WSL2 ma dhaxlo VPN-ka shirkadda, waana taas khaladka

Wiki-ga gudaha wuxuu ku furmaa Edge, halka git clone gudaha qaybinta uu waqti ka baxo. Observation-kan keliya waxaa badanaa loo akhriyaa «VPN-ku wuxuu xannibayaa WSL2», saacadda xigta waxay ku baxdaa wax ka beddelka /etc/resolv.conf. Akhrinta waxtarka badan ayaa ah in WSL2 uusan marnaba lahayn waddada shabakada martigeliyaha: wuxuu ku shaqeeyaa VM caawinaad leh oo leh adapter u gaar ah, waddooyin u gaar ah iyo fayl resolver oo Windows u abuuray. Wax kasta oo soo socda waxay ku xiran yihiin midka saddexdan ah ee dhab ahaan kaa maqan.

VM-ku wuxuu leeyahay stack, mitir iyo resolver u gaar ah

Habka caadiga ah ee NAT, qaybintu waxay fadhiisataa gadaasha switch virtual ah oo waxay internetka ka gaadhaa martigeliyaha, laakiin ma arko adapters-ka martigeliyaha. ip addr wuxuu muujinayaa hal interface oo leh cinwaan gaar ah, ip route wuxuu muujinayaa waddo caadi ah oo dhex mara switch-kaas, /etc/resolv.conf waa fayl la abuuray oo tilmaamaya stub resolver uu Windows doortay. Midkoodna ma beddelo sababtoo ah macmiil VPN ayaa ka bilaabmay dhinaca Windows.

Taasi waa sababta «browser-ku wuu shaqeeyaa» u caddeeyo wax yar. Browser-ku wuxuu isticmaalaa stack-ga martigeliyaha, tunnel-ka iyo siyaasadda resolver-ka martigeliyaha. Shell-kaaga wuxuu isticmaalaa stack kale oo si kedis ah ula wadaaga kaadhka shabakada jirka. Way ku heshiiyaan xaaladda wanaagsan oo way kala duwanaadaan si sax ah marka VPN-ku rakibo filter, dib u qoro liiska DNS ama ku daro waddo subnet-ka switch virtual-ka.

Laba tijaabo ayaa go'aamiya adduunka aad ku jirto, waana in lagu dhex socodsiiyo qaybinta:

getent hosts example.com
curl -sS -m 8 -o /dev/null -w "%{http_code}\n" 1.1.1.1
ip route
cat /etc/resolv.conf

Magacyada oo guuldareysta inta cinwaan xaraf ah jawaabayo waa dhibaato resolver. Magacyada iyo cinwaannada oo wada guuldareysta waa dhibaato waddo, mana jirto wax ka beddel resolver ah oo taabanaaya. Markaas waxaa yimaada caddaynta dhinaca Windows: Get-NetAdapter | Get-DnsClientServerAddress iyo route print -4 waxay muujinayaan in tunnel-ku qabsaday subnet-ka uu VM-gaagu ku nool yahay.

Khalladka koowaad: server-yada DNS ee shirkaddu waa xalliyaan

Wax ka beddelka faylka resolver waa talada caadiga ah, oo waa sax qiyaastii kala badh. Marka uu sax yahay, wuxuu u sax yahay sabab gaar ah: faylka la abuuray wuxuu tilmaamayaa resolver yaqaan kaliya magacyo dadweyne, sidaas darteed weydiinta intranet.example.internal waxay ku soo noqotaa sidii aan jirin inkastoo waddadu fiican tahay.

Inaad dhejiso server-yada VPN waxay la macno tahay in la joojiyo Windows dib u abuurista faylka, sababtoo ah fayl kasta oo gacanta lagu qoro waa la beddelaa bilowga xiga:

[network]
generateResolvConf = false

Kaydi taas sida /etc/wsl.conf, ka socodsii wsl --shutdown Windows, ka dib bilow qaybinta oo qor /etc/resolv.conf iyada oo server-yada tunnel-ka hor socdaan iyo resolver dadweyne oo keliya kayd ahaan. Kani waa isbeddel waaraya oo leh kharash dayactir: faylku mar dambe ma raaco martigeliyaha, marka cinwaannada DNS ee shirkaddu isbeddelaan qaybintu waxay sii weyddiinaysaa kuwii hore. Qof waa inuu milkiilo faylkaas.

Waxba ma qabato marka guuldarradu ballaadhan tahay. Haddii curl ilaa 1.1.1.1 waqti ka baxo, macmiilka tunnel-ku wuxuu filter-gareynayaa switch virtual-ka ama wuxuu subnet-ka VM u jiheynayaa tunnel-ka, resolver sax ahna wuxuu ku siinayaa kaliya magacyo aan weli la gaari karin.

Khalladka labaad: isbeddelka mitirku wuu sii jiraa

Marka magacyadu xalliyaan laakiin taraafikadu ka baxdo adapter-ka jirka, metrics-ka interface-ka ayaa ah kabaalka. Siin adapter-ka VPN kharash sare iyo switch-ka WSL kharash hoose:

Get-NetAdapter | Where-Object InterfaceDescription -Match "AnyConnect" | Set-NetIPInterface -InterfaceMetric 4000
Get-NetIPInterface -InterfaceAlias "vEthernet (WSL)" | Set-NetIPInterface -InterfaceMetric 1

Markaas xusuuso in qaybo badan oo macmiil ah adapter-ka tunnel-ka dib loo abuuro isku xir kasta oo metric-ku ku noqdo caadigiisa. Amar hal mar ah waa hagaajin si aamusan u dhacda, badanaa inta lagu jiro usbuuc-dhammaad, oo tikidku wuxuu ku soo noqdaa «usbuucii hore way shaqeynayay». Hawl qorsheysan oo ay kiciso dhacdada VPN, ama script uu isticmaaluhu socodsiiyo isku xirka ka dib, ayaa ah nooca daacadda ah ee hagaajintan.

Isku-dhiciddaas oo kale waxay khuseysaa waddooyinka martigeliyaha ee loo daray hal prefix adag. Waxay qiimo leeyihiin ogaal ahaan, sababtoo ah waxay sheegaan in dhibaatadu tahay hal meel ama waddada oo dhan, laakiin ma aha dhismo.

Khalladka saddexaad: hal hagaajin ayaa daboolaya qayb kasta oo Windows ah

wsl-vpnkit waa qaabka sidecar: qaybin yar ayaa leh waddada dhinaca martigeliyaha oo u gudbisa qaybaha kale iyada oo u maraysa socket virtual, sidaas darteed taraafikada codsiyadu waxay joojisaa ku tiirsanaanta switch-ka la filter-gareeyay. Waxay u baahan tahay in waddada caadiga ah ay shaqeyso, taas oo macnaheedu yahay in laga saaro overrides-ka networkingMode iyo dnsTunneling faylka %UserProfile%\.wslconfig, dib loo soo celiyo generateResolvConf = true qaybin kasta oo shaqeynaya oo adeegga la bilaabo gelitaanka.

Habka muraayadda waa beddelka lagu dhex dhisay Windows 11 22H2 iyo kuwa ka dambeeya, waana hal dejis ah iyo hal damis:

[wsl2]
networkingMode=mirrored

Gudaha qaybinta ip addr markaas wuxuu liis garayaa adapter-ka martigeliyaha, tunnel-ku wuxuu ka dhex muuqan karaa, iyo DNS tunneling-ku wuxuu weydiimaha u gudbiyaa resolver-ka Windows xitaa marka macmiilku dib u qoro liiska DNS. Ma aha mid caalami ah: drivers-ka filter qaarkood weli way tuurayaan waddada muraayadda, iyo xeerarka firewall-ka Hyper-V waxaa laga yaabaa inay u baahdaan fasax cad. Hagaha shabakada WSL ee Microsoft waa bogga ay tahay in lagu barbardhigo qaybintaada ka hor intaadan codsan qaab loo qoray mid cusub.

Ka dib isbeddel kasta tijaabi saddex arrimood

Dooro hal farsamo matoor kasta oo qor, sababtoo ah labaduba si xun bay isugu yimaadaan. Sidecar ku dul habka muraayadda wuxuu labanlaabmaa gudbinta, martigeliyaha muraayadda oo leh gelitaan sidecar duugoobay .wslconfig wuxuu u muuqdaa inuu guuldareysto casriyeyn ka dib, halka ka hor.

Wax kasta oo aad dooratay, tijaabada aqbalaadda waa isla saddexda codsi ee gudaha qaybinta: magac gudaha, magac dadweyne iyo cinwaan ceyriin. Markaas ku celi ka dib goynta iyo dib u xirka tunnel-ka, iyo ka dib wsl --shutdown. Kaliya magaca gudaha oo guuldareysta waa siyaasad resolver; magaca gudaha iyo kan dadweynaha oo wada guuldareysta iyada oo cinwaanku shaqeynayo weli waa siyaasad resolver; wax walba oo guuldareysta waa waddada.

Haddii hal martigeliyaha gudaha guuldareysto inta inta kale shaqeynayaan, jooji fiirinta resolver oo raadi waddo maqan oo loogu talagalay prefix-kaas. Haddii wax walba shaqeeyaan ilaa isku xirka xiga, waxaad heshay hagaajin ku xiran xaaladda waqtiga socodka, waana in si otomaatig ah dib loo codsado ama lagu beddelo mid ka mid ah labada farsamo ee kor ku xusan.