AWS Client VPN ko bastion don isa VPC mai peering

Wani endpoint na Client VPN zai iya isa VPC da ke da peering da VPC ɗinsa mai alaƙa, kuma ba kwa buƙatar bastion don tabbatar da hakan ya zama halal. Zaɓin da ya cancanci yi shi ne inda zirga-zirgar ke sauya hannu: hanyar endpoint da ke sauka a cikin subnet ɗin association kuma ta tsallake haɗin peering, ko host a cikin VPC mai peering wanda ke ƙare zaman. Duk hanyoyin biyu suna aiki kuma suna karyewa a wurare daban-daban, don haka shawarar ta shafi mallaka da bincike, ba abin da AWS ke barin ba. Ga yadda nake zaɓa tsakaninsu, da shigarwar huɗu da ke sa hanyar da aka yi rute ta yi aiki.

Hanyoyi biyu, endpoint ɗaya, masu mallaka daban

A hanyar da aka yi rute, zirga-zirgar abokin ciniki ta isa endpoint, ana fassara ta zuwa adireshin interface ɗin hanyar sadarwa na Client VPN a cikin subnet ɗin association, sannan ta bar wannan subnet ta hanyar haɗin peering daga A zuwa B. VPC B ba ya ƙare wani zaman VPN; yana ganin talakawan zirga-zirga daga VPC A, shi ya sa hanyar dawowarsa ke nuni zuwa VPC A, ba zuwa tafkin abokan ciniki ba.

A hanyar bastion abokin ciniki ya fara isa host. Bastion a cikin A har yanzu yana barin tsallaken ƙarshe ya tsallake haɗin peering, don haka kuna riƙe aikin peering kuma kuna ƙara zaman. Bastion a cikin B ma yana buƙatar hanya daga abokin ciniki, kuma idan wannan hanyar ita ce hanyar endpoint ɗin, kuna da ƙirar da aka yi rute da ƙarin tsallake ɗaya. Bastion yana cire aiki ne kawai idan ya riga ya wanzu, ya riga an amince da shi, kuma abin da ke bayansa yana buƙatar iyakar zaman maimakon iyakar hanyar sadarwa.

Shigarwa huɗu suna sa hanyar da aka yi rute ta yi aiki

AWS yana rubuta wannan yanayi a shafin Client VPN how-it-works, kuma a aikace yana zuwa ga shigarwa huɗu waɗanda ƙungiyoyi biyu ko uku suka mallaka. Zangon-ƙarfe misali ne; dole zangon peering ya zama na musamman kuma zangon dawowa ya dace da shirin ku.

Hanya da izini sarrafawa ne daban. Daidaitaccen hanyar endpoint ba tare da ƙa'idar izini mai dacewa ba ya ba abokin ciniki komai; ƙa'idar izini ga wani makoma da endpoint ba zai iya yi rute ba tana ba shi baƙin rami. Duka biyu dole su ambaci zango ɗaya.

Hanyar endpoint tana nuni zuwa subnet a cikin VPC na endpoint ɗin kansa, ba taba zuwa haɗin peering ba. Teburan rute na VPC suna nuni zuwa haɗin peering, ba taba zuwa instance ko interface ba. Kwafin ƙima tsakanin biyun ana adana shi ba tare da ƙorafi ba kuma ba ya rute komai.

Domin subnet ɗin association yana fassara tushen abokin ciniki, B dole ya yi rute da baya zuwa VPC A, ba zuwa tafkin abokan ciniki ba. Aika zangon abokin ciniki ta haɗin peering yana kama da daidaito, yana wuce bita kuma yana kasawa a hankali domin B ba ya taɓa ganin fakiti mai tushen abokin ciniki.

Ƙungiyoyin tsaro da mitar ƙarshe ta izini

Rute yana kawo fakiti cikin B; B har yanzu yana yanke hukunci. Don haɗin peering mai aiki a cikin yanki ɗaya, ƙungiyar tsaro a cikin B za ta iya yin nuni ga ƙungiyar da aka yi amfani da ita akan association ɗin Client VPN, wanda ke riƙe ƙa'idar a takaice kuma yana jure wa canjin adireshi. Inda nuni ga ƙungiya ba zai yiwu ba, ba da izinin zangon subnet ɗin association a fili maimakon faɗaɗa zuwa 0.0.0.0/0, wanda ke mai da kuskuren rute zuwa timeout marar bayani.

Sannan duba abin da rute ba ya taɓawa: ACL ɗin cibiyar sadarwa a kan duka subnets, jerin izini na aikace-aikacen ko masu sauraron token, da DNS. Peering ba ya kwafin yankunan da aka shirya na sirri, don haka kwamfutar tafi-da-gidanka na iya riƙe hanyar da ke aiki zuwa adireshin da ba za ta iya warwarewa ba, kuma haɗin peering ba ya ƙara amincewa ga takardar shaida. Nuna endpoint zuwa resolver da ke amsa don B, sannan tabbatar cewa sunan sirri da takardar shaida sun dace.

Yaushe bastion shine amsar gaskiya

Ina riƙe turaki uku don zaɓar bastion da gangan. VPC mai peering na ƙungiyar da ba za ta ƙara hanyar dawowa ga zangon ku ba ko ba za ta karɓi nuni ga ƙungiya ba. Dole a amince da shiga ko a rubuta shi kowace zama kuma aikace-aikacen ba zai iya ɗaukarsa da kansa ba. Ko kuma tsallaken ƙarshe dole ya kasance cikin B domin ana warware hidimar a can kawai kuma an liƙa asalin TLS ɗinta ga sunan ciki.

Babu ɗaya daga cikin waɗannan da ke kewaya gaskiyar cewa peering ba mai wucewa ba ne. Rashin wucewa yana iyakance abin da albarkatu a cikin B za su iya yi: ba za su iya amfani da A a matsayin hanyar wucewa zuwa VPC na uku da A ke da peering da shi ba. Hakan bai taɓa nufin mai amfani da VPN ba zai iya isa VPC mai peering kai tsaye ba, kuma bastion da aka gina don kewaya wannan kuskuren karatu host ne da za a yi patch ba tare da dalili ba.

Kuskuren akasin haka yana kashe fiye a kan lokaci: tura kowace ƙungiya ta cikin bastion ɗaya da ya riga ya wanzu, sannan gano cewa ƙungiyar tsaronsa, teburin rute da taga patch ɗinsa su ne dogaron samarwa. Rubuta wace turaki host ɗin yake hidima, kuma ka janye shi idan turakin ya tafi.

Transit Gateway da association da yawa suna canza lissafi

Idan an haɗa endpoint kai tsaye zuwa Transit Gateway maimakon subnet, ƙirar tana canzawa: ba a sake fassara abokan ciniki zuwa adireshin interface a cikin subnet ɗin association ba, kuma teburan rute na gateway dole su ɗauki zangon abokin ciniki da ƙarin haɗin da ke kaiwa VPC mai peering. Wannan ya fi tsafta a ma'auni, amma aikin yana ƙaura daga shigarwa huɗu zuwa teburan rute na gateway.

Association da yawa suna ninka bincike. Hanyar endpoint na endpoint ne, duk da haka kowane subnet ɗin association yana buƙatar teburin rute mai ainihin peering next hop. Zama na iya yin nasara ta association ɗaya yayin da wani ba shi da hanyar dawowa, don haka gwada kowanne.

Tsarin tabbatarwa da ke gano karyewa da sauri

Gudanar da waɗannan a jere; kowane mataki na iya wucewa yayin da na gaba ya kasa, kuma timeout na abokin ciniki kusan ba ya faɗin wanne ya karye.

1. Warware sunan aikace-aikacen daga abokin ciniki kuma duba cewa adireshin yana cikin zangon peering.
2. Haɗa, sannan karanta log ɗin haɗin endpoint don association ɗin da ya ƙare zaman.
3. A kan wannan subnet ɗin association, tabbatar cewa teburin rute yana nuni da zangon peering zuwa haɗin peering mai aiki.
4. A kan subnet ɗin albarkatu a cikin B, tabbatar da shigarwar dawowa don zangon interface da ƙa'idodin ƙungiya masu dacewa.
5. Gwada aiki ɗaya da aka yarda da shi da albarkatu ɗaya da dole ya kasance ba a iya isa ba; na biyu yana kama ragowar debugging.
6. Sake haɗawa bayan kowane canjin rute na split-tunnel, domin tunnel mai gudana ba zai ɗauki sabon saitin rute ba.

Alamomi biyu sun cancanci tunawa. SYN da ya isa B ba tare da amsa ba kusan koyaushe shine hanyar dawowa da ta ɓace. Haɗin da ya kammala sannan ya sake saitawa yawanci ƙungiya ce, ACL ko aikace-aikacen. Babu ɗaya da ke bayyana a cikin log ɗin endpoint a matsayin dalili, don haka riƙe shigarwa huɗu tare da mai mallaka kusa da kowanne.

Idan babu ɗaya daga cikin turaki uku da ya dace, kammala hanyar da aka yi rute kuma rubuta waɗannan shigarwa huɗu. Idan ɗaya ya dace, riƙe bastion don wannan iyaka kawai kuma bar hanyar endpoint ga ayyukan da ba sa buƙatar zaman a gabansu.