Iseva ye-DNS engalungile ku-Windows VPN: imethrikhi, ukulandelana kokuxhuma noma isijobelelo

Izindlela ezintathu ze-Windows zikhetha isixazululi se-DNS, futhi zihluleka ngendlela ehlukile. Nquma ngobubanzi bendawo yamagama, ukulandelana komhlaba wonke noma ukuthi ukulungiswa kuyasinda yini ekuxhumekeni kabusha.

Iklayenti le-Windows lingaba nomhubhe osebenzayo, liphathe isixazululi senkampani futhi lisathumele amagama angaphakathi kurutha yasekhaya. Izindlela ezintathu ezihlukene zinquma ukuthi iyiphi iseva ephendulayo, futhi zihluleka ngezindlela ezihlukene. Akudingeki ulungise zontathu: uphawu lukutshela ukuthi iyiphi esemdlalweni. Isihlahla sezinqumo esingezansi sithatha imizuzu embalwa futhi sivimbela umphumela ojwayelekile, lapho ushintsho lwemethrikhi, ukuhlelwa kabusha kwerejista kanye nomthetho we-NRPT kufika ndawonye futhi akekho owaziyo ukuthi iyiphi eyenzile okuthile.

Izindlela ezintathu zinquma, futhi ngokuvamile eyodwa ayilungile

Imethrikhi yesikhombisi ihlela ama-adaptha ngomndeni othile wamakheli. Ukulandelana kokuxhuma ngaphansi kwe-Tcpip\Linkage uhlu lwezinga lomshini lwezihlonzi zesikhombisi ezisasetshenziswa izindlela zekhodi ezindala. Ithebula lenqubomgomo yokuxazulula amagama (NRPT) lihlanganisa indawo yamagama namaseva athile, futhi uhlu lwesijobelelo lunquma ukuthi igama elifushane liyandiswa ngempela. Zizimele, yingakho isixazululi esilungile ku-adaptha ye-VPN sihlulwa ukukhathazeka okudala kwenye indawo.

What you seeMechanism to checkFirst command
Every name is slow, public names sometimes wrongGlobal adapter order: metric, then LinkageGet-NetIPInterface
Internal names resolve to a public addressThe query left through the home resolver, not the tunnelResolve-DnsName intranet.corp.example -Type A, then the same query with -Server 10.20.0.10
Only corp.example names fail, public names fineNamespace binding: NRPT or suffixGet-DnsClientNrptRule
Short name fails, fully qualified name worksSuffix list on the adapter, with the corporate suffix ahead of other entries, or pushed by the serverGet-DnsClientGlobalSetting
Works, then breaks after a reconnectRuntime setting that was never persistedGet-VpnConnection for the stored profile, then Get-NetIPInterface again after a reconnect

Awekho kulezi zindlela ayikho ingxenye yesibili yomhubhe. Uma iseva i-VPN eyicindezelayo ingakwazi ukuxazulula igama, zonke izilungiselelo ohlangothini lweklayenti ziwumhlobiso nje, ngakho isinqumo sokuqala ukuthi ingabe isixazululi ngokwaso singaphendula uma sibuzwa ngqo.

Isinqumo sokuqala: ingabe isixazululi esicindezelwe singaphendula nakancane?

Buza iseva ngokusobala bese uqhathanisa nokusesha okuvamile. Igebe phakathi kwezimpendulo lihlukanisa inkinga yokukhetha kule nkinga yokufinyeleleka, futhi nakhu igatsha elishesha kakhulu:

Resolve-DnsName intranet.corp.example -Server 10.20.0.10 -Type A
Resolve-DnsName intranet.corp.example -Type A

Uma elokuqala liphumelela futhi elesibili lihluleka, isixazululi siyafinyeleleka futhi i-Windows ikhetha kabi; qhubeka nezinqumo zendawo yamagama nokulandelana ngezansi. Uma nelokuqala lihluleka, akukho ohlangothini lweklayenti okuzosiza: hlola ukuthi i-UDP ne-TCP 53 ziyafika yini kuseva ngomhubhe, ukuthi awukho yini umdwebo womlilo womsingathi ophonsa iphuli, nokuthi izidlulisi zesisekelo seseva ngokwaso ziyaphila yini.

Ma ngaphakathi kuleli gatsha. Ukusebenzisa umthetho we-NRPT kusixazululi ongakwazi ukufinyelela kuso kulethela ukwehluleka okufanayo nokuhleleka okuningi okufanele kuhoxiswa, futhi kufihla iphutha langempela ngemuva komthetho obukeka unegunya.

Isinqumo sesibili: indawo yamagama eyodwa noma wonke umbuzo?

Ububanzi bunquma ithuluzi. Uma kuhluleka kuphela amagama enkampani, hlanganisa indawo yamagama esikhundleni sokuhlela kabusha umshini: umthetho we-NRPT uthumela leso sijobelelo kusixazululi somhubhe futhi ushiya konke okunye. Uma ukusesha konke kuthinteka, inkinga ukukhathazeka kwe-adaptha jikelele, futhi imethrikhi iyindawo yokuqala ngoba ayishintshi silungiselelo seseva.

Setha imethrikhi ngomndeni ngamunye wamakheli, kuzo zombili izikhombisi, bese uqinisekisa ukulandelana:

Get-NetIPInterface | Select-Object ifIndex, InterfaceAlias, AddressFamily, InterfaceMetric
Set-NetIPInterface -InterfaceIndex 11 -InterfaceMetric 1 -AddressFamily IPv4
Set-NetIPInterface -InterfaceIndex 11 -InterfaceMetric 1 -AddressFamily IPv6

Faka u-11 esikhundleni se-ifIndex ye-adaptha yomhubhe kusuka emugqeni ongenhla; uma u-11 kuyi-adaptha ye-LAN, umyalo ofanayo wehlisa indlela engalungile. Ukuphakamisa i-adaptha ye-LAN esikhundleni salokho kufinyelela ukulandelana okufanayo ohlangothini olunye: netsh int ip set interface interface="Ethernet" metric=15, futhi i-netsh int ipv6 set interface interface="Ethernet" metric=15 yomndeni wesibili, ngoba i-int ip ithinta kuphela i-IPv4.

Ukulandelana kokuxhuma kuyisixazululo sokugcina hhayi isinyathelo sokuqala. I-HKLM\SYSTEM\CurrentControlSet\Services\Tcpip\Linkage igcina uhlu lwe-Bind lwezihlonzi zedivayisi, futhi ukuhambisa isihlonzi somhubhe phambili kushintsha ngempela ukuthi iyiphi i-adaptha ebuzwa kuqala, kodwa liyinqwaba yerejista yezinga lomshini ngaphandle kobubanzi bendawo yamagama ngayinye. Yikhiphe ngaphandle ngaphambi kokuhlela bese uxhuma kabusha umhubhe, ukuze ukulandelana kusebenze esimweni i-klayenti elikulindele.

Endaweni yamagama eyodwa, khetha ithuluzi elincane kakhulu:

Add-DnsClientNrptRule -Namespace ".corp.example" -NameServers 10.20.0.10
Get-DnsClientNrptRule | Select-Object Namespace, NameServers

Isinqumo sesithathu: ingabe ukulungiswa kuyasinda ekuxhumekeni kabusha?

Imethrikhi esebenza kuze kube ukuxhumeka kocingo olulandelayo ayikaze igcinwe. Ama-profayela okuxhumeka e-L2TP/IPsec namanye akhiwa kabusha lapho ukuxhumeka kuqala, ngakho inani eligciniwe lihlala kungena kwincwadi yocingo njenge-IpInterfaceMetric, hhayi kuphela esikhombisini esisebenzayo. Ezinye izimo zibhala leyo nkambu nge-script ngaso lesi sizathu; ezinye zicindezela ukukhathazeka kusuka kunqubomgomo yokuphatha futhi zishiya iphoyinti lokugcina.

Isilondolozi nokubhalisa kungosongelayo oluhlukile. Ukukusebenzisa lokhu ngemuva kokuba umhubhe unyuke kulungisa okungena okuphelelwe yisikhathi futhi kubhalisa kabusha i-klayenti, kodwa akukho okuhlela kabusha i-adaptha:

ipconfig /registerdns
ipconfig /flushdns

Kuneswishi yokuvala kulo songelayo olufanayo. Ukukhubaza ukubhalisa okuguquguqukayo ku-adaptha yomzimba kuvimbela i-klayenti ekumenyeni ikheli layo ohlangothini lwe-VPN ngaphansi kwegama elingalungile, futhi lokho kuwukulungiswa okuhlukile ekuhlaziyweni okungenhla.

I-IPv6 ifanelwe umugqa wayo esinqumweni. Uma i-adaptha yomzimba inekheli le-IPv6 lomhlaba wonke ngenkathi umhubhe uthwala i-IPv4 kuphela, i-Windows ingase ikhethe indlela engenawo umhubhe wokuxazulula amagama. Hlola lowo mndeni ngokwahlukile, ngoba imethrikhi esethwe ye-IPv4 ayisho lutho ngawo:

Get-NetIPInterface -AddressFamily IPv6 | Select-Object ifIndex, InterfaceAlias, InterfaceMetric

Ukukhubaza i-IPv6 ku-adaptha ye-LAN kususa leyo ndlela kanye nomthetho wokuxhumana nayo; ukushintsha kwemethrikhi kusikhombisi se-IPv6, noma umthetho we-NRPT wendawo yamagama yenkampani, kugcina umndeni futhi kulungisa ukukhathazeka. Khetha elincane kakhulu, ngaphandle uma usunqume ukuthi lowo xhumo akufanele ube ne-IPv6.

Qinisekisa ngomthombo oshiwo, futhi gcina umnikazi oyedwa

Qinisekisa ngamathuluzi abika ukuthi yimuphi umthombo osebenzayo, hhayi kuphela ukuthi ikhasi liyalayisha:

ipconfig /all
Get-DnsClientServerAddress -AddressFamily IPv4
Resolve-DnsName fileserver.corp.example -Server 10.20.0.10 -Type A

Bese uhlukanisa ukuhlunga nokukhetha, ngoba ngaphakathi kohlelo lokusebenza kubukeka kufana. I-block-outside-dns ye-OpenVPN ivimbela imbobo engu-53 kwamanye ama-adaptha; ayikhethi isixazululi. Uma manje wonke umbuzo uhluleka, isihlungi kungenzeka sivimba iseva okuwukuphela kwayo efinyelelekayo; uma isixazululi esilungisiwe singanakwa, ukulandelana noma umthetho wendawo yamagama awulungile. Ukushintsha kokubili kanyekanye kwenza umbuzo ovimbekile nombuzo onganakwanga kungahlukaniseki.

Gcina umnikazi oyedwa wenqubomgomo ye-DNS: iphrofayela ye-VPN, inqubomgomo yokuphatha noma umthetho we-NRPT, hhayi ezimbili zazo. Ngaphambi kokuvala:

  • Isixazululi esicindezelwe siyaphendula uma sishiwo ngokusobala, futhi ukusesha okuvamile kuyasisebenzisa.
  • Umthetho noma imethrikhi oyishintshile ihlanganisa umndeni wamakheli othwala ngempela imibuzo.
  • Isilungiselelo siyasinda ekunqanyulweni nasekuxhumekeni kabusha, noma usisusile waya kuphrofayela egciniwe.
  • Kunendlela eyodwa ncamashi enegunya, kanti ezinye zishiywe njengoba zinjalo.

Thatha ukulandelana njengesimo sendawo hhayi njengento oyiqedayo. Kusihlole futhi ngemuva kokuxhuma kabusha nangemuva kokubuyekezwa kwe-Windows okuthinta isitaki senethiweki, ngoba kokubili kungabuyisela i-adaptha yomzimba phambili.

Izihloko ezihlobene