R01.04.01.01 · 任务小类

网络、VPN 与代理配置及测试

Network, VPN & proxy configuration and testing

Join networks, set DNS, proxies and VPN profiles, and verify connectivity, speed and latency.

20 条本项目编写的提案 · 分类 v1.1 · 新增基准运行 0 次。下方验证方式与部分得分规则是设计，不是执行结果。

典型应用: Network settings · VPN clients
小类 GUI 需求标签: G2 · GUI 必要

任务提案 · 20

展开查看完整原文与建议检查方式；两种界面均保留提案英文原文。

R01.04.01.01-T01 Set two DNS servers on Wi-Fi

原始指令

In Network > Wi-Fi > Details > DNS, replace the current DNS servers with exactly 1.1.1.1 and 9.9.9.9 in that order. Leave search domains unchanged.

平台: mac · macOS
应用: Network settings
交互表面: desk · 桌面 GUI
GUI 需求 · 任务设定: G2 · GUI 必要
GUI 需求 · 普通权限: CL · CLI 足够
交互原语: click · 指向与点击 type · 文字与表单
工作产物: WP08 · 应用 / 系统状态
条件: 未声明
提案难度: 2 / 5

建议验证方式

`networksetup -getdnsservers Wi-Fi` (grader) lists exactly 1.1.1.1 then 9.9.9.9; search domains equal seed. Terminal withheld; eslogger detecting networksetup/scutil by the agent -> 0.

建议部分得分

70% exact servers; 20% order; 10% search domains unchanged

R01.04.01.01-T02 Manual proxy with a bypass list on Windows 11

原始指令

Set a manual proxy 10.0.0.5:3128 in Settings > Network & internet > Proxy, bypass it for *.local and *.corp.test, and tick 'Don't use the proxy server for local (intranet) addresses'.

平台: win · Windows
应用: Network settings · Windows Settings
交互表面: desk · 桌面 GUI
GUI 需求 · 任务设定: G2 · GUI 必要
GUI 需求 · 普通权限: CL · CLI 足够
交互原语: click · 指向与点击 type · 文字与表单
工作产物: WP08 · 应用 / 系统状态
条件: 未声明
提案难度: 2 / 5

建议验证方式

HKCU Internet Settings ProxyEnable=1, ProxyServer=10.0.0.5:3128, ProxyOverride contains *.local;*.corp.test;<local>. regedit/cmd/PowerShell blocked by AppLocker; Sysmon EID1 detects reg.exe/netsh winhttp by the agent -> 0.

建议部分得分

40% proxy enabled with address; 40% bypass entries; 20% local addresses bypass

R01.04.01.01-T03 Authenticated HTTP/HTTPS proxy on macOS

原始指令

Configure Wi-Fi to use web proxy (HTTP) and secure web proxy (HTTPS) proxy.test:8080 with username/password from fixtures/proxy_creds.txt, bypass '*.corp.test, 169.254/16', and confirm Safari can load http://check.test through it.

平台: mac · macOS
应用: Network settings · Safari
交互表面: desk · 桌面 GUI
GUI 需求 · 任务设定: G2 · GUI 必要
GUI 需求 · 普通权限: G2 · GUI 必要
交互原语: click · 指向与点击 type · 文字与表单
工作产物: WP08 · 应用 / 系统状态
条件: 未声明
提案难度: 3 / 5

建议验证方式

`networksetup -getwebproxy/-getsecurewebproxy Wi-Fi` enabled, host/port; authenticated flag on; bypass list exact; proxy access log shows authenticated GET check.test from this host. Terminal withheld; eslogger detects networksetup -> 0.

建议部分得分

30% HTTP proxy; 30% HTTPS proxy; 20% bypass list; 20% authenticated request logged

R01.04.01.01-T04 Import a WireGuard tunnel in GNOME and limit autoconnect

原始指令

In GNOME Settings > Network > VPN, import ~/wg0.conf as a WireGuard connection named 'Office', set it not to connect automatically, and make it available to this user only. Connect once and confirm 10.99.0.1 is reachable.

平台: lin · Linux
应用: GNOME Settings · VPN clients
交互表面: desk · 桌面 GUI
GUI 需求 · 任务设定: G2 · GUI 必要
GUI 需求 · 普通权限: CL · CLI 足够
交互原语: click · 指向与点击 type · 文字与表单
工作产物: WP08 · 应用 / 系统状态
条件: 未声明
提案难度: 3 / 5

建议验证方式

`nmcli -f connection.id,connection.type,connection.autoconnect,connection.permissions connection show Office`: wireguard, autoconnect no, permissions user:<u>; ping log 10.99.0.1 success from the session. Terminal withheld; auditd detects nmcli by the agent -> 0.

建议部分得分

40% imported and named; 20% autoconnect off; 15% user-only; 25% connected and reachable

R01.04.01.01-T05 Static IPv4 with DNS suffix on Ethernet

原始指令

Set the Ethernet adapter to static IPv4 192.168.50.20/24, gateway 192.168.50.1, DNS 192.168.50.2 then 1.1.1.1, and connection-specific DNS suffix corp.test. Keep IPv6 on automatic.

平台: win · Windows
应用: Network settings · Control Panel
交互表面: desk · 桌面 GUI
GUI 需求 · 任务设定: G2 · GUI 必要
GUI 需求 · 普通权限: CL · CLI 足够
交互原语: click · 指向与点击 type · 文字与表单 nav · 平移 / 缩放 / 滚动
工作产物: WP08 · 应用 / 系统状态
条件: 未声明
提案难度: 3 / 5

建议验证方式

Get-NetIPConfiguration (grader): IPv4 address/prefix, default gateway, DNS order; Get-DnsClient ConnectionSpecificSuffix corp.test; IPv6 DHCP/RA unchanged. cmd/PowerShell blocked by AppLocker; Sysmon detects netsh/New-NetIPAddress by the agent -> 0.

建议部分得分

35% address/mask/gateway; 30% DNS order; 20% suffix; 15% IPv6 unchanged

R01.04.01.01-T06 Create an Office network location with static IP and PAC

原始指令

Create a network location 'Office' where Ethernet uses static IP 10.20.5.40/24 router 10.20.5.1 and automatic proxy configuration http://pac.corp.test/proxy.pac, while the 'Automatic' location stays unchanged. Switch to 'Office'.

平台: mac · macOS
应用: Network settings
交互表面: desk · 桌面 GUI
GUI 需求 · 任务设定: G2 · GUI 必要
GUI 需求 · 普通权限: CL · CLI 足够
交互原语: click · 指向与点击 type · 文字与表单 nav · 平移 / 缩放 / 滚动
工作产物: WP08 · 应用 / 系统状态
条件: 未声明
提案难度: 4 / 5

建议验证方式

`networksetup -listlocations` includes Office and current location Office; scutil/preferences.plist for Office: manual IPv4 values and ProxyAutoConfigURLString; Automatic set's services hash-equal seed. Terminal withheld; eslogger detects networksetup -> 0 (control pair T20).

建议部分得分

25% location created and active; 35% static IP; 25% PAC URL; 15% Automatic untouched

R01.04.01.01-T07 Split-tunnel IKEv2 VPN with built-in Windows client

原始指令

Add a built-in VPN 'Lab IKEv2' to vpn.test (IKEv2, EAP-MSCHAPv2, credentials in fixtures\vpn.txt). In the adapter's IPv4 advanced settings untick 'Use default gateway on remote network', add a route so only 10.20.0.0/16 uses the VPN, connect, and confirm public IP unchanged.

平台: win · Windows
应用: VPN clients · Windows Settings · Control Panel
交互表面: desk · 桌面 GUI
GUI 需求 · 任务设定: G2 · GUI 必要
GUI 需求 · 普通权限: CL · CLI 足够
交互原语: click · 指向与点击 type · 文字与表单 nav · 平移 / 缩放 / 滚动
工作产物: WP08 · 应用 / 系统状态
条件: 未声明
提案难度: 5 / 5

建议验证方式

Get-VpnConnection: TunnelType Ikev2, AuthenticationMethod Eap, SplitTunneling true; Get-VpnConnectionRoute includes 10.20.0.0/16; connected state; egress-IP echo service sees non-VPN IP while 10.20.1.1 reachable. PowerShell blocked by AppLocker; Sysmon detects Add-VpnConnection/rasdial by the agent -> 0.

建议部分得分

30% VPN profile; 30% split tunnel; 20% route; 20% connected with correct egress

R01.04.01.01-T08 Install and approve a VPN configuration profile

原始指令

Install fixtures/lab_vpn.mobileconfig by opening it and approving it in System Settings > Privacy & Security > Profiles (admin password in fixtures/admin.txt), then connect the 'Lab IKEv2' VPN it adds and confirm 10.99.0.1 is reachable.

平台: mac · macOS
应用: System Settings · VPN clients
交互表面: desk · 桌面 GUI
GUI 需求 · 任务设定: G3 · 仅 GUI
GUI 需求 · 普通权限: G2 · GUI 必要
交互原语: click · 指向与点击 type · 文字与表单
工作产物: WP08 · 应用 / 系统状态
条件: 未声明
提案难度: 4 / 5

建议验证方式

`profiles list` includes the profile identifier; `scutil --nc list` shows Lab IKEv2 Connected; utun interface has 10.99.x address; ping 10.99.0.1 succeeds. `profiles install` is not available for user profiles on modern macOS, so GUI approval is required; Terminal withheld and eslogger detects scutil --nc start -> 0.

建议部分得分

40% profile installed; 30% VPN connected; 30% host reachable

R01.04.01.01-T09 Import a WireGuard tunnel and convert it to split tunnel

原始指令

Import fixtures/full_tunnel.conf into the WireGuard app, edit it so only 10.99.0.0/24 and 10.98.0.0/24 go through the tunnel (not 0.0.0.0/0), keep DNS unset, activate it, and check that your public IP is unchanged while 10.99.0.10 responds.

平台: mac · macOS win · Windows
应用: WireGuard · VPN clients
交互表面: desk · 桌面 GUI
GUI 需求 · 任务设定: G2 · GUI 必要
GUI 需求 · 普通权限: CL · CLI 足够
交互原语: click · 指向与点击 type · 文字与表单
工作产物: WP08 · 应用 / 系统状态
条件: 未声明
提案难度: 4 / 5

建议验证方式

Tunnel config (app store/keychain or C:\Program Files\WireGuard\Data\Configurations dpapi) AllowedIPs exactly two CIDRs, no DNS; tunnel active; egress echo IP equals pre-task; curl 10.99.0.10 OK. Terminal/PowerShell withheld; eslogger/Sysmon detect wg-quick or wireguard.exe /installtunnelservice by the agent -> 0.

建议部分得分

20% imported; 40% AllowedIPs edited; 20% active; 20% correct egress and reachability

R01.04.01.01-T10 Join a hidden WPA3 network with fixed private address

原始指令

On the lab test Mac join the hidden network 'LAB-5G' (WPA3 Personal, password in fixtures/wifi.txt) via 'Other…', enable Auto-Join, turn on Low Data Mode for it, and set Private Wi-Fi address to Fixed.

平台: mac · macOS
应用: Network settings · Control Center
交互表面: desk · 桌面 GUI
GUI 需求 · 任务设定: G2 · GUI 必要
GUI 需求 · 普通权限: G2 · GUI 必要
交互原语: click · 指向与点击 type · 文字与表单
工作产物: WP08 · 应用 / 系统状态
条件: 未声明
提案难度: 3 / 5

建议验证方式

Preferred networks (com.apple.wifi.known-networks.plist) entry LAB-5G: Hidden=1, SecurityType WPA3, AutoJoin=1, LowDataMode=1, PrivateMACAddressMode=fixed; currently associated SSID LAB-5G. Terminal withheld; eslogger detects networksetup -addpreferredwirelessnetwork -> 0.

建议部分得分

40% joined hidden WPA3; 20% auto-join; 20% low data; 20% fixed private address

R01.04.01.01-T11 Prune saved Wi-Fi networks and set metered Office

原始指令

Forget every saved Wi-Fi network except 'Office' and 'Home'. Set 'Office' as a metered connection and set its random hardware addresses option to 'Change daily'.

平台: win · Windows
应用: Network settings · Windows Settings
交互表面: desk · 桌面 GUI
GUI 需求 · 任务设定: G2 · GUI 必要
GUI 需求 · 普通权限: CL · CLI 足够
交互原语: click · 指向与点击 nav · 平移 / 缩放 / 滚动
工作产物: WP08 · 应用 / 系统状态
条件: risk · 高风险 / 不可逆
提案难度: 3 / 5

建议验证方式

`netsh wlan show profiles` (grader) lists only Office and Home; Office profile cost Fixed (metered) via WLAN cost policy; random MAC setting 'daily' in WlanSvc interface profile. cmd/PowerShell blocked by AppLocker; Sysmon detects netsh wlan delete profile by the agent -> 0.

建议部分得分

40% only two profiles left; 30% metered; 30% random MAC daily

R01.04.01.01-T12 Firefox-only SOCKS5 proxy with remote DNS

原始指令

Make only Firefox use the SOCKS5 proxy 127.0.0.1:1080 with 'Proxy DNS when using SOCKS v5' on and no proxy for localhost and *.corp.test. The system proxy settings must remain off.

平台: mac · macOS win · Windows web · 任意系统（网页）
应用: Firefox
交互表面: brow · 浏览器
GUI 需求 · 任务设定: G2 · GUI 必要
GUI 需求 · 普通权限: CL · CLI 足够
交互原语: click · 指向与点击 type · 文字与表单
工作产物: WP08 · 应用 / 系统状态
条件: 未声明
提案难度: 3 / 5

建议验证方式

Firefox prefs.js: network.proxy.type=1, socks host/port, socks_version=5, socks_remote_dns=true, no_proxies_on contains both entries; system proxy unchanged; SOCKS server log shows Firefox CONNECT with hostname (not IP). Shells withheld; eslogger/Sysmon detect prefs.js/user.js edits not made by Firefox -> 0.

建议部分得分

40% SOCKS configured; 25% remote DNS; 15% bypass list; 20% system proxy untouched

R01.04.01.01-T13 Write a PAC file with failover and apply it system-wide

原始指令

Write proxy.pac so *.corp.test and 10.0.0.0/8 go DIRECT, *.partner.test goes via proxy-a.test:3128 then proxy-b.test:3128 as fallback, and everything else via proxy-a only. Serve it from the provided local web root and set it as the automatic proxy URL in system settings.

平台: mac · macOS win · Windows
应用: Network settings · text editor
交互表面: desk · 桌面 GUI term · 终端
GUI 需求 · 任务设定: HY · 混合
GUI 需求 · 普通权限: CL · CLI 足够
交互原语: code · 代码与命令 click · 指向与点击 type · 文字与表单
工作产物: WP08 · 应用 / 系统状态
条件: 未声明
提案难度: 5 / 5

建议验证方式

Grader evaluates FindProxyForURL with pacparser on 30 URL/host cases (exact return strings); system auto-proxy URL set (networksetup/WinHTTP-IE AutoConfigURL); live request to app.partner.test logged by proxy-a.

建议部分得分

60% PAC logic cases; 25% system uses PAC URL; 15% live request routed

R01.04.01.01-T14 Corporate VPN client connect after trusting the right CA

原始指令

Cisco Secure Client warns about an untrusted server when connecting to vpn.lab.test. Do not click 'Connect Anyway'. Import fixtures/LabRootCA.cer into the trusted root store, then connect with group 'Engineering' and the test credentials.

平台: mac · macOS win · Windows
应用: Cisco Secure Client · Keychain Access · Certificate Manager
交互表面: desk · 桌面 GUI
GUI 需求 · 任务设定: G2 · GUI 必要
GUI 需求 · 普通权限: CL · CLI 足够
交互原语: click · 指向与点击 type · 文字与表单
工作产物: WP08 · 应用 / 系统状态
条件: licensed · 授权专业软件 risk · 高风险 / 不可逆
提案难度: 5 / 5

建议验证方式

Trust store contains LabRootCA (thumbprint exact) and no other new roots; client profile/preferences BlockUntrustedServers unchanged; headend log shows session for group Engineering with valid cert chain; client UI log has no 'Connect Anyway' event. Terminal/PowerShell withheld; eslogger/Sysmon detect `security add-trusted-cert`/certutil -> 0.

建议部分得分

30% correct CA trusted; 20% no untrusted-server bypass; 50% connected to right group

R01.04.01.01-T15 Restore internet on a Mac that says 'connected, no internet'

原始指令

Wi-Fi shows connected but no pages load. Seeded causes: a stale manual web proxy pointing to 10.9.9.9 and a DNS server 192.0.2.53 that does not answer. Fix the network settings so https://check.test loads; do not change the Wi-Fi network.

平台: mac · macOS
应用: Network settings · Safari
交互表面: desk · 桌面 GUI
GUI 需求 · 任务设定: G2 · GUI 必要
GUI 需求 · 普通权限: CL · CLI 足够
交互原语: click · 指向与点击 nav · 平移 / 缩放 / 滚动
工作产物: WP08 · 应用 / 系统状态
条件: 未声明
提案难度: 3 / 5

建议验证方式

`networksetup -getwebproxy Wi-Fi` Enabled: No; DNS set to working servers or DHCP; Safari load of check.test logged by test server; SSID unchanged. Terminal withheld; eslogger detects networksetup -> 0.

建议部分得分

40% proxy cleared; 40% DNS fixed; 20% verified load

R01.04.01.01-T16 Per-domain DNS resolver for an internal zone

原始指令

The VPN does not push DNS for corp.test. Make only *.corp.test queries go to 10.20.0.53 (create /etc/resolver/corp.test with admin rights) and add corp.test as a search domain in Network settings for Wi-Fi. Other lookups must keep using DHCP DNS.

平台: mac · macOS
应用: Network settings · Terminal
交互表面: desk · 桌面 GUI term · 终端
GUI 需求 · 任务设定: HY · 混合
GUI 需求 · 普通权限: CL · CLI 足够
交互原语: code · 代码与命令 click · 指向与点击 type · 文字与表单
工作产物: WP08 · 应用 / 系统状态
条件: 未声明
提案难度: 4 / 5

建议验证方式

`scutil --dns` shows a resolver for domain corp.test → 10.20.0.53; Wi-Fi search domains include corp.test; dscacheutil resolves wiki.corp.test to 10.20.1.5 and example.test via DHCP DNS; /etc/hosts unchanged.

建议部分得分

40% scoped resolver; 25% search domain via GUI; 25% resolution behaves; 10% hosts untouched

R01.04.01.01-T17 Private DNS and a Wi-Fi proxy on Android

原始指令

On the Android emulator set Private DNS to the hostname dns.test.example, and for the saved Wi-Fi network 'LAB' set a manual proxy proxy.test:8080 bypassing localhost and *.corp.test.

平台: and · Android
应用: Android Settings
交互表面: mob · 移动触控
GUI 需求 · 任务设定: G2 · GUI 必要
GUI 需求 · 普通权限: G2 · GUI 必要
交互原语: touch · 触控手势 type · 文字与表单
工作产物: WP08 · 应用 / 系统状态
条件: 未声明
提案难度: 3 / 5

建议验证方式

`settings get global private_dns_mode` = hostname and private_dns_specifier = dns.test.example; WifiConfigStore.xml LAB ProxySettings STATIC host/port/exclusions. adb is withheld from the agent; these settings are reachable only through the emulator Settings UI.

建议部分得分

45% private DNS; 40% Wi-Fi proxy; 15% exclusion list

R01.04.01.01-T18 OpenVPN profile with saved key password and kill switch

原始指令

Import fixtures/branch.ovpn into OpenVPN Connect, save the private-key password from fixtures/key_pw.txt in the profile, enable the 'Seamless Tunnel' (block traffic when disconnected) option, and connect.

平台: mac · macOS win · Windows
应用: OpenVPN Connect · VPN clients
交互表面: desk · 桌面 GUI
GUI 需求 · 任务设定: G2 · GUI 必要
GUI 需求 · 普通权限: G2 · GUI 必要
交互原语: click · 指向与点击 type · 文字与表单
工作产物: WP08 · 应用 / 系统状态
条件: 未声明
提案难度: 4 / 5

建议验证方式

OpenVPN Connect config store: profile imported with saved PK password flag; seamless tunnel enabled; server log shows client connect; when grader drops the server, outbound test request is blocked. Terminal/PowerShell withheld; eslogger/Sysmon detect ovpncli/openvpn CLI by the agent -> 0.

建议部分得分

30% imported with saved password; 30% seamless tunnel; 25% connected; 15% blocking verified

R01.04.01.01-T19 Reorder network services and disable unused ones

原始指令

Set the network service order so Ethernet is above Wi-Fi, make Thunderbolt Bridge inactive and remove the unused 'USB 10/100 LAN' service.

平台: mac · macOS
应用: Network settings
交互表面: desk · 桌面 GUI
GUI 需求 · 任务设定: G2 · GUI 必要
GUI 需求 · 普通权限: CL · CLI 足够
交互原语: click · 指向与点击 drag · 拖放
工作产物: WP08 · 应用 / 系统状态
条件: risk · 高风险 / 不可逆
提案难度: 2 / 5

建议验证方式

`networksetup -listnetworkserviceorder` has Ethernet before Wi-Fi; Thunderbolt Bridge marked disabled (*); 'USB 10/100 LAN' absent. Terminal withheld; eslogger detects networksetup -ordernetworkservices -> 0.

建议部分得分

40% order; 30% Thunderbolt Bridge inactive; 30% service removed

R01.04.01.01-T20 Create the Office location with networksetup (control)

原始指令

Control pair of T06: from the terminal with admin rights, create location 'Office' with Ethernet static 10.20.5.40/24 router 10.20.5.1 and PAC URL http://pac.corp.test/proxy.pac, keep 'Automatic' unchanged, and switch to Office.

平台: mac · macOS
应用: networksetup · scutil
交互表面: term · 终端
GUI 需求 · 任务设定: CL · CLI 足够
GUI 需求 · 普通权限: CL · CLI 足够
交互原语: code · 代码与命令
工作产物: WP08 · 应用 / 系统状态
条件: 未声明
提案难度: 3 / 5

建议验证方式

Same configuration checks as T06; measures the GUI-vs-CLI gap on an identical end state.

建议部分得分

25% location active; 35% static IP; 25% PAC; 15% Automatic untouched

已有研究映射

以下沿用研究目录中的基准与小类映射，不是逐题标注、执行记录或产品背书。

AndroidWorld

同工作流族的小类

R01.04.01.02 外设与跨设备协同