I-VPN ivimba i-LAN yasendaweni ku-Windows: umzila noma inqubomgomo yeklayenti?
Ukufinyelela ku-LAN yasendaweni ku-Windows kuyaphuka ngezizathu ezimbili ezihlukene: umzila ongekho, noma inqubomgomo yesango elahla i-subnet. Izivivinyo ezintathu zisho ukuthi yikuphi.
Iphrinta, i-NAS noma umshini wokuthuthukisa etafuleni lakho siqu uyeka ukuphendula ngesikhathi i-VPN yomsebenzi ixhuma. Ngesinye isikhathi umyalo womzila owodwa uyilungisa ngemizuzwana; ngesinye isikhathi umzila ofanayo ulungile futhi amaphakethe asalahleka, okusho ukuthi ubheka enye inkinga enophawu olufanayo. Isinqumo siza emibuzweni emithathu, futhi ukuyibuza ngokulandelana okungalungile yisizathu sokuthi abantu bachitha ubusuku bonke besusa futhi bengeza imizila.
Imibuzo emithathu ngaphambi kwanoma yimuphi umyalo
Okokuqala: ingabe ikhona ingeno ye-prefix yasendaweni, futhi ikhomba ku-adaptha yomzimba? Okwesibili: ingabe iklayenti lithola imvume noma ukunqatshelwa kwenethiwekhi yasendaweni kusango lapho lixhuma? Okwesithathu: ingabe udinga kuphela ukufinyelela okuphumayo ku-LAN, noma kukhona okuthile ku-inthanethi okufanele futhi kufinyelele isevisi esebenza emshinini wakho?
Umbuzo wokuqala uhlukanisa iphutha lokuhambisa nomzila nephutha lokuhlunga. Owesibili usho ukuthi ukulungiswa komzila kuvunyelwe ukusebenza noma cha. Owesithathu ushintsha ukulungiswa: umzila ulungisa ithrafikhi ephumayo, kanti isevisi engenayo engafinyeleleki ngokuvamile iyinkinga yokubopha isilaleli nendlela yokubuya umzila oyenza ibe kubi kakhulu.
| What you see | What it points at |
|---|---|
| No local prefix in the table | Missing route |
| Correct prefix, no reply | Client filter or gateway policy |
| Works by IP, fails by name | Resolver changed by the tunnel |
| Inbound service dies, outbound fine | Return path or listener binding |
Umbuzo wokuqala: umzila, isihlungi noma igama
Funda ithebula ngaphambi kokwengeza noma yini kulo. Inkomba yesixhumi ibalulekile, ngoba wonke umyalo womzila ngezansi uboshelwe kuyo:
route print -4
Get-NetRoute -DestinationPrefix 192.168.1.0/24 | Format-Table InterfaceIndex,NextHop,RouteMetricI-subnet exhunywe ngqo ngokuvamile igcina umzila we-on-link ngisho noma i-tunnel iphezulu, ngakho ingeno ingaba khona futhi ithrafikhi isehluleke. Leyo nhlanganisela iyisiginesha sesihlungi esisebenza ngemuva kokuhambisa, futhi yilowo mkhakha lapho umzila wesibili, oqondile kakhulu, ungalushintshi noluncane.
Vivinya ngokuhlukana ngekheli nangegama. Uma i-ping 192.168.1.50 iphendula kanti i-net view 192.168.1.50 ayiphenduli, ithebula lokuhambisa lalingeyona inkinga: i-tunnel yashintsha isixazululi futhi igama lasendaweni alisaxazululwa. Ukwengeza umzila walokho kuwumsebenzi oyize.
Umbuzo wesibili: ingabe isango livumela ukufinyelela ku-LAN yasendaweni?
Iklayenti lezentengiselwano lifaka okungaphezu kwemizila. Lithola inqubomgomo lapho lixhuma, futhi leyo nqubomgomo ingase ihlanganise imvume ecacile yenethiwekhi yasendaweni. Ekusetshenzisweni kwe-Cisco IPsec inqubomgomo yeqembu ithwala isilungiselelo se-split-tunneling kanye nefulegi ehlukile yokufinyelela ku-LAN yasendaweni; ibhokisi lokumaka kuklayenti isicelo isango elingasinqaba. Ku-AnyConnect iphrofayela ilawula uhlu lokufaka nokukhipha lwe-split kanye nemvume efanayo. Ku-Windows RRAS okulingana nakho iwukukhetha kwesango elizenzakalelayo kuphrofayela kanye nemizila emile enikezwa yiseva.
Uma ifulegi livaliwe, ukuziphatha okubhaliwe ukuthi iklayenti livimba ithrafikhi eya ku-subnet exhunywe ngqo nakuba kunomzila ovumelekile, oqondile kakhulu. Yingakho futhi imizila engeyona eyeklayenti inganyamalala ngemizuzwana ngemuva kokuyengeza: iklayenti lakha kabusha isimo elayalwa ukuba silakhiwe, alilwi nawe.
Ilogi yeklayenti irekhoda isinqumo lapho lixhuma, futhi ukuyifunda kushesha kunanoma yikuphi ukuhlola emshinini. Uma ilogi ithi ukufinyelela kwasendaweni kuvinjiwe, yima: akukho ukulungiswa komugqa womyalo okudlula kulokho, futhi izindlela ezisele ukushintsha inqubomgomo, ukufinyelela isisetshenziswa nge-tunnel, noma ukuvala iklayenti emshinini wobuqili nokushiya umsingathi kunethiwekhi yasendaweni.
Umbuzo wesithathu: yiluphi uhlangothi oludingayo?
Ithrafikhi ephumayo iya kudivayisi eseduze umbuzo wokuhambisa. Khomba i-prefix ye-LAN esangweni lasendaweni ngesilinganiso esiphansi ngokwanele ukunqoba umzila ozenzakalelayo we-tunnel:
route add 192.168.1.0 mask 255.255.255.0 192.168.1.1 metric 1 if 12
route add 192.168.1.50 mask 255.255.255.255 192.168.1.1 -pIfomu lesibili libophela idivayisi eyodwa, futhi yilokho okufunayo lapho ikheli elilodwa liyisidingo sonke. Okulingana ne-netsh kurekhoda isinqumo esifanayo ngegama lesixhumi hhayi ngenkomba:
netsh interface ipv4 add route prefix=192.168.1.0/24 interface=12 nexthop=192.168.1.1 store=persistentImiyalo yomzila yehluleka nge-Ipharamitha ayilungile lapho ikheli nemaski kungavumelani, isibonelo ikheli lomsingathi elinemaski ye-/24. Sebenzisa ikheli lenethiwekhi kumzila we-subnet kanye nemaski yomsingathi kumsingathi oyedwa.
Okungena kuhlukile. Iseva ye-VNC noma ye-SSH emshinini ofanayo iyahluleka ukufinyeleleka lapho izimpendulo zoxhumano olungena ziphuma ngosango lwe-VPN futhi zingabuyi. Hlola ukuthi isevisi ilalela ini ngaphambi kokuthinta imizila:
netstat -ano | findstr :5900Isilaleli esiboshelwe ekhelini elilodwa elithile ngeke siphendule kwesinye isixhumi. Ukusibophela kuzo zonke izixhumi yisinqumo sangamabomu, esithathwa kanye nomthetho wodonga lomlilo obekelwe umkhawulo kunethiwekhi oyethembayo. Kuphela ngemuva kwalokho ukulungiswa komzila kubuyisela indlela yokubuya.
Sebenzisa ushintsho oluncane olufanele
Enye intshukumo evamile ukususa uphawu ku-“Sebenzisa isango elizenzakalelayo kunethiwekhi ekude” ezimfanelweni ezithuthukisiwe ze-IPv4. Lokhu kugcina ithrafikhi ye-inthanethi yasendaweni, kodwa kwenza izinto ezimbili ngesikhathi esisodwa: i-VPN ayiseyona indlela ezenzakalelayo, futhi iklayenti alisakutholi imizila yenethiwekhi ekude, kuhlanganise ne-multicast. Susa uphawu futhi i-LAN ekude iyanyamalala ngaphandle uma iseva icindezela ama-prefix akude aqondile adingwa yiklayenti ngalinye.
Lokho kungalingani kunquma ukulandelana komsebenzi. Uma uhlangothi olukude kufanele luhlale lufinyeleleka ngokuphelele, cindezela ama-subnet akude kusuka kuseva futhi ushiye okuzenzakalelayo kwasendaweni. Uma ungeke ushintshe iseva, engeza umzila ongunaphakade ku-prefix ekude ngokusebenzisa ikheli elinikezwe i-tunnel, futhi uhlole nge-route print ukuthi i-prefix ikhomba kusixhumi se-VPN kuyilapho okuzenzakalelayo kusakhomba esangweni lomzimba.
Bese uqinisekisa ukuthi ukulungiswa kuyaphila ngemuva kokuxhuma kabusha, ngoba imizila engeyona engunaphakade iyafa kanye ne-adaptha futhi iskripthi esigijima ngemuva kokuxhuma ngakunye iyindawo eqotho yayo. Hlola idivayisi yasendaweni eyodwa nesinsiza sekude esisodwa kuseshini efanayo, nqamula, xhuma futhi uhlole futhi. Uma idivayisi yasendaweni isehluleka ngenkathi umzila ubonakala ulungile, buyela kumbuzo wesibili: iklayenti liyahlunga, futhi impendulo ukushintsha inqubomgomo hhayi umzila wesibili oqhudelanayo.