LocalSubnet ee ku jira qaanuunka dab-demiska SMB ma dabooli doonto macaamiisha VPN
Qaanuunka fasaxa LocalSubnet wuxuu daboolaa subnet-yada server-ka laftiisa, ma aha barkada VPN ee la leexiyay. Isbarbardhig ciwaanka isha ee server-ku arko ka hor inta aadan ballaarin baaxadda.
Desktop-yada xafiiska waxay gaaraan wadaagga, isticmaalayaasha VPN waqtigooda wuu dhammaadaa, isla akoonkaasna wuxuu ka shaqeeyaa hotspot-ka taleefanka. Ogolaanshaha wadaagga ayaa dhif ah inuu noqdo farqiqa; ciwaanka yimaadda server-ka faylasha ayaa sida caadiga ah farqiqa. Qaanuun ku xaddidan LocalSubnet wuxuu oggolaadaa subnet-yada server-ka laftiisa ku xiran, barkada VPN ee si gooni ah loo leexiyayna mid ka mid ah ma aha. Laba naqshad ayaa buuxiya farqigaas, waxayna ka tagaan diiwaanno aad u kala duwan.
Laba naqshad, calaamad hal
Naqshadda koowaad waxay barkada VPN ku dartaa shardiga ciwaanka fog ee qaanuunka. Markaas server-ku wuxuu arkaa ciwaanka tunnel-ka macmiil kasta, sidaas darteed diiwaannadiisu waxay kala saari karaan hal isticmaale fog mid kale. Naqshadda labaad waxay u leexisaa taraafikada VPN iyada oo maraysa gateway u beddela ciwaan LAN ka hor inta uusan server-ku arkin. Taasi waxay soo celisaa isku xirnaanta oo waxay tirtirtaa farqiga isla tallaabadaas.
Shaxdu waxay qeexdaa doorarka halkii ay ka qeexi lahayd ciwaannada, oo prefix-yadaada ayaa go'aamiya safka khuseeya. Daabac qiimaha dhabta ah ee server-ka halkii aad ka koobi lahayd tusaale ku jira boostada blog:
Get-NetIPAddress -AddressFamily IPv4 | Select-Object InterfaceAlias, IPAddress, PrefixLengthShaxdu waa kaalmo go'aan, ma aha sheegasho ku saabsan dhul kasta. Martigeliye leh interface dheeraad ah, xiriir site labaad ama maaskar kale wuxuu leeyahay koox maxalli ah oo kale.
| Path the packet takes | Address the server records | Filter scope that admits it | What the log can still tell you |
|---|---|---|---|
| Desktop on the server LAN | Its own LAN address | LocalSubnet or the LAN prefix | Which workstation connected |
| Client on the routed VPN pool | Its tunnel address | The VPN pool as a remote address | Which VPN account connected, if the pool is logged |
| Client behind source NAT at the gateway | The gateway's LAN address | The gateway address | Only that some VPN user connected |
| Site-to-site gateway | The remote gateway's tunnel address | The remote site's prefix | Which site connected, not which user |
Tixraaca New-NetFirewallRule ee Microsoft waxay diiwaangelisaa shuruudaha ciwaanka fog iyo erayga muhiimka ah LocalSubnet. Akhri ka hor inta aadan go'aansan in erayga muhiimka ahi macneeyo dhammaan ciwaannada gaarka ah, maxaa yeelay sidaas ma aha.
Isbarbardhig waxa server-ku dhab ahaan helo
Akhri qaanuunka dhaqan galaya halkii aad ka akhrin lahayd kan qof u malaynayo inuu abuuray. Hubi inuu shaqeynayo, inuu khuseeyo profile-ka firfircoon, iyo in shardiga ciwaanka fog uu waafaqsan yahay isha uu server-ku arko. Qaanuun kaliya lagu hawlgeliya profile-ka Domain waxba ma sameeyo marka adapter-ku isbeddel shabakadeed ka dib u gudbay Public.
Get-NetFirewallRule -DisplayGroup 'File and Printer Sharing' | Get-NetFirewallAddressFilter
Get-NetFirewallProfile | Select-Object Name,Enabled,DefaultInboundActionAmarka koowaad wuxuu daabacaa shaandheeyayaasha ciwaanka ee ku xiran qaanuunnada wadaagga faylasha, tan labaadna waxay muujinaysaa profile-yada firfircoon iyo sida loo maareeyo taraafikada soo gasha ee aan waafaqsaneyn. Sidoo kale raadi qaanuun xannibaad iyo siyaasad si dhexe loo maareeyo. Qaanuunnada xannibaaddu waxay ka sarreeyaan kuwa fasaxa, siyaasad damiirta isku-darka qaanuunnada maxalliga ahna waxay ka dhigi kartaa ka-tagga maxalliga cusub mid aan shaqeyn.
Kani waa kiiska qaanuunku uu ka muuqdo mid sax ah console-ka oo uusan wax saameyn ah ku lahayn taraafikada. Isla waqtigaas hubi qoondaynta profile-ka, maxaa yeelay laptop ku biiray shabakad kale wuxuu u gudbi karaa profile-ka Public iyada oo aan qofna taaban dab-demiska.
Tijaabi gaadiidka ka hor gelitaanka
Kala sooc gaaritaanka iyo xaqiijinta aqoonsiga. Dhageystaha TCP 445 wuxuu caddeeyaa in adeeg ku xiran yahay dekedda; ma caddeeyo in baakad fog ay gaari karto. Isku xirka TCP oo dhammaaday, dhanka kale, weli wax kama sheegayo dhisidda fadhiga SMB ama ogolaanshaha wadaagga. Tijaabi gacan-qabsiga labada dhinac ka hor inta aadan wax ka beddelin qaanuun.
Test-NetConnection -ComputerName files.corp.example -Port 445
Test-NetConnection -ComputerName files.corp.example -Port 445 -InformationLevel DetailedAmarka koowaad wuxuu soo sheegaa haddii gacan-qabsiga TCP ku guuleysto mishiinka aad ka waddo, tan labaadna waxay ku darsataa ciwaanka la xalliyay iyo faahfaahinta interface-ka. Ka socodsii macmiilka VPN iyo desktop-ka xafiiska, ka dibna isbarbardhig. Ping ma ka jawaabo mid ka mid ah labada su'aalood, maxaa yeelay ICMP waa la xannibi karaa inta SMB furan yahay, ama waa la oggolaan karaa inta dab-demiska tuurayo 445.
Haddii gacan-qabsigu ku guuldareysto kaliya VPN-ka, baaxadda isha ayaa ah tuhunkii ugu weynaa. Haddii uu guuleysto oo wadaaggu wali ku diido, u gudub baaritaanka fadhiga iyo ogolaanshaha SMB halkii aad wax ka beddeli lahayd qaanuunnada dab-demiska.
Marka NAT-ka isha tirtiro farqiga
Marka turjumaad ku jirto wadada, server-ku ma kala saari karo macaamiisha VPN ee gaarka ah ciwaan ahaan. Isticmaale kasta oo fog wuxuu u yimaaddaa sida gateway-ga. Fasax kasta oo ku tiirsan kala saaristooda waa in lagu dhaqan geliyo meesha aqoonsigooda wali muuqdo, taas oo sida caadiga ah ka dhigan tahay isku-ururinta VPN ama proxy xaqiijinaya. Qaanuunka dab-demiska wuxuu oggolaan karaa taraafikada; ma soo celin karo farqi ay turjumaaddu tirtirtay.
Marka ciwaankaas gateway la oggolaado, isticmaale kasta oo fog waxaa lagu diiwaangeliyaa hal ciwaan, sidaas darteed qaanuunku wuxuu barkada oo dhan siinayaa qof kasta oo gaari kara gateway-ga. Haddii go'aan isticmaale kasta u gaar ah u muhiim yahay, ciwaannada asalka ah ka dhig kuwo muuqda ama u rar go'aanka lakab wali yaqaan isticmaalaha. Haddii kale isticmaale kasta oo fog wuxuu dhaxlaa ogolaanshaha hal ciwaan oo server-ku arki karo, raadka hordhacuna ma kala saari karo iyaga ka dib. Taasi waa go'aan naqshadeed, ma aha faahfaahin dab-demis.
Si ula kac ah u dhex dooro labada naqshad. Ku xaddid qaanuunka barkada VPN dhabta ah marka server-ku ay tahay inuu arko cidda isku xirtay, oo aqbal wadada la turjumay kaliya marka server-ku run ahaantii aanu u baahnayn macluumaadkaas. Qor baaxadda isha la doortay qaanuunka agtiisa, maxaa yeelay qofka xiga ee tan baaritaankiisa sameeya wuxuu marka hore eegi doonaa shaxda ciwaannada.