DNS na AWS Client VPN: yi amfani da resolver na VPC, ba subnet ba

Endpoint yana cikin 10.0.8.0/24, don haka resolver dole ya zama 10.0.8.2. Wannan ita ce hujja da na fi ji, kuma ba daidai ba ne sau biyu. Route 53 Resolver yana amsawa a kan babban kewayon IPv4 na VPC da biyu, wanda ga VPC na 10.0.0.0/16 shine 10.0.0.2, ko wace subnet endpoint ɗin yake amfani da ita. Kuskure na biyu ya fi shiru: saka adireshin daidai a cikin endpoint ba ya nufin cewa tsarin aiki na client zai taɓa tambayarsa komai. Duk kuskuren biyu suna ba da alama ɗaya: warware suna yana aiki ga wasu clients kuma yana kasawa ga wasu.

Tatsuniya ta fara ne daga haɗin subnet

Haɗin yana magana ne a kan inda elastic network interfaces na haɗin client suke, ba a kan wane adireshin resolver yake ba. Subnets na endpoint suna ba clients adireshi a cikin VPC, kuma kowannensu ba ya ɗauke da nasa resolver.

Da zarar ka raba waɗannan ra’ayoyi biyu, lissafin ya daina zama abin mamaki, kuma binciken matsala ya koma ga client, inda yawancin waɗannan al’amuran suke ƙarewa da gaske.

Ƙididdige adireshin daga babban kewayon VPC

Ɗauki babban CIDR na IPv4 na VPC ka ƙara biyu a adireshin cibiyar sadarwa. 10.0.0.0/16 yana ba da 10.0.0.2, 172.31.0.0/16 yana ba da 172.31.0.2, kuma VPC mai kewayon na biyu yana riƙe resolver a babban. Subnet na 10.0.8.0/24 a cikin wannan VPC ba ya motsa shi. Rubuta adireshin kusa da ID na VPC kafin ka taɓa endpoint, domin lambar dukiyar VPC ce ba ta haɗin ba.

VPC kuma yana amsawa a adireshin link-local 169.254.169.253. Wannan adireshin ana iya isa gare shi daga cikin VPC, amma ba makoma ce da aka yi mata hanya gaba ɗaya ba ga kwamfutar tafi-da-gidanka a wani gefen tunnel.

Don haka akwai adiresoshin resolver guda biyu masu inganci, kuma babu ɗayansu da ya zama subnet da biyu.

Abin da saitin endpoint yake yi da abin da ba ya yi

Endpoint na Client VPN yana da filayen DNS server, kuma inda console ke bayar da zaɓin resolver na VPC yana cika wannan ra’ayi. Saitawa yana canza abin da sabis ɗin ke miƙa wa clients yayin kafa haɗin. Ba ya canza abin da client na OpenVPN mara kulawa yake yi da wannan ƙimar, domin client ɗin dole ya yi amfani da ita a tsarin aiki. Daga wannan gibin ne «yana aiki a Mac na amma ba a na’urar Linux ba» yake zuwa.

A Linux haɗin resolver mallakar mai kula da haɗi ne ba na mai amfani ba. Gyara /etc/resolv.conf da hannu yana tabbatar da cewa adireshin yana aiki don zama ɗaya sannan ya ɓace yayin sake haɗawa — shi ya sa yawancin al’amuran da aka gyara suke dawowa da safe.

Duba resolver mai aiki a kan client bayan haɗawa, ba shafin tsarin endpoint ba.

Split tunneling na iya kayar da daidaitaccen resolver

Da split tunneling ana amfani da hanyoyin da aka tura cikin tunnel kawai. Idan adireshin resolver ba ya cikin wata hanya, tambayar tana fita ta local interface kuma router na gida ne yake amsawa. Adireshin da ke cikin endpoint daidai ne har yanzu kuma binciken yana kasawa har yanzu. Ƙara hanya don resolver, sannan sake gwadawa.

Kewayon gida masu haɗuwa suna ba da sakamako ɗaya a hanya mafi muni: ana amsa tambayar, amma daga server ɗin da ba daidai ba.

Kada ka buɗe security groups don adireshin Amazon DNS

Hankali lokacin da bincike ya ƙare lokaci shine ƙara doka da ke ba da izinin UDP 53 zuwa adireshin resolver. AWS ya rubuta cewa security groups da network ACL ba sa tace zirga-zirgar Amazon DNS kamar yadda suke tace zirga-zirga zuwa naku DNS instance. Buɗe waɗannan dokoki ba ya canza komai ga resolver na VPC kuma yana faɗaɗa iyaka ba tare da dalili ba. Resolver da kake gudanarwa da kanka wani lamari ne daban kuma yana buƙatar nasa dokoki.

Idan duka biyu suna cikin tsarinka, duba wanda client ɗin yake nufa da gaske kafin ka gyara kowace doka.

Tabbatar da hanyar, sannan auna wani abu

Warware sunan jama’a, warware sunan sirri da aka yi rijista a wani yanki mai masauki na sirri da ke da alaƙa da VPC, sannan karanta resolver mai aiki na client tsakanin su. Wannan jeri yana raba «adireshin resolver ba daidai ba ne» daga «yankin ba shi da alaƙa» da «client ya yi watsi da saitin». Kowanne yana da gyara daban, kuma babu ɗaya da ya zama matsalar saurin watsawa.

Bincike mai nasara ba ya faɗi komai game da saurin canja wuri mai dorewa, don haka ka raba waɗannan tattaunawa biyu lokacin da kake bayar da rahoto.