Ngenisa iphrofayili ye-VPN ku-PowerShell nge-Add-VpnConnection

I-Add-VpnConnection yakha amaphrofayili e-Windows omdabu kuphela. Qondanisa i-tunnel nendlela yokuqinisekisa negesiweyi, setha ububanzi ngamabomu, bese uhlola imizila ne-DNS.

Akukho cmdlet ethi Import-VpnProfile, futhi leyo ebukeka iseduze kakhulu, i-Add-VpnConnection, ayilokothi ifunde ifayela le-.ovpn noma le-.conf. Yakha iphrofayili ye-Windows yomdabu ngokusebenzisa amapharamitha owadlulisayo, yingakho iphuzu lokuqala lokuhlola lapha liwufomethi wefayela hhayi umugqa womyalo. Uma igesiweyi ikhuluma SSTP, IKEv2, L2TP/IPsec noma i-PPTP, i-Windows ingaba umnikazi wale phrofayili futhi uhlu olusele luyasebenza. Uma unikezwe ifayela le-OpenVPN noma le-WireGuard, ma ube uyeke esigabeni sokuqala: lawo maklayenti anabangenisi bawo.

Isigaba 1: Qinisekisa iphrofayili i-Windows engaba umnikazi wayo ngempela

Qala ngokugijima Get-Command -Module VpnClient kumshini ngaphambi kwanoma yini enye. I-Windows 10, i-Windows 11 ne-Server 2016 noma kamuva zifika nalesi sigaba; uma singekho, awekho umbhalo okopishiwe ongenza le host yamukele iphrofayili yomdabu. Ama-cmdlet abalulekile yi-Add-VpnConnection, i-Get-VpnConnection ne-Remove-VpnConnection, futhi uhlu lwamapharamitha oluku- sihloko sokubhekisela se-Add-VpnConnection kufanele lufundwe ngokuphelele kanye.

Omdabu kusho ukuthi isitaki se-Windows VPN siqeda i-tunnel. Lokho kufaka i-IKEv2, ngokuvamile enesitifiketi somshini; i-SSTP, okuyi-TLS enokuqinisekiswa komsebenzisi noma kwesitifiketi ngaphakathi; ne-L2TP/IPsec enokhiye owabiwe ngaphambili. Ifayela le-.ovpn iwumbhalo we-OpenVPN, hhayi uxhumano lwe-Windows: ithwala imiyalo efana ne-remote, i-cipher noma i-tls-auth isitaki se-Windows esingayiqondi nhlobo. I-.conf ye-WireGuard iyindaba efanayo ne-PrivateKey ne-AllowedIPs; ukuguqula enye ibe enye akukona ukukhetha ipharamitha kodwa ukuqaliswa kwe-tunnel ehlukile.

Kunegatsha lesithathu. Uma umlawuli ekunika idokhumenti ye-XML ye-VPNv2 CSP noma iphrofayili ye-Intune, leyo yindlela ye-MDM, esetshenziswa yisitaki sokuhlinzeka hhayi i-Add-VpnConnection. Ungawuhumushi lawo magama e-node abe amapharamitha e-PowerShell; esikhundleni salokho buza ukuthi iyiphi indlela esebenzisa i-XML.

Isigaba 2: Hlanganisa uhlobo lwe-tunnel nendlela yokuqinisekisa

-TunnelType ne-AuthenticationMethod amapharamitha ahlukene, futhi igesiweyi ikhathazeka ngokuhlanganiswa kuphela. Thola okukodwa ngokulungile kanti okunye kungelungile uthola iphrofayili engaxhumani nakhi, noma ekhasa ngethuba i-tunnel isivele iphakamile. Setha kokubili ngokusobala esikhundleni sokuthemba okumisiwe okwakukhelwe enye insizakalo.

  • IKEv2 ne-MachineCertificate: iklayenti yethula isitifiketi sekhompyutha; setha futhi i-EncryptionLevel Required.
  • SSTP ne-Eap: i-TLS tunnel kuqala, bese i-PEAP/MSCHAPv2 noma isitifiketi ngaphakathi kwe-EAP. Lokhu kudinga i-XML esigabeni 3.
  • SSTP, L2TP noma PPTP ne-MSChapv2, Chap noma Pap: igama lomsebenzisi neliphasiwedi elijwayelekile, akukho EAP blob.
  • L2TP ne-MSChapv2 ne-Lt2pPsk: i-PSK ihlanganisa ingxenye ye-IPsec, umsebenzisi uhlanganisa i-PPP; kokubili kufanele kufane nesiphakeli.

i-splat igcina amanani endaweni eyodwa:

$p = @{
  Name                 = "Corp IKEv2"
  ServerAddress        = "vpn.example.com"
  TunnelType           = "Ikev2"
  AuthenticationMethod = "MachineCertificate"
  EncryptionLevel      = "Required"
  SplitTunneling       = $false
  DnsSuffix            = "corp.example.com"
}
Add-VpnConnection @p -PassThru

I-PassThru ibuyisa into i-Windows esanda kuyibhala, ngakho ungayihlola ngaphandle kocingo lwesibili. Uma igama selivele likhona i-cmdlet iyenqaba ukugijima; i-Force iyibhala ngaphezulu, okuwukusabela okungalungile kukhompyutha yokusebenza ngoba ilahla buthule noma yini umuntu eyilungiselele ngesandla.

Isigaba 3: Nikeza impahla yobufakazi ngendlela efanele

Amaphasiwedi, okhiye abiwe ngaphambili nama-EAP blob yilapho le mibhalo ivame ukuphuka. I-EapConfigXmlStream ifuna i-XmlDocument, hhayi indlela yefayela, ngakho qala ufunde futhi uguqule uhlobo lwefayela. Ukudlulisa i-stri ngikho kukhiqiza iphutha lokuguqula elizwakala njengenkinga ye-schema futhi lenze abantu babhale kabusha i-XML eyayingakaze ibe nephutha.

$eap = [xml](Get-Content -Raw .\peap-mschapv2.xml)
Add-VpnConnection -Name "Corp SSTP" -ServerAddress "sstp.example.com" `
  -TunnelType Sstp -AuthenticationMethod Eap `
  -EapConfigXmlStream $eap -EncryptionLevel Required

Leyo XML akuyona into okufanele iqanjwe kusukela kusiqeshana sebhulogi. Iveza uhlobo lwendlela ye-EAP nokuqinisekisa kwangaphakathi, futhi igesiweyi iqhathanisa kokubili nenqubomgomo yayo. Indlela yangaphakathi engahambisani ihluleka ngemva kokuqedwa kokuxhawulana kwe-TLS, okubukeka njengephasiwedi engalungile kanye nokungeyona. Thatha i-XML kulowo ophethe igesiweyi, noma yikhiphe kuphrofayili esivele isebenza.

Ku-IKEv2 ingxenye yesitifiketi ukusesha esitolo. I-MachineCertificateIssuerFilter ithatha into yesitifiketi, futhi i-Windows iyisebenzisa ukuthola isitifiketi seklayenti esisebenzisekayo ku-LocalMachine\My. Isitifiketi sidinga ukhiye oyimfihlo nochunge lwesiphakeli esiluthembayo; uma kukhishwa okukodwa, ukuqinisekisa kuhluleka ngaphandle kwemininingwane ewusizo, ngakho hlola isitolo kuqala:

Get-ChildItem Cert:\LocalMachine\My |
  Where-Object { $_.HasPrivateKey -and $_.NotAfter -gt (Get-Date) } |
  Select-Object Subject, Issuer, Thumbprint, NotAfter

Gcina izimfihlo ngaphandle kwefayela lombhalo. I-PSK edluliswa kumugqa womyalo noma efakwe ku-.ps1 igcina emibhalweni, kumaseshini agciniwe nakumakhosombe abiwe, futhi i-RememberCredential igcina ubufakazi bomsebenzisi bakamuva, iguqula ukuhlola kwesikhathi esisodwa kube yimvume ehlala njalo.

Isigaba 4: Nquma ububanzi ngaphambi kokugijima kokuqala

I-cmdlet efanayo ibhala emabhukwini amabili ahlukene ezingcingo. Ngaphandle kwe-AllUserConnection iphrofayili ingeyakho futhi ihlala ngaphansi kwe-%APPDATA%\Microsoft\Network\Connections\Pbk\rasphone.pbk. Nayo, kusukela kuphrompthi ephakanyisiwe, iphrofayili ibonakala kuwo wonke ama-akhawunti, kufaka nesikrini sokungena, futhi ingena ku-%ProgramData%\Microsoft\Network\Connections\Pbk\rasphone.pbk.

Ububanzi akubona ubucwebe. Iphrofayili yabasebenzisi bonke yiyo i-akhawunti yensizakalo, umsebenzi ohleliwe noma isimo sangaphambi kokungena engayisebenzisa; iphrofayili yomsebenzisi oyedwa ayibonakali kulezo zintathu. Izinto zifundwa ngendlela ehlukile futhi: i-Get-VpnConnection ibala okufakwe umsebenzisi wamanje, i-Get-VpnConnection -AllUserConnection ibala okokomshini wonke. Khetha okukodwa manje, futhi thwala ushintsho lwakamuva njengokufufuta nokwakha kabusha hhayi ukuhlela:

# elevated prompt
Remove-VpnConnection -Name "Corp IKEv2" -Force
Add-VpnConnection -Name "Corp IKEv2" -ServerAddress "vpn.example.com" `
  -TunnelType Ikev2 -AuthenticationMethod MachineCertificate `
  -EncryptionLevel Required -AllUserConnection

Isigaba 5: Hlola ukuthi i-tunnel kufanele ihlanganise ini ngempela

Isithonjana esixhunyiwe sifakaza ukuthi i-tunnel iphakamile futhi akukho okunye. Xhumana kusukela kumugqa womyalo kuqala ukuze ukwehluleka kufike njengombhalo, hhayi idayalogi, bese ufunda lokho i-Windows ekubhalile:

rasdial "Corp IKEv2"
Get-VpnConnection -Name "Corp IKEv2" |
  Select-Object Name, ServerAddress, TunnelType, ConnectionStatus, SplitTunneling
Get-NetRoute -DestinationPrefix "0.0.0.0/0"

Ukwehluleka okubili abasebenzisi abakubikayo ngenkathi isimo sisathi Kuxhunyiwe i-DNS nokuhamba kwemizila. Sombulula igama langaphakathi bese ubheka ukuthi iyiphi isiphakeli ephendulile; iphrofayili engenayo i-DnsSuffix ingakha i-tunnel ngokuphelele futhi yehluleke konke ukusesha kwe-intranethi. Bese bheka umzila omisiwe: uma i-split tunneling ivaliwe, umzila we-0.0.0.0/0 onemethrikhi ephansi kakhulu kufanele ukhombe engxenyeni ye-VPN, futhi uma uvuliwe kuphela iziqalo ozilindele kufanele. Uma kokubili kubukeka kulungile futhi ithrafikhi isafa, inkinga ingale kwephrofayili, kunqubomgomo noma kusihlungi segesiweyi.

Uma uxhumano lwehluleka ngokuphelele, ikhodi inciphisa isigaba okufanele ubuyele kuso:

  • 691: igesiweyi yenqaba ubufakazi. Buyela esigabeni 3, hhayi ku-tunnel.
  • 809: ukuxhawulana kwe-IKEv2 akuzange kuqedwe. Hlola i-UDP 500 ne-4500, nokwethenjwa kwesitifiketi.
  • 789: ukhiye owabiwe ngaphambili we-L2TP/IPsec awukho noma awulungile.
  • 868: igama lesiphakeli alizange lixazululwe. Lungisa i-DNS ngaphambi kokuhlela iphrofayili.

Gcina umyalo osebenzayo eduze nezilungiselelo eziwufihlayo, ukuze umuntu olandelayo akwazi ukwakha kabusha esikhundleni sokuhlehlisa ubunjiniyela bephrofayili kusukela ku-UI. Uma kufanele wakhe kabusha, susa okufakiwe bese wakha futhi ngamapharamitha afanayo; ukulungisa iphrofayili elungiselelwe ingxenye kushiya imizila endala nesimo sokuqinisekisa. Futhi uma ifayela lalingakaze libe lomdabu, buyela kuklayenti engumnikazi walo. I-.ovpn egqokiswe njengephrofayili ye-IKEv2 akukona ukungenisa, yithikithi losizo.

Izihloko ezihlobene