An haɗa AWS Client VPN amma babu intanet: duba hanyoyin

Kana da alaƙa da ƙarshen wurin AWS Client VPN, ƙaramin cibiyar sadarwa ta sirri tana amsawa, amma kowane shafi na jama'a yana ƙarewa da lokaci. Wannan haɗin yana taƙaita matsalar zuwa ɗaya daga cikin abubuwa uku a gefen da ake sarrafawa: hanyar da abokin ciniki ke girka, hanyar ƙarshen wurin tare da ƙa'idar izininsa, ko matakin gaba na ƙaramin cibiyar sadarwar da ke da alaƙa. Ina duba su a wannan tsari domin kowace gazawa tana bambanta daga wajen abokin ciniki. Wannan jagorar ta shafi ƙarshen wurin da ake sarrafawa wanda ke da alaƙa da VPC, ba sabar OpenVPN a kan EC2 ba kuma ba haɗin Cloud WAN ko Transit Gateway ba.

Fara da abin da abokin ciniki ke tura da gaske

Yanayin haɗi yana tabbatar da zaman TLS da rabon CIDR ga abokin ciniki, ba wani abu ba. Tambayi tsarin aiki inda adireshin jama'a zai je yayin da ramin yake a buɗe. A Linux, ip route get 1.1.1.1 ya kamata ya ambaci muƙamin ramin; a macOS, netstat -rn -f inet | head -5 yana nuna shigarwar da aka saba; a Windows, Find-NetRoute -RemoteIPAddress 1.1.1.1 yana buga muƙamin da aka zaɓa da mataki na gaba.

Sannan ka karanta tutar raba-ramin, domin ita ce ke yanke shawarar ko hanyoyin da ƙarshen wurin ya wallafa su ne kaɗai wuraren da abokin ciniki ke turawa cikin ramin:

aws ec2 describe-client-vpn-endpoints \
  --client-vpn-endpoint-ids cvpn-endpoint-0123456789abcdef0 \
  --query 'ClientVpnEndpoints[0].SplitTunnel'

Lokacin da SplitTunnel gaskiya ne, waje na jama'a yana amfani da ramin ne kawai lokacin da ƙarshen wurin ya wallafa hanyar da ta rufe shi, don haka 0.0.0.0/0 da ba ya nan yana barin wannan zirga-zirgar a muƙamin gida. Idan ƙarya ne, abokin ciniki yana kama zirga-zirgar, amma ƙarshen wurin har yanzu dole ya tsara ta kuma ya ba da izini; in ba haka ba fakiti suna shiga ramin kuma suna tsayawa a can. Sake haɗa abokin ciniki bayan canza ɗaya daga cikin saitin biyu, domin ana ba da hanyoyi da sabar DNS a lokacin haɗi kuma abokin ciniki mai gudana na iya riƙe tsohon sa.

Karanta hanyar ƙarshen wuri da ƙa'idar izini daban

Waɗannan abubuwa biyu ne, kuma ƙirƙirar ɗaya ba ya ƙirƙirar ɗayan. Jera hanyoyin ƙarshen wurin ka nemi hanyar da aka saba wadda manufarta ita ce ƙaramin cibiyar sadarwa mai alaƙa:

aws ec2 describe-client-vpn-routes \
  --client-vpn-endpoint-id cvpn-endpoint-0123456789abcdef0

Kowace hanya tana da manufa guda ɗaya tak, don haka haɗe-haɗe uku suna buƙatar hanyar da aka saba da ta dace kowace. AWS tana rubuta wannan buƙatar rufewa, kuma alamar da ta dace ta rata ita ce mai amfani da ke aiki daga wata cibiyar sadarwa kuma yana tsayawa daga wata, wanda ake karantawa a matsayin gazawa mai zuwa lokaci-lokaci maimakon hanyar da ta ɓace. takardun yanayin Client VPN na hukuma sun bayyana tsarin ƙaramin cibiyar sadarwar jama'a da waɗannan hanyoyin suka kasance a ciki.

Izini shine abu na biyu. Lokacin da babu ƙa'ida da ta rufe waje na jama'a, ramin yana ɗaukar fakitin kuma sabis ɗin ya watsar da shi, don haka albarkatun sirri suna ci gaba da aiki yayin da intanet ba ya:

aws ec2 describe-client-vpn-authorization-rules \
  --client-vpn-endpoint-id cvpn-endpoint-0123456789abcdef0

Ƙa'ida ta CIDR na VPC ba ta ce komai ba game da 0.0.0.0/0. Ƙara ɓangarorin da suka ɓace don cikakken rami yana nufin hanya ɗaya ga kowace ƙaramin cibiyar sadarwa mai alaƙa da ƙa'idar izini da za ka iya bincika daga baya:

aws ec2 create-client-vpn-route \
  --client-vpn-endpoint-id cvpn-endpoint-0123456789abcdef0 \
  --destination-cidr-block 0.0.0.0/0 \
  --target-vpc-subnet-id subnet-0a1b2c3d4e5f67890
aws ec2 create-client-vpn-authorization-rule \
  --client-vpn-endpoint-id cvpn-endpoint-0123456789abcdef0 \
  --destination-cidr-block 0.0.0.0/0 \
  --access-all \
  --description "internet egress for full tunnel"

--access-all yana ba da manufar ga kowane abokin ciniki na ƙarshen wurin, don haka riƙe shi kawai muddin ana son ramin ya zama cikakke; ƙa'idar da aka ɗaure da rukunin jagorar ita ce mafi kyau lokacin da kake da rukunoni da za a ɗaure.

Bi fakitin daga ƙaramin cibiyar sadarwar da ke da alaƙa

Hanyar ƙarshen wuri tana yanke shawarar cewa AWS yana ba da fakitin ga wannan ƙaramin cibiyar sadarwar. Ba ta yanke shawarar mataki na gaba bayanta ba, wanda ke rayuwa a cikin teburin hanyoyin VPC na ƙaramin cibiyar sadarwar kanta:

aws ec2 describe-route-tables \
  --filters Name=association.subnet-id,Values=subnet-0a1b2c3d4e5f67890 \
  --query 'RouteTables[].Routes[?DestinationCidrBlock==`0.0.0.0/0`]'

Hanyar da aka saba da za a iya amfani da ita tana nuni ga ƙofar intanet don ƙaramin cibiyar sadarwar jama'a, ko ga ƙofar NAT don ta sirri, kuma yanayin blackhole yana nufin an share manufar kuma hanyar yanzu tana mutuwa a hankali. Waɗannan tebura ne daban da jerin hanyoyin ƙarshen wurin, kuma gyaran ɗaya ba ya gyara ɗayan.

Matattara biyu suna kan wannan mataki. Ƙungiyar tsaro da aka yi amfani da ita a haɗin cibiyar sadarwar manufa dole ta ba da izinin zirga-zirgar fita zuwa waje na jama'a, kuma duk wani ACL na cibiyar sadarwa da ya dace dole ya ba da izinin buƙatar da zirga-zirgar dawowa a tashoshin efemera. Ƙuntataccen ƙungiyar tsaro ta haɗi shine sanadin da ya zama ruwan dare cewa shiga na sirri yana aiki yayin da na jama'a ba ya.

Zaɓi matakin farko daga alamar maimakon canza duka uku lokaci ɗaya:

Raba gazawar DNS da mataccen hanya

Warware suna yana gazawa daban da turawa, kuma cikakken rami yana sa bambancin ya zama mahimmanci domin yanzu ana isa ga mai warware da aka tura ta cikin ramin. Idan ƙarshen wurin ya ƙayyade sabar DNS na VPC, adiresoshinsu suna buƙatar rufewar hanya da izini kamar kowace manufa. Tambayi mai warware kai tsaye don ganin wace gazawa kake da ita: dig +short example.com @10.0.0.2, ko nslookup example.com 10.0.0.2 a Windows.

Lokacin da URL na lamba ya amsa kuma na suna bai amsa ba, daina gyaran hanyar da aka saba ka yi aiki a kan DNS. Buƙata zuwa adireshin IP ba ta tabbatar da komai game da mai masaukin kama-da-wane mai suna da takardar shaidarsa, don haka riƙe gwaji ɗaya mai suna a cikin binciken ƙarshe.

Lokaci yana taimakawa. Haɗin TCP da ba ya samun amsa cikin 'yan daƙiƙa yana nuni ga tsarin hanya ko matattara, yayin da buƙatar da ke rataye cikin neman suna tana nuni ga mai warware. Canza hanyar da aka saba yayin da mai warware ba ya isa yana mai da gazawa ɗaya zuwa biyu.

Juya baya da tsabta, sannan tabbatar da hanyar fita

Dukansu abubuwan sun kasance na ƙari, don haka juyawa baya shine sharewa ba gyara ba:

aws ec2 delete-client-vpn-route \
  --client-vpn-endpoint-id cvpn-endpoint-0123456789abcdef0 \
  --destination-cidr-block 0.0.0.0/0 \
  --target-vpc-subnet-id subnet-0a1b2c3d4e5f67890
aws ec2 delete-client-vpn-authorization-rule \
  --client-vpn-endpoint-id cvpn-endpoint-0123456789abcdef0 \
  --destination-cidr-block 0.0.0.0/0 \
  --access-all

Sake haɗi, sannan tabbatar da wace hanya zirga-zirgar ke fita. Kwatanta adireshin jama'a da aka gani da adireshin IP na roba na ƙofar NAT, ko da ƙofar intanet da ka yi niyyar amfani da ita, kuma duba ko albarkar sirri har yanzu tana amsawa a cikin zaman ɗaya.

Kammala da ɗan gajeren jeri, kuma ɗauki abu na ƙarshe a matsayin ɓangare na canjin ba takarda ba:

• Ɗaya 0.0.0.0/0 hanyar ƙarshen wuri ga kowace ƙaramin cibiyar sadarwa mai alaƙa.
• Ƙa'idar izini da ta rufe 0.0.0.0/0 ga abokan cinikin da kake son yi wa hidima.
• Hanyar da aka saba ta VPC wadda ba ta cikin yanayin blackhole a kowace ƙaramin cibiyar sadarwa mai alaƙa.
• Fitowar ƙungiyar tsaro ta haɗi, da zirga-zirgar dawowa ta ACL.
• Adiresoshin mai warware da aka tsara kuma aka ba izini, an tabbatar da su da buƙata mai suna.
• Juyawa baya da aka rubuta don hanyar da ƙa'idar.

Wata sanarwa ta iyaka: wannan hanya ce ta IPv4. Abokin ciniki mai matakai biyu yana riƙe da duk wata hanyar sadarwa ta IPv6 da yake da ita, don haka hanyar da aka saba ta IPv6 shawara ce daban da izininta ba sakamakon wannan ba.