I-LocalSubnet kumthetho we-firewall ye-SMB ngeke ihlanganise amaklayenti e-VPN
Umthetho wemvume we-LocalSubnet uhlanganisa ama-subnet aseva siqu, hhayi ichibi le-VPN eliqondisiwe. Qhathanisa ikheli lomthombo uthola iseva ngaphambi kokwandisa ububanzi.
Amadesktophu asehhovisi afinyelela ekwabelwaneni, abasebenzisi be-VPN baphelelwa isikhathi, futhi i-akhawunti efanayo isebenza kusuka ku-hotspot yocingo. Izimvume zokwabelwana azivamisile ukuba umehluko; ikheli elifika kuseva yamafayela liyona ngokuvamile. Umthetho okhawulelwe ku-LocalSubnet uvumela ama-subnet aseva siqu axhunyiwe, futhi ichibi le-VPN eliqondiswe ngokwehlukile akulona elinye lawo. Imiklamo emibili ivala lesikhala, futhi ishiya amarekhodi ahluke kakhulu.
Imiklamo emibili, uphawu olulodwa
Umklamo wokuqala wengeza ichibi le-VPN esimweni sekheli elikude lomthetho. Iseva ibona ikheli lethunjeli lekhasimende ngalinye, ngakho amalogi ayo angahlukanisa umsebenzisi okude oyedwa komunye. Umklamo wesibili uqondisa ithrafikhi ye-VPN ngokusebenzisa isango eliyihumusha ekhelini le-LAN ngaphambi kokuba iseva ilibone. Lokho kubuyisela ukuxhumana futhi kususa umehluko esigabeni esifanayo.
Ithebula lichaza izindima hhayi amakheli, futhi iziqalo zakho zinquma ukuthi yimuphi umugqa osebenza. Phrinta amanani angempela eseva esikhundleni sokukopa isibonelo kumbhalo weblogi:
Get-NetIPAddress -AddressFamily IPv4 | Select-Object InterfaceAlias, IPAddress, PrefixLengthIthebula liyinsiza yesinqumo, akusona isitatimende ngakho konke ukusetshenziswa. Umsingathi onezixhumi ezengeziwe, isixhumanisi sesizinda sesibili noma imaski ehlukile unesethi yendawo ehlukile.
| Path the packet takes | Address the server records | Filter scope that admits it | What the log can still tell you |
|---|---|---|---|
| Desktop on the server LAN | Its own LAN address | LocalSubnet or the LAN prefix | Which workstation connected |
| Client on the routed VPN pool | Its tunnel address | The VPN pool as a remote address | Which VPN account connected, if the pool is logged |
| Client behind source NAT at the gateway | The gateway's LAN address | The gateway address | Only that some VPN user connected |
| Site-to-site gateway | The remote gateway's tunnel address | The remote site's prefix | Which site connected, not which user |
Incwadi yokubhekisa ye-New-NetFirewallRule yakwa-Microsoft ibhala izimo zamakheli akude negama elingukhiye i-LocalSubnet. Yifunde ngaphambi kokunquma ukuthi igama elingukhiye lisho wonke amakheli angasese, ngoba akunjalo.
Qhathanisa lokho iseva ekutholayo ngempela
Funda umthetho osebenzayo hhayi lowo umuntu akhumbula ukuthi wawudala. Hlola ukuthi unikwe amandla, usebenza kuphrofayela esebenzayo, futhi isimo sekheli elikude sihambisana nomthombo iseva ewubonayo. Umthetho onikwe amandla kuphela kuphrofayela ye-Domain awenzi lutho lapho i-adaptha isidlulele ku-Public ngemuva koshintsho lwenethiwekhi.
Get-NetFirewallRule -DisplayGroup 'File and Printer Sharing' | Get-NetFirewallAddressFilter
Get-NetFirewallProfile | Select-Object Name,Enabled,DefaultInboundActionUmyalo wokuqala uphrinta izihlungi zamakheli ezixhunywe emithethweni yokwabelwana ngamafayela, futhi owesibili ukhombisa ukuthi yimaphi amaphrofayela asebenzayo nokuthi ithrafikhi engenayo engahambisani isingathwa kanjani. Funa futhi umthetho wokuvimba nenqubomgomo ephethwe maphakathi. Imithetho yokuvimba iba phambili kunemithetho yemvume, futhi inqubomgomo evala ukuhlanganiswa kwemithetho yendawo ingenza isibonelelo sendawo esisha singasebenzi.
Lena yisimo lapho umthetho ubonakala ulungile kukhonsoli futhi ungenamthelela kuthrafikhi. Hlola ukwabiwa kwephrofayela ngasikhathi sinye, ngoba ikhompyutha ephathekayo ejoyine enye inethiwekhi ingadlulela kuphrofayela ye-Public ngaphandle kokuthi kukhona othinta i-firewall.
Hlola ukuthutha ngaphambi kokungena
Ihlukanise ukufinyeleleka nokuqinisekisa. Umsakazi ku-TCP 445 ufakazela ukuthi isevisi iboshelwe embobeni; akufakazeli ukuthi iphakethe elikude lingafinyelela kuwo. Ukuxhumana kwe-TCP okuqediwe, ngakolunye uhlangothi, akukasho lutho mayelana nokusethwa kweseshini ye-SMB noma izimvume zokwabelwana. Hlola ukuxhawulana kusuka kuzinhlangothi zombili ngaphambi kokuhlela umthetho.
Test-NetConnection -ComputerName files.corp.example -Port 445
Test-NetConnection -ComputerName files.corp.example -Port 445 -InformationLevel DetailedUmyalo wokuqala ubika ukuthi ukuxhawulana kwe-TCP kuyaphumelela yini kusuka kumshini owusebenzisayo, futhi owesibili wengeza ikheli elixazululiwe nemininingwane yesixhumi. Yisebenzise kusuka kuklayenti ye-VPN nakudesktophu yasehhovisi, bese uqhathanisa. I-Ping ayiphenduli imibuzo yomibili, ngoba i-ICMP ingavinjwa ngenkathi i-SMB ivuliwe, noma ivunyelwe ngenkathi i-firewall ilahla u-445.
Uma ukuxhawulana kwehluleka kusuka ku-VPN kuphela, ububanzi bomthombo yisoliso esiyinhloko. Uma kuphumelela futhi ukwabelwana kusala kukunqaba, dlulela ekuxilongeni kweseshini nezimvume ze-SMB esikhundleni sokuhlela imithetho ye-firewall.
Lapho i-NAT yomthombo isusa umehluko
Uma kunokuhumusha endleleni, iseva ayikwazi ukuhlukanisa amaklayenti e-VPN ngamanye ngekheli. Wonke umsebenzisi okude ufika njengesango. Noma yikuphi ukugunyazwa okuncike ekubahlukaniseni kufanele kusetshenziswe lapho ubunikazi babo busabonakala khona, okuvame ukusho isihlanganisi se-VPN noma i-proxy eqinisekisayo. Umthetho we-firewall ungavumela ithrafikhi; awukwazi ukubuyisela umehluko owususwe ukuhumusha.
Lapho lelo kheli lesango livunyelwe, wonke umsebenzisi okude ubhaliswa ngaphansi kwekheli elilodwa, ngakho umthetho unikeza lonke ichibi kunoma ubani ongafinyelela isango. Uma isinqumo somsebenzisi ngamunye sibalulekile, gcina amakheli okuqala ebonakala noma hambisa isinqumo esigabeni esisaziyo umsebenzisi. Uma kungenjalo wonke umsebenzisi okude uzuzwa njengefa izimvume zekheli elilodwa iseva engalibona, futhi umkhondo wokucwaninga awusakwazi ukubahlukanisa. Leso yisinqumo somklamo, hhayi imininingwane ye-firewall.
Khetha ngamabomu phakathi kwemiklamo emibili. Khawulela umthetho echibini le-VPN langempela lapho iseva kufanele ibone ukuthi ubani oxhunyiwe, futhi wamukele indlela ehumushiwe kuphela lapho iseva ingayidingi ngempela leyo mininingwane. Bhala ububanzi bomthombo obukhethiwe eceleni komthetho, ngoba umuntu olandelayo ozolungisa lokhu uzobheka ithebula lamakheli kuqala.