I-firewall ye-Windows yodwa njengesicishi se-VPN: ingaba ngcono?
Imithetho yohlobo lwe-interface ingavala ama-adapter abonakalayo, kodwa itheneli yomuntu wesithathu ivamise ukubonakala inentambo. Hlola ukuhlukaniswa, indlela yendawo yokugcina, bese kuba yi-DNS.
Buza ukuthi i-firewall ye-Windows ingasebenza yodwa njengesicishi sesimo esiphuthumayo futhi uzothola izimpendulo ezimbili eziqinisekile kodwa ezingavumelani. Enye ithi umthetho wohlobo lwe-interface wenza wonke umsebenzi; enye ithi awusebenzi ngaphandle kwama-script. Zombili zichaza ingxenye yesigamu sendlela eyodwa. I-firewall ingaveza ukuvalwa, futhi ukuthi umphumela wehluleka ngokuvaliwe ngempela kuncike ezintweni ezintathu: indlela i-Windows ehlukanisa ngayo i-adapter yetheneli, ukuthi isibaluli sendawo yokugcina siyasinda yini, nokuthi ukuxazululwa kwamagama kanye ne-IPv6 kumboziwe yini. Ungenza iphutha kunoma yikuphi kulokhu, umshini uzovuza noma ulahlekelwe ukuxhumana konke.
Imibandela emithathu, ngalolu hlelo
Umbadela wokuqala ukuhlukaniswa, futhi unquma ukuthi umthetho owufunayo uyakhonjiswa yini noma cha. Imithetho ye-firewall ye-Windows ingakhawulwa ngohlobo lwe-interface: enentambo, engenantambo noma ukufinyelela kude. Inqubomgomo evala ukuhamba okuphumayo ezinhlotsheni ezibonakalayo kuyilapho ivumela itheneli isebenza kuphela uma i-Windows ibona itheneli njengokufinyelela kude.
Umbadela wesibili isibaluli sendawo yokugcina. Ngaphambi kokuba kube khona itheneli, iklayenti kufanele lifinyelele iseva ye-VPN ngokusebenzisa i-adapter ebonakalayo, ngakho ukuvalwa okuphelele kuleyo adapter kuvimbela ukuxhumana okungenza ukuvalwa kungadingeki. Isibaluli kufanele sisho iseva kanye nebhokisi laso, futhi iphakethe kufanele liphume ngomnyango obonakalayo hhayi lingene kutheneli engakavulwa.
Okwesithathu ukumboza. Iqoqo lemithetho evala i-IPv4 ikhohlwe i-IPv6, noma evumela isixazululi sendawo ukuthi ifune indawo yokugcina ngakho ivumele konke okunye ukufuna, yehluleka ngokuvulekile kulelo hwindo i-switch ekhona ngenxa yalo. Lesi yisikhala somklamo, hhayi iphutha le-firewall. Futhi yisikhala esidlula zonke izivivinyo etafuleni.
Ukuhlukaniswa yisango lokuqala
Bheka ukuthi i-Windows icabangani ngama-adapter ngaphambi kokubhala ngisho umthetho owodwa. Ukuxhumana kwe-VPN kwemvelo kwe-Windows kuvamise ukuvela njengokufinyelela kude. Iklayenti yomuntu wesithathu edala i-adapter yayo yobuciko ivamise ukuvela njengenentambo, okusho ukuthi ukuvalwa okukhawulelwe kuma-adapter anentambo kuvala netheneli.
Get-NetConnectionProfile | Select-Object Name,InterfaceAlias,NetworkCategory
Get-NetAdapter | Select-Object Name,InterfaceDescription,Status,ifIndex
Get-NetFirewallProfile | Select-Object Name,Enabled,DefaultOutboundActionUmyalo wesithathu utshela ukuthi ukuvalwa okuphumayo okuzenzakalelayo sekusebenza yini, futhi lokhu kushintsha sonke isimo somklamo. Uma okuzenzakalelayo sekuwukuvala, ubhala imithetho yokuvumela hhayi izibaluli kusisekelo esivumelayo, futhi leso yisimo esilula kakhulu ukucabanga ngaso.
Uma i-adapter yetheneli yakho ibika njengenentambo, i-firewall yodwa akuyona ithuluzi elifanele umklamo ohluleka ngokuvaliwe, futhi akukho ukulungiswa kwemithetho okushintsha lokho. Leli yisimo lapho umbono wesibili kuwo wonke umucu we-forum uqinisile.
Isibaluli sendawo yokugcina sidinga indlela kanye nomthetho
Ake sithi ukuhlukaniswa kuyasebenza. Isibaluli sinezingxenye ezimbili, futhi zihlala ezinhlelweni ezingaphansi ezihlukene. Umthetho we-firewall uvumela ukuhamba; indlela yomsingathi ikhipha ngaphandle ngokusebenzisa i-interface efanele ngenkathi itheneli iphansi.
New-NetFirewallRule -DisplayName "VPN endpoint allow" -Direction Outbound -Action Allow \
-Protocol TCP -RemoteAddress 203.0.113.9 -RemotePort 443 -InterfaceType Wired,Wireless
New-NetRoute -DestinationPrefix 203.0.113.9/32 -InterfaceIndex 12 -NextHop 192.168.1.1
Get-NetRoute -DestinationPrefix 203.0.113.9/32Ngaphandle kwendlela, isibaluli sisiza kuphela ngenkathi indlela ezenzakalelayo isakhomba emnyango obonakalayo. Uma iklayenti lifaka indlela yalo ezenzakalelayo bese lifa, amaphakethe avunyelwe awanandawo enengqondo yokuya futhi ukuxhumana akukwazi ukusungulwa kabusha. Lokho kwehluleka kubonakala njengeklayenti eliphukile futhi empeleni kuyindlela engekho.
Gcina isibaluli sincane ngangokuthi iklayenti livumele. Ikheli elilodwa kanye nebhokisi elilodwa kuyahlolwa; ububanzi obumboza wonke umxhwele womhlinzeki abukho. Lowo mthetho obanzi uvumela nakho konke okunye okusingathwa kumhlinzeki ofanayo, okuvamise ukuba ngaphezu kwalokho obukuhlosile.
I-DNS ne-IPv6 yizindawo lapho yehluleka khona ngokuvulekile
Ukuxazululwa kwamagama ukuvuza kwendabuko. Uma indawo yokugcina iyigama lomsingathi, iklayenti kufanele liyixazulule ngaphambi kokuba itheneli ibe khona, okusho ukuthi i-adapter ebonakalayo kufanele ivunyelwe ukufinyelela isixazululi. Leyo mvume efanayo ikhipha konke okunye ukufuna ngaphandle ngenkathi itheneli iphansi, futhi ukufuna okukodwa kwanele ukuveza lokho obuzokuvakashela.
I-IPv6 ingeyesibili. Imithetho ebhalelwe i-IPv4 ayimbumbi omunye umndeni, futhi amaklayenti amaningi afaka izindlela ze-IPv4 kuphela. Ngakho umshini onokuxhumana kwe-IPv6 kwemvelo ungaqhubeka nokukhuluma ne-inthanethi ngenkathi uhlangothi lwe-IPv4 luvalwe ngokuqinile, futhi i-switch ibika impumelelo ngaso sonke isikhathi.
| Gap | What leaks | Control |
|---|---|---|
| Resolver permitted for endpoint lookup | Every name queried while down | Pin the endpoint as an address, or block non-tunnel DNS |
| Rules only for IPv4 | Full IPv6 connectivity | Add the same rules for the other family |
| Application bound to physical interface | Its own traffic | Firewall cannot fix this; change the binding |
Umugqa wesithathu kufanele uqondwe hhayi ugwenywe. I-firewall inquma ngamaphakethe, hhayi ngokuthi iyiphi i-interface uhlelo oluyicele, futhi uhlelo oluzibophela ngokusobala lungaba nzima ukulawulwa. Lokho kuyisizathu esihle se-switch yohlangothi lweklayenti esebenza ngaphansi kohlelo, hhayi imithetho eminingi.
Hlola ngokumisa iklayenti, hhayi ngokudonsa intambo
Isivivinyo esisodwa esinengqondo yileso esilingisa ukwehluleka owuvikelayo. Misa insizakalo, bulala inqubo, noma khubaza i-adapter eyadalwa yiklayenti, bese uzama ukufinyelela i-inthanethi negama:
Stop-Service -Name "YourVpnService" -Force
Test-NetConnection -ComputerName 1.1.1.1 -Port 443
Resolve-DnsName example.com
Test-NetConnection -ComputerName 2606:4700:4700::1111 -Port 443Zontathu kufanele zehluleke. Uma eyokuqala iphumelela, ukuvalwa akusebenzi; uma eyesibili iphumelela lapho eyokuqala yehluleka khona, unokuvuza kwe-DNS; uma eyesithathu iphumelela, i-IPv6 ayimboziwe. Umsuka ngamunye ukhomba kanye kuphela kwezikhala ezingenhla.
Phinda isivivinyo ngemuva kokulala nokuvuka, ngoba iphrofayela ye-firewall ingashintsha lapho i-Windows inquma ukuthi inethiwekhi yisidlangala noma iyimfihlo, futhi imithetho ekhawulelwe kuphrofayela iyayilandela. Umklamo ohlala etafuleni wehluleke esitimeleni umklamo ohlolwe kanye kuphela.
Uma isango lokuhlukanisa noma imfuneko ye-DNS yenza indlela ye-firewall-yodwa ingasebenzi, i-switch yohlangothi lweklayenti iyimpendulo eqotho. Uma itheneli iphelela kumrutha esikhundleni salokho, inqubomgomo kufanele ibe eyomrutha, ngoba umthetho owodwa lapho umboza yonke idivayisi engemuva kwayo futhi awuncikile ekutheni i-Windows ibiza kanjani i-adapter.