Ingabe i-Firewall ivimba i-VPN? Ukuhlola isinyathelo ngesinyathelo

Isikhathi esisodwa sokuphela se-VPN sikhombisa ukuthi akukho impendulo esebenzisekayo efikile, futhi akukhombisi lutho mayelana nesizathu. Iphrofayela ingase ibalule iphothi elingalungile, iseva ingase icishiwe, noma isicelo singafika ngaphandle kwendlela yokubuya esebenzayo. Ngakunye kwalokhu kushiya umkhondo ohlukile, futhi umkhondo yiwona otshela ukuthi yimuphi umthetho okufanele uwuthinte. Landela izigaba ezine ngezansi ngokulandelana. Misa ngokushesha lapho esinye sazo sichaza uphawu.

Isigaba 1: qinisekisa iseva nokuthuthwa

Funda igama leseva, ukuthuthwa kanye nephothi kuphrofayela yamanje yomhlinzeki hhayi ekushintsheni kwasekhaya. Iphothi eshintshiwe kukhompyutha yakho akukwazi ukwakha isilaleli kuseva yomphakathi, futhi lokho kungafani kukhiqiza isikhathi sokuphela esifana nokuvalwa. Uma iphrofayela inikeza ukuthuthwa okunye okusekelwayo, kubhale njengezinye izindlela hhayi njengesixazululo. Xazulula igama futhi uqhathanise impendulo nekheli elishicilelwe umhlinzeki.

Irekhodi le-DNS elidala lithumela iklayenti kumsingathi ongakaze aphendule. Lokho kungenye iphutha elilingisa isihlungi, futhi ukulikhipha kudla umbuzo owodwa.

Bhala kokubili amanani kuthikithi. Konke ukuqhathanisa okulandayo kuwasebenzisa, futhi ithikithi elingenawo liqala uphenyo phansi.

Isigaba 2: khombisa indlela ngokuqhathanisa okukodwa okulawulwayo

Shiya idivayisi nephrofayela kungashintshiwe bese uzama enye inethiwekhi yokufinyelela ethembekile. Uma umhubhe ukhuphuka lapho, umehluko yindlela yasekuqaleni noma inqubomgomo yayo. Uma idivayisi yesibili egunyaziwe isebenza kunethiwekhi yasekuqaleni, umehluko yidivayisi yokuqala. Okukodwa kwalokhu kuqhathanisa okubili cishe njalo kuyanquma.

Qala ngokuqedela noma yikuphi ukungena kwenethiwekhi okusemthethweni, ngoba ingosi eboshiwe ibonakala njengokuvalwa ize iqedwe.

Hlola iphothi oyisebenzisayo ngempela, futhi thatha umphumela we-TCP njengolwazi mayelana ne-TCP kuphela.

Resolve-DnsName vpn.corp.example
tracert -h 8 -w 500 vpn.corp.example
Test-NetConnection vpn.corp.example -Port 443 -InformationLevel Detailed

Ukuxhawulana kwe-TCP okuphumelelayo kuphothi 443 kusho ukuthi isilaleli siphendule lapho. Akusho lutho mayelana nesilaleli se-UDP ku-51820, futhi akusho nokuthi izingxoxo ziqediwe yini.

Isigaba 3: funda izehlakalo zokuphepha zesikhathi sokwehluleka

Izehlakalo ze-firewall ziwubufakazi obunamandla kakhulu obukhona, futhi zinexwayiso okufanele lishiwo kokuqala. Ukuloga kucishiwe kumaphrofayela amaningi okusile, ngakho hlola ukuthi iphrofayela efanele iyaloga yini ukulahla ngaphambi kokufunda ilogi engenalutho njengobufakazi bokungabi nacala. Uma ukuloga kuvuliwe, isehlakalo sisho umthetho, isiqondiso namakheli, okuyikho kanye okudingwa ukushintshwa komthetho. Imithetho yezinhlelo zokusebenza nemithetho yamaphothi ziyizinto ezihlukene, futhi inqubomgomo elawulwayo ingadlula isilungiselelo sasekhaya. Qinisekisa ukuthi umthetho uhlanganisa yiphi iklayenti futhi yiphi insizakalo ngempela.

Qoqa isimo sephrofayela nezehlakalo zakamuva kumshini owehlulekile, hhayi kumsingathi osondele.

Funda isikhathi sesehlakalo ngokuqhathanisa nesikhathi somzamo wakho wokuhlola, ngoba igama lomthetho elihambisana nesigxivizo sesikhathi esihlukile liyingozi nje.

Get-NetFirewallProfile | Select-Object Name, Enabled, DefaultInboundAction, LogBlocked
Get-NetFirewallRule -Enabled True -Direction Outbound | Where-Object DisplayName -match 'VPN'
Get-WinEvent -LogName 'Microsoft-Windows-Windows Firewall With Advanced Security/Firewall' -MaxEvents 20

Kuseva oyilawulayo, buza ukuthi isicelo safinyelela isilaleli yini. Iphakethe elifika ngaphandle kwempendulo inkinga yokudlulisela noma yendlela yokubuya. Isicelo esingakaze sibonakale inkinga yokuhlunga noma yekheli.

Isigaba 4: hlola ukudlulisela ngemva kokuba umhubhe ukhuphukile

I-firewall ingavumela isikhathi bese inqaba konke isikhathi esifuna ukusifinyelela. Ama-sysctl okudlulisela, imithetho ye-NAT kanye nezindlela zokubuya konke kungemva kokuqinisekisa, futhi ukukhululwa okubanzi kwephothi le-VPN akulungisi neyodwa yazo. Hlola indawo eyodwa yangaphakathi nendawo eyodwa ye-inthanethi ngokwehlukana, ngoba ngokuvamile zihluleka ngezizathu ezihlukile. Uma amagama angaphakathi ehluleka kodwa amakheli esebenza, bheka i-DNS epushwayo ngaphambi kwanoma yimuphi umthetho.

Gxuma izivivinyo ezintathu ngezansi kuseva ngenkathi iklayenti lixhunyiwe futhi lizama isicelo esihlulekayo.

Izibali kusixhumi sendlela yomhubhe ziyona ndaba, ngoba zikhombisa ukuthi amaphakethe angene yini nokuthi kukhona okuphumile yini.

sysctl net.ipv4.ip_forward
nft list ruleset | grep -n -E 'forward|masquerade'
tcpdump -ni tun0 -c 10

Uma amaphakethe efika kumhubhe futhi kungaphumi lutho olubheke endaweni, umsolwa ukudlulisela noma i-NAT. Uma kungafiki lutho, isikhathi sikhuphukile kodwa iklayenti alithumeli, futhi indawo okufanele ibhekwe ithebula lemizila yeklayenti.

Qinisekisa ukulungiswa bese ususa okungasizanga

Ngemva kokulungiswa okugunyaziwe, phinda kahle lokho kuhlola okwehluleka futhi urekhode umphumela kuyo leyophrofayela nedivayisi. Bese ususa noma yikuphi ukukhululwa kwesikhashana okungashintshanga umphumela, ngoba ukukhululwa okungasetshenziswanga kuyanqwabelana futhi ngakunye kuyisinqumo okungekho oyikhumbulayo. Gcina okusele kuncane: indawo eyodwa, iphothi elilodwa, isiqondiso esisodwa, umnikazi oyedwa.

Gxuma futhi imiyalo emithathu efanayo bese uyiqhathanisa nokukhishiwe okulondoloze ngaphambi koshintsho.

Test-NetConnection vpn.corp.example -Port 443 -InformationLevel Detailed
tracert -h 8 -w 500 vpn.corp.example
Get-NetFirewallRule -Enabled True | Where-Object DisplayName -match 'VPN' | Select-Object DisplayName, Action

Uma inethiwekhi yokuqhathanisa isebenza, inethiwekhi yasekuqaleni isehluleka futhi izehlakalo zihlala zingenalutho, umsolwa osele indlela hhayi umsingathi. Dlulisela lokho kumnikazi wenethiwekhi njengesitatimende esiqondile, unamathisele kokubili imiphumela yokuqhathanisa. Leyo indawo engcono yokuma kunephrofayela ye-firewall evaliwe.