection -Name "Corp IKEv2" -ServerAddress "vpn.example.com" `
  -TunnelType Ikev2 -AuthenticationMethod MachineCertificate `
  -EncryptionLevel Required -AllUserConnection

Tallaabada 5: Tijaabi waxa tunnel-ku dhab ahaan gudbin doono

Astaanta xiriirka waxay caddaynaysaa in tunnel-ku kacay oo wax kale ma aha. Marka hore khadka amarka ka xiriir si guuldarrooyinku u yimaadaan qoraal ahaan, ma aha dialog, ka dibna akhri waxa Windows qoray:

rasdial "Corp IKEv2"
Get-VpnConnection -Name "Corp IKEv2" |
  Select-Object Name, ServerAddress, TunnelType, ConnectionStatus, SplitTunneling
Get-NetRoute -DestinationPrefix "0.0.0.0/0"

Labada guuldarro ee isticmaalayaashu soo sheegaan inta xaaladdu weli leedahay Connected waa DNS iyo dariiqa. Xalliso magac gudaha ah oo hubi server-ka jawaabay; profile aan lahayn -DnsSuffix waxa uu si fiican u tunneli karaa oo haddana ku guuldaraysan kara raadin kasta oo intranet ah. Ka dib eeg dariiqa caadiga ah: marka split tunneling dammaan yahay, dariiqa 0.0.0.0/0 ee metric-ka ugu hooseeya waa inuu u jeestaa interface-ka VPN, marka uu shidan yahayna kaliya prefixes-ka aad filanayso. Haddii labaduba sax u muuqdaan oo haddana traffic-ku dhinto, dhibaatadu waxay ka dambeysaa profile-ka, siyaasadda ama filter-ka gateway-ga.

Marka xiriirku gabi ahaanba guuldaraysto, koodku waxa uu cidhiidhiyaa tallaabada dib loo eegi doono:

• 691: gateway-gu waxa uu diiday aqoonsiga. Ku noqo tallaabada 3, ma aha tunnel-ka.
• 809: IKEv2 handshake waligiis ma dhammaanin. Hubi UDP 500 iyo 4500, iyo kalsoonida shahaadada.
• 789: furaha horay loo wadaagay ee L2TP/IPsec waa maqan yahay ama khaldan.
• 868: magaca server-ka lama xallin. Hagaaji DNS ka hor inta aadan tafatirin profile-ka.

Hayso amarka shaqeeya agtiisa dejinta uu qorayo, si qofka xiga uu dib u dhiso profile-ka halkii uu ka soo saari lahaa interface-ka. Haddii aad runti u baahan tahay inaad dib u dhisto, tirtir qoraalka oo isla parameters-kaas ka abuur; nadiifinta profile badh-qaabaysan waxa ay ka tagtaa waddooyin duugoobay iyo xaalad xaqiijin. Haddiina faylku waligiis asli ahayn, ku noqo macmiilka iska leh. .ovpn oo loo labbisay profile IKEv2 ma aha soo dejinta, waa tikit taageero.