Kaliya Firewall-ka Windows oo ah beddelka xaaladda degdegga VPN: ma adkaystaa?
Xeerarka nooca interface-ka waxay xannibi karaan adapters-ka jirka, laakiin tunnel-ka dhinac saddexaad wuxuu inta badan u muuqdaa mid xadhig leh. Hubi kala-soocidda, wadada barta ugu dambeysa, ka dibna DNS.
Weydii haddii firewall-ka Windows uu keligiis u shaqeyn karo beddelka degdegga ah waxaadna heli doontaa laba jawaab oo kalsooni leh oo aan is waafaqsaneyn. Mid wuxuu leeyahay xeerka nooca interface-ka ayaa qabta shaqada oo dhan; kan kale wuxuu leeyahay ma shaqeeyo la'aanteed scripts. Labaduba waxay sharraxayaan nus ka mid ah isla habka. Firewall-ku wuxuu muujin karaa xannibaadda, iyo haddii natiijadu dhab ahaan ku guuldareysato si xiran waxay ku xiran tahay saddex shay: sida Windows u kala saaro adapters-ka tunnel-ka, haddii ka reebista barta ugu dambeysa ay sii socoto, iyo haddii xallinta magacyada iyo IPv6 la daboolay. Mid ka mid ah khalad ka dhig, mishiinku wuu daadan doonaa ama wuxuu lumin doonaa isku xirka oo dhan.
Saddex shuruud, sidan oo kale
Shuruudda koowaad waa kala-soocidda, waxayna go'aamisaa haddii xeerka aad rabto uu xitaa la sheegi karo. Xeerarka firewall-ka Windows waxaa lagu xaddidi karaa nooca interface-ka: xadhig leh, wireless ama gelitaan fog. Siyaasadda xannibaysa socodka baxa ee noocyada jirka oo u oggolaanaysa tunnel-ka waxay shaqeysaa kaliya haddii Windows u aqoonsado tunnel-ka gelitaan fog.
Shuruudda labaad waa ka reebista barta ugu dambeysa. Ka hor inta aan tunnel jirin, macmiilku waa inuu gaaro server-ka VPN isagoo maraya adapters-ka jirka, sidaas darteed xannibaad buuxda oo ku taal adapters-kaas waxay hor istaagtaa isla isku xirkaas oo xannibaadda ka dhigi lahaa mid aan loo baahnayn. Ka reebistu waa inay sheegto server-ka iyo dekeddiisa, pakettuna waa inuu ka baxaa iridda jirka ee aan u gelin tunnel aan weli kicin.
Tan saddexaad waa daboolka. Xeerar xannibaya IPv4 oo ilaaway IPv6, ama u oggolaanaya xalliyaha maxalliga ah inuu baadho barta ugu dambeysa oo sidaas u oggolaanaya baaritaan kasta oo kale, waxay si furan ugu guuldareystaan isla daaqaddaas oo beddelka loogu talagalay. Taasi waa bannaan ansixin ah, ma aha cilad firewall-ka. Sidoo kale waa bannaanka ka badbaada baaritaan kasta oo miis lagu sameeyo.
Kala-soocidda waa iridda koowaad
Eeg waxa Windows ka fikiro adapters-ka ka hor inta aadan qorin hal xeer. Isku xirka VPN-ga asalka ah ee Windows wuxuu inta badan u muuqdaa gelitaan fog. Macmiil dhinac saddexaad oo abuura adapters-kiisa macmalka ah wuxuu inta badan u muuqdaa mid xadhig leh, taasoo la macno ah in xannibaad ku eg adapters xadhig leh ay sidoo kale xannibayso tunnel-ka.
Get-NetConnectionProfile | Select-Object Name,InterfaceAlias,NetworkCategory
Get-NetAdapter | Select-Object Name,InterfaceDescription,Status,ifIndex
Get-NetFirewallProfile | Select-Object Name,Enabled,DefaultOutboundActionAmarka saddexaad wuxuu kuu sheegayaa haddii xannibaadda baxa ee caadiga ah ay horey u dhaqan gashay, taasoo beddeleysa qaabka guud ee naqshadda. Haddii caadiga horey u xannibaad yahay, waxaad qoreysaa xeerar oggolaansho halkii aad ka qori lahayd ka reebis saldhig oggolaansho leh, taasna waa mowqif aad u fudud in laga fikiro.
Haddii adapters-ka tunnel-kaagu uu isku sheego mid xadhig leh, firewall kaliya ma aha qalabka saxda ah naqshad guuldareysata oo xiran, mana jirto wax hagaajin xeerar ah oo beddela taas. Tani waa kiiska ay ra'yiga labaad ee mawduuc kasta oo madal ah sax yahay.
Ka reebista barta ugu dambeysa waxay u baahan tahay waddo, ma aha oo kaliya xeer
Ka soo qaad in kala-soociddu shaqeyso. Ka reebistu waa laba qaybood, waxayna ku nool yihiin nidaamyo hoose oo kala duwan. Xeerka firewall-ka wuxuu oggolaadaa socodka; waddada martigeliyaha ayaa ka dhigta inuu ka baxo interface-ka saxda ah inta tunnel-ku hoos jiro.
New-NetFirewallRule -DisplayName "VPN endpoint allow" -Direction Outbound -Action Allow \
-Protocol TCP -RemoteAddress 203.0.113.9 -RemotePort 443 -InterfaceType Wired,Wireless
New-NetRoute -DestinationPrefix 203.0.113.9/32 -InterfaceIndex 12 -NextHop 192.168.1.1
Get-NetRoute -DestinationPrefix 203.0.113.9/32La'aanteed waddada, ka reebistu waxay caawisaa kaliya inta waddada caadiga ah ay weli tilmaamayso iridda jirka. Marka macmiilku rakibo waddadiisa caadiga ah oo uu dhinto, paketada la oggolaaday ma laha meel macquul ah oo ay tagaan mana suurtogal tahay in isku xirka dib loo sameeyo. Guuldareysigaas wuxuu u eg yahay macmiil jabay, run ahaantii waa waddo maqan.
Ka reebista u hay sida ugu cidhiidhsan ee macmiilku oggolaado. Hal cinwaan iyo hal deked ayaa dib loo eegi karaa; baaxad daboolaysa shabakadda dhan ee bixiyaha ma aha. Xeerkaas ballaaran wuxuu sidoo kale oggolaadaa wax kasta oo kale oo lagu martigeliyo isla bixiye, taasoo badanaa ka badan inta aad uga fikirtay.
DNS iyo IPv6 waa meelaha uu si furan ugu guuldareysto
Xallinta magacyada waa daadinta caadiga ah. Haddii barta ugu dambeysa ay tahay magac martigeliye, macmiilku waa inuu xalliyaa ka hor inta tunnel-ku jirin, taasoo la macno ah in adapters-ka jirka loo oggolaado inuu gaaro xalliyaha. Isla oggolaanshahaas wuxuu u baxaa baaritaan kasta oo kale inta tunnel-ku hoos jiro, hal baaritaanna wuu ku filan yahay inuu muujiyo waxa aad ku niyad santay inaad booqato.
IPv6 waa tan labaad. Xeerarka loo qoray IPv4 ma daboolaan qoyska kale, macmiillo badanina waxay rakibaan kaliya waddooyinka IPv4. Sidaas darteed mishiin leh isku xir IPv6 asali ah wuxuu sii wadi karaa inuu la hadlo internet-ka inta dhinaca IPv4 si adag loo xannibay, beddelkuna wuxuu soo sheegaa guul waqtiga oo dhan.
| Gap | What leaks | Control |
|---|---|---|
| Resolver permitted for endpoint lookup | Every name queried while down | Pin the endpoint as an address, or block non-tunnel DNS |
| Rules only for IPv4 | Full IPv6 connectivity | Add the same rules for the other family |
| Application bound to physical interface | Its own traffic | Firewall cannot fix this; change the binding |
Sadarka saddexaad waa in la fahmo halkii laga maarmi lahaa. Firewall-ku wuxuu go'aamiyaa paketada, ma aha interface-ka uu codsaday barnaamijku, barnaamij si cad isku xidhana wuu adkaan karaa in la xakameeyo. Taasi waa dood u taagan beddelka dhinaca macmiilka ee ka hooseeya barnaamijka, ma aha xeerar badan.
Ku tijaabi adoo joojinaya macmiilka, ma aha adoo jiidaya xadhigga
Tijaabada kaliya ee macne leh waa tan ku dayata guuldareysiga aad ka ilaalinayso. Jooji adeegga, dil habsocodka, ama jooji adapters-ka uu macmiilku abuuray, ka dib isku day inaad gaarto internet-ka iyo magac:
Stop-Service -Name "YourVpnService" -Force
Test-NetConnection -ComputerName 1.1.1.1 -Port 443
Resolve-DnsName example.com
Test-NetConnection -ComputerName 2606:4700:4700::1111 -Port 443Saddexda waa inay guuldareystaan. Haddii tan koowaad guuleysato, xannibaaddu ma dhaqan gelin; haddii tan labaad guuleysato meesha tan koowaad ku guuldareysatay, waxaad leedahay daadinta DNS; haddii tan saddexaad guuleysato, IPv6 lama daboolin. Natiijo kastaa waxay tilmaamaysaa mid ka mid ah bannaanada kore si sax ah.
Ku celi tijaabada ka dib hurdada iyo soo jeedka, sababtoo ah borofaylka firewall-ka wuu is beddeli karaa marka Windows go'aansado in shabakaddu tahay mid dadweyne ama mid gaar ah, xeerarka borofaylka ku egna way raacaan. Naqshad ku adkaysata miis oo ku guuldareysata tareen waa naqshad hal mar la tijaabiyay.
Haddii iridda kala-soocidda ama shuruudda DNS ay ka dhigaan habka firewall-kaliya mid aan macquul ahayn, beddelka dhinaca macmiilka waa jawaabta daacadda ah. Haddii tunnel-ku uu ku dhammaado router, siyaasaddu waa inay router-ka tahay, sababtoo ah hal xeer oo halkaas ah wuxuu daboolaa qalab kasta oo ka dambeeya mana ku xirna sida Windows u magacaabo adapter.