Indlela yokuhlola ukuthi i-VPN ku-Windows ihambisa ini ngempela ku-PowerShell

Ithayela le-VPN elixhunyiwe alifakazeli ukumbozwa. Funda ifulegi yephrofayili egciniwe, ithebula lemizila ebukhoma nemithetho ye-NRPT ngalo lokhu kulandelana.

Ngixhume iklayenti le-VPN kukhompyutha ephathwayo ye-Windows 11, ithayela lashintsha laya ku-Connected, isabelo sefayela langaphakathi savuleka, futhi isiza somphakathi sasilokhu silayisha ngqo kusuka ku-Wi-Fi yasehhovisi. Le nhlanganisela ibukeka njengomhubhe ophukile. Kodwa lokhu kuwumphumela ojwayelekile wephrofayili ethumela ingxenye yethrafikhi nge-VPN bese ishiya okusele ku-adaptha yomzimba. Ukuhamba komhubhe okuphoqelelwe kushintsha ukuthi yimuphi umzila ozenzakalelayo i-Windows ewukhethayo; akususi imizila eqondile kakhulu futhi akuthembisi ukuthi ithrafikhi izoma lapho uxhumano luphuka. Okulandelayo ukulandelana engikulandelayo lapho iklayenti lithi linokumbozwa: isimo sekhayenti, iphrofayili egciniwe, imizila esetshenzisiwe, isixazululi, bese kuba yimifudlana yangempela.

Qala ekhyentini, bese uyeka ukuyethemba

Iklayenti iyindawo efanele yokuqala kuphela ngoba isho ukuthi iyiphi iphrofayili esebenzayo. Vula izakhiwo zoxhumano bese ubhala igama lephrofayili eliqondile, ukuthi yadalelwa umsebenzisi wamanje noma wonke umuntu kumshini, nokuthi iyiphi i-adaptha evelayo ku-ncpa.cpl ngemuva kokuxhuma. Kumakhompyutha ami okuhlola i-adaptha yayiphethe igama lephrofayili, okwenza umphumela wemizila ufunde kalula. Kweminye imishini ivela njengokufakwa kwe-WAN Miniport futhi igama alikutsheli lutho.

Into iklayenti elingakwazi ukuyitshela ukumbozwa. Ithayela elixhunyiwe lichaza isimo somhubhe, hhayi uhlu lwezindawo. Amaklayenti ezinkampani zangaphandle nawo agcina ukucushwa kwawo, ngakho iphrofayili yemvelo ye-Windows, nakho konke okwakhiwo ozokufunda kuyo, kungenzeka kungahlobani nalokho okufakwa yilelo klayenti. Uma i-VPN ifike nge-AnyConnect, OpenVPN GUI, WireGuard noma i-ejenti yomthengisi, izivivinyo ze-PowerShell ngezansi azisebenzi kakhulu futhi kufanele ufunde izilungiselelo zalezo klayenti ze-split-tunnel nokuhamba kwemizila.

Funda iphrofayili egciniwe, hhayi ithayela

Kuyephrofayili yemvelo ye-Windows (IKEv2, L2TP, SSTP noma leyo ephushwa yi-MDM) isinqumo se-split-tunnel esigciniwe siyisakhiwo esisodwa:

Get-VpnConnection -Name 'Office' | Select-Object Name, ServerAddress, SplitTunneling, DnsSuffix

Engeza -AllUserConnection lapho iphrofayili yadalelwa wonke umuntu kudivayisi. Ngaphandle kwalo ufunda uhlu lomsebenzisi wamanje, ongase ube lutho noma ube nokunye ukufakwa okunegama elifanayo. Inani elithi False ku-SplitTunneling lisho ukuthi iphrofayili yagcinwa njengomhubhe ogcwele: i-Windows ifaka umzila ozenzakalelayo ngokusebenzisa i-adaptha ye-VPN. True lisho i-split tunnel, futhi ukumbozwa lapho kuncike ngokuphelele emizileni nasemthethweni yokuxazulula amagama ephushwa yileyophrofayili.

Thatha lelo nani njengokucushwa, hhayi njengokubonwa. Libhala lokho iphrofayili eyakucela ngesikhathi sokuxhuma. I-Windows ingase igcine inemizila esetshenzisiwe ehlukile, ngenxa yomzila oqondile kakhulu wenye i-interface, isilungiselelo senqubomgomo noma ukufakwa okusalile kuxhumano lwangaphambilini, ngakho i-Boolean ayikaze iyixazulule yodwa imibuzo.

Qhathanisa inani eligciniwe nethebula lemizila esetshenzisiwe

Ngemuva kokuxhuma, bhala imizila ku-adaptha yomhubhe esikhundleni sokuskrola ithebula lonke:

$vpn = Get-NetAdapter | Where-Object InterfaceDescription -match 'VPN|WAN Miniport'
Get-NetRoute -InterfaceIndex $vpn.ifIndex | Sort-Object DestinationPrefix
Find-NetRoute -RemoteIPAddress 10.20.4.15 | Select-Object -First 1

Find-NetRoute ingxenye ewusizo. Ipendula umbuzo iklayenti elingakaze uliphendule: kule ndawo, iyiphi i-interface futhi iyiphi ikheli lomthombo i-Windows ezolisebenzisa ngempela? Yisebenzise kumphathi wangaphakathi, kumphathi womphakathi nakho konke ocabanga ukuthi kuwukukhishwa ngamabomu. Iphrofayili yomhubhe ogcwele kufanele ibonise i-interface yomhubhe kukheli lomphakathi. Iphrofayili ye-split tunnel ivamise ukubonisa i-adaptha yomzimba lapho kuyilapho iziqalo zangaphakathi zisaxazululelwa ku-VPN.

Amagibe amabili achaza iningi lemibiko ethi «ihambisa ohlangothini olungalungile». Isiqalo esiqondile kakhulu sihlala sinqoba, ngakho i-/24 ku-adaptha yomzimba yehlula umzila ozenzakalelayo ku-VPN noma ngabe imethrikhi yomhubhe iphansi kangakanani. Imethrikhi ixazulula kuphela ukulingana phakathi kwemizila yesiqalo esisodwa. Futhi i-IPv4 ne-IPv6 kunqunywa ngokwehlukana: iphrofayili ehlanganisa i-0.0.0.0/0 ingase ishiye i-IPv6 kusixhumanisi sasendaweni, okwenza isiza esinezingqimba ezimbili sibukeke njengengxenye yomhubhe. Hlola Get-NetRoute -AddressFamily IPv6 ngaphambi kokuphetha ngokuthi umhubhe ulungile.

What you seeMost likely causeCheck next
Public traffic leaves the physical adapter while SplitTunneling reads FalseA more specific route on that adapter wins over the tunnel defaultFind-NetRoute for the exact destination, then look for a /24 or host route on the physical interface
Internal name fails, internal IP worksNo NRPT rule for that namespace, or a broader rule matches firstGet-DnsClientNrptPolicy and the namespace order
A dual-stack site opens directly while IPv4 uses the tunnelThe profile covers only the IPv4 default routeThe IPv6 route table on both interfaces
Routes look right but one app still goes directThe app uses its own proxy, or the client keeps a per-app listThe app's proxy settings and the client's application list

Hlola ukuxazululwa kwamagama ngokwehlukana nge-NRPT

Amagama angaphakathi ahlulekayo kuyilapho amakheli e-IP angaphakathi esebenza akhomba kunqubomgomo yesixazululi, hhayi ekuhambeni kwemizila. I-Windows inquma i-DNS ngesikhala ngasinye samagama ngokusebenzisa ithebula lenqubomgomo yokuxazulula amagama, elizimele kunethebula lemizila:

Get-DnsClientNrptPolicy -Effective | Select-Object Namespace, NameServers
Get-DnsClientServerAddress -InterfaceIndex $vpn.ifIndex

Lapho umthetho uhambisana ne-*.corp.example, imibuzo yaleso sikhala samagama iya kumaseva e-DNS omhubhe noma ngabe indlela yedatha eya kulawo maseva isalokhu ku-adaptha yomzimba kumodi ye-split tunnel. Lowo umklamo, futhi yingakho ukuhlolwa kwesiphequluli esivula isiza somphakathi akusho lutho ngamagama angaphakathi. Uma i-adaptha ibhala amaseva alindelekile kodwa ukusesha kusaya kwenye indawo, qhathanisa ukulandelana kwemithetho ye-NRPT futhi uhlole ukuthi isikhala samagama esiqondile kakhulu sihambisana kuqala yini.

Qinisekisa imifudlana, bese unquma ukuthi wacela ini ngempela

Dlula ezindaweni ngokulandelana okugxilile ukuze imiphumela iqhathaniseke phakathi kwemishini: ikheli lomphakathi, ikheli langaphakathi, igama langaphakathi nokukhishwa okukodwa ngamabomu njengephrinta yasendaweni noma ucingo lwevidiyo. Bhala i-interface nekheli lomthombo i-Find-NetRoute ekubuyisela ngakunye. Ngemuva kwanoma yiluphi ushintsho lwenqubomgomo, xhuma futhi uphinde lezo zivivinyo ezine; ithebula lemizila ngemuva kokuxhuma kabusha liwubufakazi kuphela bokuthi iphrofayili entsha isiqalile ukusebenza.

Bese uhlukanisa ukuhamba kwemizila nokuphoqelela. Umhubhe ophoqelelwe ukhetha umhubhe wethrafikhi ehlanganisiwe ngesikhathi umhubhe umile. Akusona isicishamlilo. Uma isidingo sithi akukho okuzophuma emshinini lapho umhubhe uwela, lokho kufanele kuvele kumklamo ovimbayo: iphrofayili ye-firewall eboshelwe esimweni somhubhe, iphrofayili ehlala ivuliwe enezihlungi zethrafikhi noma inketho yeklayenti yomthengisi yokuvala-lapho-kwehluleka. Umhubhe ophoqelelwe kufanele futhi ushiye ikheli leseva ye-VPN uqobo lifinyeleleka ngaphandle komhubhe, futhi ukuvimbela kwalo egameni lokuthi «phoqelela konke» kuyindlela ethembeke yokuzivalela ngaphandle koxhumano oluzama ukuluphoqelela.

Ngaphambi kokushintsha noma yini, dlula kulolu hlu. Into ngayinye ehlulekayo inciphisa lapho inkinga yangempela ikhona.

  • Igama nobubanzi bephrofayili kuqinisekisiwe, kusetshenziswe i--AllUserConnection kumaphrofayili omshini wonke.
  • I-SplitTunneling ifundiwe futhi yathathwa njengokucushwa, hhayi ubufakazi bokumbozwa.
  • Imizila ye-adaptha yomhubhe ibhalwe ngokwehlukana ye-IPv4 ne-IPv6.
  • I-Find-NetRoute isetshenzisiwe endaweni eyodwa yomphakathi, eyodwa yangaphakathi neyodwa yokukhishwa.
  • Imithetho ye-NRPT ihloliwe ngaphambi kokusola imizila ngokwehluleka kwegama.
  • Isidingo sokuvimbela sifundwe futhi: ukuhamba okuthandwayo akufani nokuvimbela okuphoqelelwe.

Isinqumo somhubhe ogcwele noma we-split singesomnini wephrofayili, futhi amanothi okuhamba kwe-Microsoft achaza ukuziphatha i-Windows ekusebenzisayo lapho iphrofayili ikubeka. Microsoft: umhubhe ophoqelelwe ne-split isithenjwa engisivula ngesikhathi ngifunda umphumela.

Izihloko ezihlobene