Amaklayente e-VPN avinjiwe yiPhrofayela Yomphakathi yefayela lika-Windows

Ithuneli lakho liphila, isango liphendula ku-ping, futhi ukwabelana ngamafayela kusaphela isikhathi. Le nhlanganisela ayivamisile ukuba inkinga yomzila: i-Windows ibeke i-subnet ye-adaptha ye-VPN kuphrofayela Yomphakathi, futhi wonke umthetho wokuvumela owabhalelwa i-Private noma i-Domain awukaze usetshenziswe. Ngihlangane nalokhu kumakhompyutha aphathekayo afinyelela ihhovisi kahle nasesiphakamisa i-RRAS esikhonza wonke amanye amaklayente, futhi ukulungisa kufushane uma ushibhile iphrofayela ethintekayo. Nakhu ukuhleleka engisebenza ngakho, kanye nokuhlola okukutshela ukuthi ume nini ngaphambi kwesinyathelo esilandelayo.

Thola ukuthi yiliphi iphrofayela ithrafikhi efika kulo ngempela

Ifayela lika-Windows alinawo umsebenzi owodwa womhlaba wonke. Yonke i-interface exhunyiwe ithwala isigaba, futhi amaphakethe angenayo ahlungwa ngokwesigaba se-interface eza ngayo, ngakho-ke iphrofayela ye-adaptha ye-VPN inquma ukuthi iklayente esethuneli ingafinyelela ini, hhayi i-adaptha ye-Wi-Fi noma ye-Ethernet eseceleni. Funda womabili amaqiniso ngaphambi kokushintsha noma yini:

Get-NetConnectionProfile | Select-Object Name, InterfaceAlias, NetworkCategory, IPv4Connectivity
Get-NetFirewallProfile -Name Public | Select-Object Name, Enabled, DefaultInboundAction

Ekufakweni okujwayelekile kwe-OpenVPN noma i-WireGuard, i-adaptha ye-VPN ivela njengenethiwekhi engaziwa futhi iwela ku-Yomphakathi, okuyinto ezenzakalelayo kunoma iyiphi inethiwekhi i-Windows engakwazi ukuyihlukanisa: asikho isilawuli sesizinda esaphendula kuyo futhi asikho iphrofayela yesango elafanayo. Igama le-interface alibalulekile lapha, ngakho-ke ukubiza i-adaptha ngokuthi "VPN" noma "Corp" akushintshi lutho. I-DomainAuthenticated idinga umshini ohlangene nesizinda , ongafinyelela ngempela isilawuli sesizinda ngale-interface; ithuneli elihlukanisiwe elithwala i-subnet eyodwa ngeke lihlangabezane nalokho.

Uma umthetho owudingayo usuvele ukhawulelwe echibini le-VPN futhi ususebenza esigabeni osanda kusifunda, ma ume lapha: ukuhlunga akulona uhlaka lwakho, futhi indawo elandelayo okufanele uyibheke ukucushwa kwesevisi. Lokho kuhlola kuthatha imizuzwana eyishumi futhi konga ihora lokuhlela imithetho. Amagama ezigaba nokuthi yikuphi okumbozwa yileyo naleyo kubhalwe ku- sireferensi se-Get-NetConnectionProfile.

Qinisekisa ukuhlunga, hhayi umzila, ngaphambi kokuhlela imithetho

I-Ping iwukuhlola okubuthakathaka. I-ICMP ingadlula ngenkathi imbobo yesevisi ilahliwe, futhi umkhathi angaphendula esuka ku-LAN ngenkathi enqaba isicelo esifanayo ngethuneli. Hlola imbobo edingwa yiklayente, kusuka kuklayente:

Test-NetConnection 10.8.0.1 -Port 445
Test-NetConnection 10.8.0.1 -Port 3389 -InformationLevel Detailed

Uma ukuhlola kwembobo kwehluleka, hlukanisa izigaba ezimbili. Iphutha lethuneli noma lomzila livamise ukuvela njengokungabikho kwempendulo isuka ekhelini lesango, kuyilapho ukulahlwa kwefayela kubonisa isango eliphendulayo nembobo yesevisi engaphenduli. Kusiphakamisa se-Windows esishicilela ichibi nge-RRAS, gijima lokho kuhlola kuklayente futhi ufunde iphrofayela yesiphakamisa uqobo: i-interface ye-RAS ingahlala esigabeni okungathi imithetho yaso yokungena ayisho neze ibanga lamaklayente, futhi yingakho umshini ukhonza i-LAN yawo futhi unqaba wonke amaklayente asethuneli.

Uma umphumela usungaqondakali, bhala ukulahlwa kwephrofayela ethintekayo futhi ukufunde:

Set-NetFirewallProfile -Name Public -LogBlocked True `
  -LogFileName "$env:systemroot\system32\LogFiles\Firewall\pfirewall.log"

Okufakiwe okusho ikheli nembobo yeklayente ne-DROP kuqinisekile, futhi kukutshela ukuthi yimuphi umthetho owawungekho. I-log engenalutho ngenkathi i-SYN yeklayente ingaveli neze ikhomba ngaphezu komkhathi, ngakho-ke buyela ethunelini, kumthetho we-NAT, noma emzileni wechibi ngaphambi kokuthinta enye into yefayela.

Khawulela umthetho owodwa wokungena echibini lamaklayente

Ukulungisa umthetho owodwa wokungena wokuvumela okukheli lakho elikude liyichibi, hhayi umhlaba wonke. Kusuka kuseshini ephakanyisiwe:

New-NetFirewallRule -DisplayName "VPN clients - SMB 445" `
  -Direction Inbound -Action Allow -Protocol TCP -LocalPort 445 `
  -RemoteAddress 10.8.0.0/24 -Profile Public

Uma isevisi iyifayela elilodwa le-binary, khetha umthetho okhawulelwe ohlelweni one- -Program esikhundleni sohlu lwamachweba; lokho kukhawulela okukhiphile kukho kokubili inqubo nebanga lomthombo.

Ukukhethwa kwephrofayela yindawo lapho iphutha elifanayo lenziwa khona ngakolunye uhlangothi. -Profile Public kwanele uma i-adaptha ingeyomphakathi futhi ihlala ingeyomphakathi. -Profile Any kuyavikeleka uma isevisi kufanele isebenze kungakhathalekile ukuthi i-Windows ihlukanisa kanjani i-adaptha, kodwa kuphela uma ububanzi obukude buhlala bukhona. Okungavikeleki neze ukuthi -RemoteAddress Any kuphrofayela Yomphakathi: lowo mthetho ulandela ikhompyutha ephathekayo kuyo yonke inethiwekhi yekhefi nehhotela elijoyinayo futhi uvula imbobo kunoma ngubani owabelana ngaleyo subnet.

Bhala ichibi eceleni komthetho. -RemoteAddress 10.8.0.0/24 kuyeka buthule ukufana ngosuku lapho ichibi le-VPN liphindwa ukubalwa, futhi iphutha libukeka njengento efanayo nebhuge lokuqala, yingakho kubiza intambama yesibili. Qamba imithetho ngokwesevisi nangebanga lomthombo, uyigcine ndawonye ne- -Group, futhi uyifunde futhi njalo uma incazelo yechibi ishintsha. Uhlu lwemithetho ongayihlola kusikrini esisodwa ludlula umthetho olungile ongatholakali muntu.

Shintsha isigaba kuphela uma isigaba siyisinqumo

Ukushintshela i-interface ku-Private nakho kuyasebenza, futhi kuwukuhleleka okungalungile okuzenzakalelayo. Iphrofayela ye-Private ithwala uhlu olude lwemithetho yokuvumela eyakhelwe ngaphakathi, ehlanganisa ukwabelana ngamafayela namaphrinta, ukuthola inethiwekhi, ideskithophu ekude nokunye kuye ngokwesisekelo, ngakho-ke ukuhlukanisa kabusha i-adaptha ye-VPN kwenza yonke isebenze ngesikhathi esisodwa kuklayente ngamunye ethunelini. Umthetho owodwa okhawulelwe unikeza isevisi eyodwa kubanga elilodwa. Kukhompyutha ephathekayo ehlangana nezinye izinethiwekhi ezingathenjwayo, lowo mehluko awuwona wokuhlobisa.

Kunezimo lapho ukuhlukaniswa kungamanga ngempela: ithuneli elihlala livuliwe noma lesiza-esiza elithwala i-subnet yehhovisi liyingqalasizinda ethenjwayo, futhi ukumaka leyo adaptha njenge-Private yisinqumo somklamo esisemthethweni, esithathwa kanye ngomgomo hhayi ngetikithi ngalinye. Uma ukwenza, kwenze ngokucacile:

Set-NetConnectionProfile -InterfaceAlias "OpenVPN TAP-Windows6" -NetworkCategory Private

Kudivayisi ephethwe, qala ngokuhlola ukuthi ingabe uMgomo Weqembu noma isisekelo se-MDM siphethe isilungiselelo. Uma siphethe, ushintsho lwasekhaya luzohoxiswa ekuhlaziyweni okulandelayo, futhi gpresult /h luzosho umgomo osiphethe; lungisa lapho, hhayi endaweni yokugcina.

Qinisekisa kuzo zombili izinhlangothi futhi ushiye umkhondo

Qinisekisa ukugeleza okubikwa umsebenzisi, kusuka kuklayente, ngemuva koshintsho:

Test-NetConnection 10.8.0.1 -Port 445
Get-NetFirewallRule -DisplayName "VPN clients - SMB 445" | Get-NetFirewallAddressFilter | Select-Object RemoteAddress
Get-NetFirewallRule -DisplayName "VPN clients - SMB 445" | Get-NetFirewallPortFilter | Select-Object Protocol, LocalPort

Bese uvala umjikelezo ezintweni ezizofohla ngesonto elizayo. Qalisa kabusha umkhathi futhi uhlole futhi, ngoba umthetho okhawulelwe kuphrofayela engalungile uyaqhubeka usebenza kuze kube i-adaptha ibuya kwesinye isigaba. Hlola kuklayente wesibili, ngoba iklayente eyodwa ephethe isivumelwano esidala ingafihla ukungafani kwechibi. Bala imithetho oyenezelile ngokumelene naleyo oyisusile, ngoba okukhiphayo okugqagqanayo yiyo indlela ukulungiswa kwemigqa emibili okuba umgomo wokuhlunga ongabuyekezwa muntu.

Ngaphambi kokukubiza ukuthi sekuqediwe:

• Iphrofayela eshiwo emthethweni iyiphrofayela ye-interface ithrafikhi efika kuyo.
• Ububanzi obukude yichibi le-VPN, futhi lelo chibi lihambisana nalokho okunikezwa isiphakamisa ngempela.
• Awukho umthetho owengezile osebenzisa -RemoteAddress Any kuphrofayela Yomphakathi.
• Akukho okwenziwe kwangasebenzi ukuze ukuhlola kudlule, futhi noma yikuphi ukushintsha kwesigaba kubhala ukuthi ubani ukugunyazile.