VPN waxay xannibtaa LAN-ga gudaha Windows: waddo mise siyaasadda macmiilka?
Helitaanka LAN-ga gudaha Windows waxay u burbursaa laba sababood oo kala duwan: waddo maqan, ama siyaasad gateway oo tuurta subnet-ka. Saddex baaritaan ayaa sheegaya kee.
Daabacaha, NAS ama mishiinka horumarinta ee ku yaal miiskaaga u gaar ah way joojiyaan jawaabta isla markii VPN-ga shaqada uu xirmo. Mararka qaarkood hal amarka waddadu wuxuu ku hagaajiyaa ilbiriqsiyo gudahood; mararka qaarkood isla waddadaas waa sax oo baakaduhu weli way lumaan, taas oo macneheedu yahay inaad eegto dhibaato kale oo calaamado la mid ah leh. Go'aanku wuxuu ku yimaadaa saddex su'aalood, iyo in si khaldan loo kala horreysiiyo ayaa sababta dadku u qaataan habeenkii oo dhan iyagoo tirtiraya oo dib u daraya waddooyin.
Saddex su'aal ka hor amarka kasta
Marka hore: ma jiraa galitaan loogu talagalay prefix-ka gudaha, oo ma tilmaamayaa adapter-ka jirka? Marka labaad: ma helaa macmiilku oggolaansho ama diidmo shabakada gudaha ah gateway-ga marka uu xirmo? Marka saddexaad: ma waxaad u baahan tahay oo keliya gelitaan baxa oo LAN-ga ah, mise wax internetka ku jira ayaa sidoo kale waa inuu gaaraa adeeg ku socda mishiinkaaga?
Su'aasha koowaad waxay kala soocdaa cilad habaynta dariiqa iyo cilad shaandhayn. Ta labaad waxay sheegtaa haddii hagaajinta waddada la oggol yahay inay shaqeyso. Ta saddexaad waxay beddeshaa hagaajinta: waddadu waxay hagaajisaa taraafikada baxa, halka adeegga soo-gala ee aan la gaari karin uu badanaa yahay dhibaato ku xiran dhegeysanaha iyo wadada soo noqodka oo waddadu ka sii daraato.
| What you see | What it points at |
|---|---|
| No local prefix in the table | Missing route |
| Correct prefix, no reply | Client filter or gateway policy |
| Works by IP, fails by name | Resolver changed by the tunnel |
| Inbound service dies, outbound fine | Return path or listener binding |
Su'aal koowaad: waddo, shaandheyn mise magac
Akhri shaxda ka hor intaadan wax ku darin. Tilmaamaha interface-ka ayaa muhiim ah, sababtoo ah amarka kasta oo waddada hoose wuxuu ku xiran yahay:
route print -4
Get-NetRoute -DestinationPrefix 192.168.1.0/24 | Format-Table InterfaceIndex,NextHop,RouteMetricSubnet-ka si toos ah u xiran ayaa badanaa hayaa waddada on-link xitaa marka tunnel-ku sarreeyo, sidaas darteed galitaanku wuu jiri karaa oo taraafikadu weli way dhici kartaa. Isku darkaas waa saxeexa shaandheyn socota ka dib habaynta dariiqa, waana kiiska ay waddada labaad, oo gaar ah, waxna beddelin.
U tijaabi si gooni ah ciwaanka iyo magaca. Haddii ping 192.168.1.50 jawaabo oo net view 192.168.1.50 aan jawaabin, shaxda habaynta dariiqa waligeed ma ahayn dhibaatada: tunnel-ku wuxuu beddelay xalliyaha oo magaca gudaha lama xalliyo. Waddo ku darista taas waa shaqo bilaash ah.
Su'aal labaad: gateway-ga ma oggol yahay gelitaanka LAN-ga gudaha?
Macmiil ganacsi wuxuu rakibaa wax ka badan waddooyin. Wuxuu helaa siyaasad marka uu xirmo, oo siyaasaddaas waxaa ku jiri kara oggolaansho cad oo shabakada gudaha ah. Hirgelinta Cisco IPsec, siyaasadda kooxdu waxay qaaddaa dejinta split-tunneling iyo calan gooni ah oo gelitaanka LAN-ga gudaha; sanduuqa calaamadaha ee macmiilka waa codsi uu gateway-ga diidi karo. AnyConnect, profile-ku wuxuu maamulaa liisaska ku darista iyo ka-saarista split iyo isla oggolaanshahaas. Windows RRAS, waxyaabaha u dhigma waa ikhtiyaarka gateway-ga caadiga ah ee profile-ka iyo waddooyinka static ee server-ku qoondeeyo.
Marka calanku damman yahay, dhaqanka la diiwaangeliyay waa in macmiilku xannibo taraafikada u socota subnet-ka si toos ah u xiran, in kastoo waddo sax ah oo gaar ah ay jirto. Taas ayaa sidoo kale sababta waddooyinka aan macmiilku lahayn ay u lumi karaan ilbiriqsiyo ka dib markaad ku darto: macmiilku wuxuu dib u dhisayaa xaaladda la yiri ha dhiso, kuguma dagaallamayo.
Log-ga macmiilku wuxuu diiwaangeliyaa go'aanka marka la xirmo, akhrintiisuna way ka dhaqso badan tahay tijaabo kasta oo mishiinka ah. Haddii log-ku yiraahdo gelitaanka gudaha waa xanniban yahay, istaag: hagaajin kasta oo khadka amarka ah kama badbaado taas, oo waddooyinka hadhay waa beddelka siyaasadda, gaaritaanka kheyraadka tunnel-ka, ama macmiilka ku haynta mishiin firtual ah iyo martigeliyaha ku reebista shabakada gudaha.
Su'aal saddexaad: jihada kee baad u baahan tahay?
Taraafikada baxa ee qalabka u dhow waa su'aal habayn dariiqa. U jeedi prefix-ka LAN-ga gateway-ga gudaha oo leh cabbir aad u hooseeya oo ka adkaan kara waddada caadiga ah ee tunnel-ka:
route add 192.168.1.0 mask 255.255.255.0 192.168.1.1 metric 1 if 12
route add 192.168.1.50 mask 255.255.255.255 192.168.1.1 -pQaabka labaad wuxuu dhejiyaa hal qalab, waana waxa aad rabto marka hal ciwaan uu yahay shuruudda oo dhan. netsh u dhigma wuxuu isla go'aankaas ku diiwaangeliyaa magaca interface-ka halkii index:
netsh interface ipv4 add route prefix=192.168.1.0/24 interface=12 nexthop=192.168.1.1 store=persistentAmarka waddada waxay ku guuldareystaan Halbeegga waa khalad marka ciwaanka iyo mask-ku aanay is waafaqin, tusaale ciwaanka martigeliyaha oo leh mask /24. Isticmaal ciwaanka shabakadda waddada subnet-ka iyo mask martigeliyaha hal martigeliye.
Taraafikada soo-gala way ka duwan tahay. Server VNC ama SSH oo isla mishiinka ku yaal wuu noqdaa mid aan la gaari karin marka jawaabaha xiriirka soo-gala ay ka baxaan gateway-ga VPN oo aanay waligood soo noqon. Ka hor intaadan taaban waddooyinka, hubi waxa adeeggu dhegeysanayo:
netstat -ano | findstr :5900Dhegeyste ku xiran hal ciwaan gaar ah kama jawaabi doono interface-ka kale. In lagu xiro dhammaan interface-yada waa go'aan ula kac ah, oo lala yeeshay qaanuun derbi-dab ah oo ku xaddidan shabakadda aad aaminto. Ka dib oo keliya ayay hagaajinta waddadu soo celisaa wadada soo noqodka.
Codso isbeddelka ugu yar ee ku habboon
Dhaqdhaqaaqa kale ee caadiga ah waa in laga qaado calaamadda “Isticmaal gateway-ga caadiga ah shabakadda fog” ee guryaha horumarsan ee IPv4. Tani waxay taraafikada internetka ku haysaa gudaha, laakiin waxay sameysaa laba shay isku mar: VPN-ga ma aha wadada caadiga ah, oo macmiilku ma helo waddooyin shabakadda fog, oo ay ku jirto multicast. Ka qaad calaamadda oo LAN-ga fog wuu luminayaa haddii server-ku aanu riixin prefix-yada fog ee gaar ah ee macmiil kasta u baahan yahay.
Aan isle'egtaas ayaa go'aamisa nidaamka shaqada. Haddii dhinaca fog waa inuu si buuxda u gaari karo, ka riix subnet-yada fog server-ka oo ka tag caadiga gudaha. Haddii aadan beddeli karin server-ka, ku dar waddo joogto ah prefix-ka fog iyada oo loo marayo ciwaanka tunnel-ku qoondeeyay, oo ku hubi route print in prefix-ku u jeedo interface-ka VPN halka caadigu weli u jeedo gateway-ga jirka.
Kadib xaqiiji in hagaajintu ka badbaaddo dib u xirnaansho, sababtoo ah waddooyinka aan joogtada ahayn waxay la dhintaan adapter-ka, oo script-ka socda ka dib xiriir kasta waa booska daacad ah ee iyaga. Tijaabi hal qalab gudaha ah iyo hal kheyraad fog isla fadhi, goo, dib u xir, oo mar kale tijaabi. Haddii qalabka guduhu weli guuldareysto halka waddadu u egtahay mid sax ah, ku noqo su'aasha labaad: macmiilku wuu shaandhaynayaa, jawaabtuna waa beddelka siyaasadda ee ma aha waddo labaad tartan gal ah.