Kungani i-VPN efakwe ku-Windows ingafinyeleli isango le-SSL lomthengisi

I-Windows iza nezinhlobo ezine zamathaneli, futhi isango le-SSL lomthengisi akusilo olunye lawo. Noma kanjalo qondisa iphrofayela efakiwe kulolo sango, ukuxhumana kuzohluleka ngaphambi kokucelwa imininingwane yokungena, ngokuvamile ngomlayezo othi ukuxhumana kwaqedwa uhlelo lwasendaweni. Lowo mbhalo wuphawu lokungahambisani, hhayi ukuxilonga. Uhlobo lwephrofayela kanye neklayenti eliphethe iphrothokholi kufanele kuhambisane, futhi kukhona okunye okungekho.

Izinhlobo ezine nengxoxo eyodwa

Yonke iphrofayela egciniwe ithwala uhlobo lwethaneli. Iklayenti efakiwe yamukela i-PPTP, i-L2TP, i-IKEv2 ne-SSTP, kanye nemodi ezenzakalelayo ezizama ngokulandelana. Akukho okufakwayo okuvamile kwe-SSL VPN, futhi ayikho indlela yokwengeza okukodwa ngengxoxo. Isango lomthengisi likhuluma iphrothokholi yaso yohlelo lokusebenza phezu kwe-TLS, okwenziwa yiklayenti yalowo mthengisi kuphela.

Uhlu lukude nomyalo owodwa, futhi kufanelekile ukulugxusha ngaphambi kwanoma yikuphi okunye ukuxazulula izinkinga ngoba kuthatha isekhondi elilodwa futhi kususa isigaba sonke semibono engalungile:

Get-VpnConnection | Select-Object Name, ServerAddress, TunnelType, SplitTunneling
Get-VpnConnection -Name "Office" | Format-List

Uma iphrofayela ithi SSTP futhi isango akuyona iseva ye-RRAS, ukungahambisani sekutholakele kakade. Akukho msebenzi wezitifiketi noma wothango lomlilo owukushintshayo lokho.

I-SSTP ne-TLS yomthengisi zibukeka zifana kuphothi 443

I-SSTP isonga iseshini ye-PPP ngaphakathi kwe-TLS futhi ihamba ku-TCP 443. Kusitaki yakwa-Microsoft iphethwa yi-RRAS, eletha isitifiketi seseva esiqinisekiswa yiklayenti. Idivayisi ye-Fortinet, Citrix noma i-Pulse nayo iphetha i-TLS ku-443, futhi ingosi yayo ivuleka kunoma yisiphi isiphequluli ngaphandle kwezigxeko.

Lolo vivinyo lwesiphequluli lubonisa ukufinyeleleka, hhayi ukuhambisana. Iphrothokholi yeseshini engemuva kwengosi ingeyomthengisi, futhi iklayenti efakiwe ayinakho ukuphunyezwa kwayo. Ukuthi umthengisi unikeza iklayenti yakhe siqu kukutshela ukuthi ubhekene naluphi uhhafu lokungahambisani.

Ukudideka okuphambene nakho kuyenzeka. Iphrofayela elungiselelwe njenge-SSTP ngokumelene neseva ye-RRAS yangempela ingase ihluleke ekuqinisekiseni isitifiketi ngenkathi ingosi ilungile, futhi lokho kuyinkinga yesitifiketi, hhayi inkinga yephrothokholi.

Amaphutha avelayo ngaphambi kokuba kube nethaneli

Amakhodi ochungechunge luka-800 abikwa ngaphambi kokuba kusungulwe noma iyiphi ithaneli, yingakho imithetho yothango lomlilo ingavamile ukuwuhambisa. Iphutha 812 inqubomgomo yohlangothi lweseva enqaba indlela yokuqinisekisa eyanikezwa yiklayenti. Amanye asesigabeni avela kumphathi wokuxhumana wasendaweni, hhayi kunethiwekhi.

Vula ukulandelela ngaphambi kokwakha kabusha noma yini. Ukulandelela kubiza isigaba esihlulekayo, futhi igama lesigaba libaluleke ukwedlula umbhalo wengxoxo:

netsh ras set tracing * enable
Get-ChildItem "$env:windir\tracing" | Sort-Object LastWriteTime -Descending | Select-Object -First 5

Iziphumo zokulandelela zihlala ngaphansi kwedijithali yokulandelela futhi zihlala lapho kuze kube yilapho uzisusa, ngakho-ke kucisha ngemuva kwalokho esikhundleni sokukuyeka kusebenza amasonto.

Iphrofayela exhunyiwe nayo ingaphihliza konke

Iphrofayela exhumayo bese iphihliza ukuphequlula, ukwabelana kwasendaweni noma injini yekhonteyina inenkinga yomzila, hhayi inkinga yethaneli. Isango elizenzakalelayo lifudukele ethaneleni, ngakho-ke yonke indawo ekuyiwa kuyo manje idlula kumlingani ongase angayiqondisi.

Izilawuli ezimbili zinquma lokhu. Okunye isici se-split tunneling kwiphrofayela. Okunye ukukhetha kwe-adaptha ngayinye ukusebenzisa isango elizenzakalelayo kunethiwekhi ekude, okungaphansi kwezilungiselelo ezithuthukisiwe ze-IPv4.

Set-VpnConnection -Name "Office" -SplitTunneling $true
Add-VpnConnectionRoute -ConnectionName "Office" -DestinationPrefix 10.20.0.0/16

Ukuvula i-split tunneling ngaphandle kokwengeza imizila kuveza ithaneli elixhumayo kodwa elingafinyeleli ndawo. Ukuyivala ngaphandle kokuhlola i-DNS kuveza amagama angaphakathi ahlukaniswa abe izimpendulo zomphakathi, ngoba isijobelelo sase-adaptha kanye namaseva ayo awasetshenziswa.

Qinisekisa amapayipi, bese uqinisekisa uhlobo

Sebenza ngalolu hlelo, futhi ma uma isinyathelo sihluleka esikhundleni sokulungisa konke ngesikhathi esisodwa:

Test-NetConnection vpn.example.net -Port 443
Get-VpnConnection -Name "Office" | Format-List TunnelType, ServerAddress, DnsSuffix
netsh interface ipv4 show route
rasdial Office

Umyalo wokuqala wehlukanisa ukufinyeleleka nephrothokholi. Owesibili uqinisekisa ukuthi iphrofayela izitshela ukuthi iyini. Ithebula lemizila likhombisa ukuthi ithaneli libambe umzila ozenzakalelayo yini. Umyalo wokushaya uxoxa iphutha lomphathi wokuxhumana ngokwakhe, okuvame ukucaca ukwedlula ingxoxo.

Bhala ohlwini lwekhithi uhlobo lwethaneli, umkhiqizo wesango kanye nephutha eliqondile. Ngemuva kwalokho umuntu olandelayo uyazi ngemva komzuzu owodwa ukuthi lokhu ukungahambisani kwephrothokholi, ukuhluleka kwesitifiketi noma isinqumo somzila, esikhundleni sokuqala ngo-“i-VPN ayisebenzi”.