Server DNS khaldan ee Windows VPN: metrik, nidaamka isku xirka ama horgal
Saddex hab oo Windows ah ayaa dooranaya resolverka DNS, waxayna ku guul-darraystaan siyaabo kala duwan. Go'aan ku gaar baaxadda booska magaca, nidaamka caalamiga ah ama haddii hagaajintu ka badbaadaysato dib u xir.
Macaamiil Windows wuxuu yeelan karaa tunnel shaqeeya, oo sida resolveryada shirkadda, haddana magacyada gudaha u diro routerka guriga. Saddex hab oo kala duwan ayaa go'aamiya serverkee jawaabaya, waxayna ku guul-darraystaan siyaabo kala duwan. Saddexdaba ma aha inaad hagaajiso: calaamaddu waxay kuu sheegaysaa kee ku jira ciyaarta. Geedka go'aanka ee hoose wuxuu qaataa dhowr daqiiqo wuxuuna ka hortagaa natiijada caadiga ah, halkaas oo isbeddelka metrik, dib u habaynta diiwaanka iyo qaanuunka NRPT ay wada yimaadaan oo aan cidna ogaalin kee wax qabtay.
Saddex hab ayaa go'aamiya, badanaana mid baa khalad ah
Metrika interface-ka waxay u kala hormarisaa adapters-ka qoyska cinwaan ee la bixiyay. Habka isku xirka ee Tcpip\Linkage hoostiisa waa liis heer mishiin ah oo aqoonsiga interface-ka oo waddooyinka koodhka hore ay weli eegaan. Shaxda Siyaasadda Xallinta Magacyada (NRPT) waxay ku xirtaa booska magaca serverro gaar ah, liiska horgalna wuxuu go'aamiyaa haddii magac gaaban uu gabi ahaanba la fidinayo. Way madax banaan yihiin, taasina waa sababta resolverka saxda ah ee adapterka VPN uu ugu guul-darraysto doorasho duug ah meel kale.
| What you see | Mechanism to check | First command |
|---|---|---|
| Every name is slow, public names sometimes wrong | Global adapter order: metric, then Linkage | Get-NetIPInterface |
| Internal names resolve to a public address | The query left through the home resolver, not the tunnel | Resolve-DnsName intranet.corp.example -Type A, then the same query with -Server 10.20.0.10 |
| Only corp.example names fail, public names fine | Namespace binding: NRPT or suffix | Get-DnsClientNrptRule |
| Short name fails, fully qualified name works | Suffix list on the adapter, with the corporate suffix ahead of other entries, or pushed by the server | Get-DnsClientGlobalSetting |
| Works, then breaks after a reconnect | Runtime setting that was never persisted | Get-VpnConnection for the stored profile, then Get-NetIPInterface again after a reconnect |
Midkoodna hababkan ma aha dhinaca kale ee tunnelka. Haddii serverka VPN-ku riixo uusan xallin karin magaca, dejinta kasta oo dhinaca macaamiisha ah waa qurxin uun, marka go'aanka koowaad waa haddii resolverka laftiisu jawaab karo marka si toos ah loo weydiiyo.
Go'aan koowaad: resolverka la riixay ma jawaabi karaa gabi ahaanba?
Serverka si cad u weydii oo la barbardhig raadin caadi ah. Farqiga u dhexeeya jawaabaha waxay kala saaraa dhibaatada xulashada iyo dhibaatada gaaritaanka, halkanna waa laanta ugu dhaqso badan:
Resolve-DnsName intranet.corp.example -Server 10.20.0.10 -Type A
Resolve-DnsName intranet.corp.example -Type AHaddii kan koowaad guulaysto oo kan labaad guul-darraysto, resolverku waa la gaari karaa Windowsna si xun ayuu u dooranayaa; u gudub go'aannada booska magaca iyo nidaamka ee hoose. Haddii kan koowaadna guul-darraysto, waxba kuma caawinayaan macaamiisha: hubi in UDP iyo TCP 53 ay tunnelka ku gaaraan serverka, in aan dab-damis martigeliyaha serverka ku tuurin barkada, iyo in gudbiyeyaasha serverka laftiisa ay caafimaad qabaan.
Joog laantan. Ku dhaqangelinta qaanuunka NRPT resolver aan la gaari karin waxay keenaysaa isla guul-darraystaas oo leh dejisyo badan oo dib loo celinayo, waxayna qarinaysaa cilad-dhaqameedka dhabta ah qaanuun u eg mid awood leh.
Go'aan labaad: hal boos magac mise su'aal kasta?
Baaxadda ayaa go'aamisa qalabka. Marka kaliya magacyada shirkaddu guul-darraystaan, xir booska magaca halkii aad mishiinka dib u habayn lahayd: qaanuunka NRPT wuxuu horgalkaas u diraa resolverka tunnelka oo wuxuu ka tago wax kasta oo kale. Marka raadin kastaa saameeyo, dhibaatadu waa doorashada caalamiga ah ee adapters-ka, metrikna waa meesha laga bilaabo maxaa yeelay waxba kama beddelo dejinta serverka.
Deji metrika qoyska cinwaan kasta, labada interface, kadibna xaqiiji nidaamka:
Get-NetIPInterface | Select-Object ifIndex, InterfaceAlias, AddressFamily, InterfaceMetric
Set-NetIPInterface -InterfaceIndex 11 -InterfaceMetric 1 -AddressFamily IPv4
Set-NetIPInterface -InterfaceIndex 11 -InterfaceMetric 1 -AddressFamily IPv6Ku beddel 11 ifIndex-ka adapterka tunnelka ee safka kore; haddii 11 yahay adapterka LAN, isla amarkaas wuxuu hoos u dhigaa waddada khaldan. Inaad adapterka LAN kor u qaaddo waxay ka gaartaa isla nidaamka dhinaca kale: netsh int ip set interface interface="Ethernet" metric=15, iyo netsh int ipv6 set interface interface="Ethernet" metric=15 qoyska labaad, maxaa yeelay int ip wuxuu taabtaa oo kaliya IPv4.
Nidaamka isku xirku waa tababarka ugu dambeeya ee ma aha tallaabada koowaad. HKLM\SYSTEM\CurrentControlSet\Services\Tcpip\Linkage wuxuu hayaa liis Bind ah oo aqoonsiga aaladaha, aqoonsiga tunnelka horay u guurintiisuna runtii waxay beddelaa adapterka marka hore la weydiiyo, laakiin waa qiime diiwaan heer mishiin ah oo aan lahayn baaxad boos magac kasta. Dhoofi ka hor tafatirka kadibna mar kale ku xir tunnelka, si nidaamku u shaqeeyo xaaladda uu macaamiilku filayo.
Hal boos magac, dooro qalabka cidhiidhiga ah:
Add-DnsClientNrptRule -Namespace ".corp.example" -NameServers 10.20.0.10
Get-DnsClientNrptRule | Select-Object Namespace, NameServersGo'aan saddexaad: hagaajintu ma ku noolaataa dib u xirka?
Metrik shaqeeya ilaa xiritaanka telefoonka ee xiga weligeed lama kaydin. L2TP/IPsec iyo profiles-ka isku xirka kale dib ayaa loo abuuraa marka isku xirku bilaabmo, marka qiimaha la kaydiyay wuxuu ku nool yahay gelitaanka buugga telefoonka sida IpInterfaceMetric, ma aha oo kaliya interface-ka nool. Deegaanada qaar ayaa goobtaas script ka dhigta sababtaas awgeed; qaar kalena waxay doorashada ka riixaan siyaasadda maamulka oo waxay ka tagaan barta ugu dambeysa.
Kaydka iyo diiwaangelintu waa lakab gooni ah. Ku socodsiintooda ka dib marka tunnelku kaco waxay hagaajisaa gelitaanno duug ah oo mar kale diiwaangelisaa macaamiilka, laakiin midkoodna dib uma habayso adapter:
ipconfig /registerdns
ipconfig /flushdnsLakabkaas oo kale waxaa ku yaal dab-bixin. Diiwaangelinta firfircoon ee adapterka jirka ah dab-damintiisu waxay ka horraysaa macaamiilka in uu cinwaankiisa dhinaca VPN ku dhawaaqo magac khaldan, taasina waa hagaajin ka duwan cusboonaysiinta kore.
IPv6 waxay mudan tahay saf u gaar ah go'aanka. Haddii adapterka jirka ahi leeyahay cinwaan IPv6 caalami ah halka tunnelku qaado kaliya IPv4, Windows wuxuu doorbidan karaa waddada aan tunnelka lahayn xallinta magacyada. Qoyskaas si gooni ah u hubi, maxaa yeelay metrik loo dejiyay IPv4 waxba kama sheegto isaga:
Get-NetIPInterface -AddressFamily IPv6 | Select-Object ifIndex, InterfaceAlias, InterfaceMetricIPv6 dab-daminta adapterka LAN waxay meesha ka saartaa waddadaas iyo borotokoolka la socda; metrik beddelid interface-ka IPv6, ama qaanuun NRPT oo loogu talagalay booska magaca shirkadda, ayaa qoyska haynaya oo hagaajinaya doorashada. Dooro kan cidhiidhiga ah ilaa aad go'aansatay in xiriirkaas uusan IPv6 yeelan karin.
Ku xaqiiji isha la magacaabay, oo haysasho hal mulkiile
Ku xaqiiji qalab sheegaya ishaas oo dhaqan gal ah, ma aha oo kaliya haddii boggu soo rarto:
ipconfig /all
Get-DnsClientServerAddress -AddressFamily IPv4
Resolve-DnsName fileserver.corp.example -Server 10.20.0.10 -Type AKadib kala sooc shaandhaynta iyo xulashada, maxaa yeelay gudaha barnaamijka labaduba isku mid ayay u muuqdaan. block-outside-dns ee OpenVPN waxay xannibtaa port 53 adapters-ka kale; ma dooranayso resolver. Haddii hadda su'aal kastaa guul-darraysto, shaandhayn ayaa laga yaabaa in ay xannibto serverka kaliya ee la gaari karo; haddii resolverka la habeeyay la iska indhatirayo, nidaamka ama qaanuunka booska magacu waa khalad. Labadaba wada beddelidda waxay ka dhigtaa su'aal la xannibay iyo su'aal la iska indhatiray mid aan la kala gudbin karin.
Haysasho hal mulkiile siyaasadda DNS: profile-ka VPN, siyaasad maamul ama qaanuun NRPT, ma aha laba ka mid ah. Ka hor inta aadan xirmin:
- Resolverka la riixay wuu jawaabaa marka si cad loo magacaabo, raadin caadina wuu isticmaalaa.
- Qaanuunka ama metrika aad beddeshay waxay daboolaan qoyska cinwaanka ee runtii qaada su'aalaha.
- Dejintu waxay ka badbaadaysaa go'itaan iyo dib u xir, ama waxaad u rartay profile-ka la kaydiyay.
- Si sax ah hal hab ayaa awood leh, kuwa kalena sidii ay ahaayeen ayaa loo daayay.
U qaado nidaamka sida xaalad deegaan ah ee ma aha shay la dhammeeyo. Mar kale ku hubi ka dib dib u xir iyo ka dib cusboonaysiin Windows ah oo taabta xidhmada shabakadda, maxaa yeelay midkoodna wuu dib u soo bandhigi karaa adapterka jirka ah.