Cikakken tunnel na Access Server a EC2: me ya sa akwatin dubawa daya bai isa ba

Kashe dubawar tushe da manufa a kan injin EC2 ita ce amsa da aka fi maimaitawa kan tambayoyi game da fitar Access Server zuwa intanet, kuma ita kadai ba ta yi wa abokan cinikinka komai. Dubawar wani takaitaccen turawa ne na AWS: tana sa injin ya karbi fakiti wadanda tushensu ko manufarsu ba adireshinsa ba ne. Ba ta gaya wa abokin ciniki na Access Server ya aika zirga-zirgar intanet ta cikin tunnel ba, ba ta kirkiro hanya zuwa sama ba, kuma ba ta kara NAT ba. Tatsuniyar ita ce akwatin dubawa shi ne fasalin.

Abin da dubawar ke sarrafawa a hakika

Kowane fuskar cibiyar sadarwa ta EC2 yana watsar da zirga-zirgar da ba a aika masa ba, sai dai idan injin yana aiki a matsayin na’urar hanya, na’urar NAT ko kofar VPN kuma ka kashe wannan dubawar. Kashe ta yana ba da izinin turawa. Izinin ba tsari ba ne: injin yana bukatar hanyar zuwa kofar intanet ko na’urar NAT, teburin hanyoyi na VPC yana bukatar shigarwar da ta dace, kungiyoyin tsaro dole su yarda da kwararar, kuma uwar garken dole ta fassara ko ta bi diddigin zirga-zirgar dawowa.

Duba darajar yanzu da aws ec2 describe-instance-attribute --instance-id i-0123456789abcdef0 --attribute sourceDestCheck kafin ka canza komai. Idan ka canza ta a cikin console, canza ta saboda injin yana turawa domin wasu, ba saboda abokin ciniki ba ya isa intanet ba.

Access Server ne ya mallaki manufar hanyoyin abokin ciniki

A cikin Access Server 3, bude Access Controls ka nemo sashin Internet Access and DNS. Zabin Internet Gateway yana bayar da cikakken tunnel ko rabin tunnel; cikakken tunnel yana gaya wa abokin ciniki ya bi diddigin zirga-zirgarsa ta asali cikin VPN, rabin tunnel yana barin zirga-zirgar intanet a hanyar gida ta abokin ciniki. Ajiye ka yi amfani ta hanyar aikin kayan, sannan ka sake hada abokin ciniki na gwaji, domin ana isar da manufar a lokacin hadawa.

Sigar da suka gabata suna amfani da menu daban kuma wasu gine-ginen Community na OpenVPN ba su da irin wannan iko. Duba babbar sigar da aka shigar kafin ka nemi allon da babu shi. Sannan tabbatar da abin da abokin ciniki ya karba: bayanin cikakken tunnel ya kamata ya sanya hanyar asali ta cikin tunnel, kuma bayanin rabin tunnel bai kamata ya yi haka ba.

Bi fakiti bayan tunnel

Da zarar abokin ciniki ya aika zirga-zirgar intanet cikin tunnel, uwar garken dole ta tura ta kuma yawanci ta fassara ta. Access Server yana kula da nasa dokokin NAT da hanyoyi, don haka karanta tsarin da ke aiki maimakon kara dokokin Community OpenVPN cikin fayilolin da aka kirkira; ana sake rubuta dokokin da ba a kula da su ba ko suna cin karo a sabuntawar kayan na gaba. sudo iptables -t nat -L -n -v ko makamancin nftables yana nuna abin da ake fassarawa a hakika.

Bangaren AWS wata hanya ce daban. Injin da ke cikin subnet na jama’a yana isa kofar intanet kai tsaye kuma yana rike da adireshinsa na jama’a ko elastic IP. Injin da ke cikin subnet na sirri yana bukatar hanya zuwa kofar NAT ko injin NAT, kuma na’urar NAT tana bukatar nata hanyar zuwa kofar intanet. Haḥa kofar intanet zuwa VPC ba ta ba wa kowane tushe na sirri adireshin dawowa na jama’a da kanta, shi ya sa wannan tsarin Access Server ke aiki a wani subnet kuma yana kasawa a shiru a wani.

Duba teburin hanyoyi da ke da alaka da subnet din injin, ba kawai babban teburin VPC ba. Hadin subnet yana wuce babban teburin, kuma tsohon hadi shine sanadin da ya zama ruwan dare na tsarin da ke aiki ya tsaya bayan sake ginawa.

Raba fitar IP da DNS

Gwada adireshin zahiri da farko, sannan suna, daga wannan aikace-aikacen abokin ciniki. Idan curl -4 https://checkip.amazonaws.com ya dawo da adireshin jama’a amma sunayen mai masauki sun kasa, tunnel da hanyar NAT suna aiki kuma matsalar DNS ce: resolver din da aka tura, yanayin resolver na abokin ciniki, ko kungiyar tsaro da ke toshe resolver din. Saitunan DNS na Access Server suna cikin yankin Internet Access guda, amma suna bi hanyar lambar daban.

Kwatanta adireshin da aka dawo da fitar da ka yi niyya. Idan adireshin jama’a ne na injin, injin ne ke fassara zirga-zirgar; idan adireshin kofar NAT ne, ana amfani da hanyar subnet na sirri. Dukansu na iya zama daidai. Abin da ba za ka iya kammalawa ba shi ne cewa burauza a kan uwar garken ya tabbatar da turawa ga abokin ciniki.

Kada ka bar akwati daya ya rufe binciken

IPv6 yanke shawara ce daban. Manufar cikakken tunnel ga IPv4 ba ta ce komai game da ko ana daukar IPv6, an toshe shi ko yana yoyo, kuma abokin ciniki mai tarin biyu na iya ci gaba da amfani da hanyarsa ta gida ta IPv6 yayin da IPv4 ke cikin tunnel. Gwada dangin adireshin da kake da muhimmanci da gaske, kuma yanke shawara a fili ko ya kamata a kashe dayan.

A karshe, gwada yanayin da aka cire. Zabin cikakken tunnel yana bayanin manufar hanyoyi lokacin da kake hada, ba abin da ke faruwa idan tunnel ya fadi ba. Idan bukatar ita ce babu zirga-zirgar da za ta tsere waje da VPN, wannan tambaya ce ta kill-switch da bangon wuta, kuma tana bukatar nata gwajin maimakon kammalawa daga teburin hanyoyi.