AWS Site-to-Site VPN zuwa NAT Gateway: VGW da Transit Gateway

Kowa yana zana wannan zane a karon farko: VPN cikin VPC, NAT gateway zuwa intanet, an gama. Amma AWS ba ta goyi bayan wannan hanya lokacin da VPN ta ƙare a kan virtual private gateway, kuma gazawar tana da shiru har ƙungiyoyi suna sake gina ta fiye da sau ɗaya. Tsarin da ke aiki yana buƙatar transit gateway, wanda ke canza gateway da teburin hanyoyi a ɓangarorin biyu. Kwatanta siffofin biyu kafin ka zana komai.

Tsarin da yake kama a bayyane amma ba a goyi bayansa

Takardun NAT gateway na AWS suna zana layin da ke ba kowa mamaki wanda ya gina tsarin VPC ɗaya kawai: ba za a iya tura zirga-zirgar Site-to-Site VPN zuwa NAT gateway ta virtual private gateway ba. Nau'in gateway da VPN ta ƙare a kansa ne ke ƙayyade ko akwai hanyar fassara kwata-kwata. Kuskuren yana wanzuwa domin yanayin ramin UP ne kuma EC2 instance a cikin subnet ɗaya tana isa intanet ba tare da matsala ba. Babu ɗaya daga cikin waɗannan dubawa da ke gwada ɓangaren da ya lalace.

A aikace fakiti yana zuwa da adireshin tushe daga cibiyar sadarwar gida kuma bai sami wani mataki na gaba da ake goyi bayan da zai fassara shi ba. Dangane da teburin, ana watsar da shi a iyakar fita, kuma domin ramin yana zama UP yayin da instance a cikin subnet ɗaya ke isa intanet, ana ba da rahoton gazawar a matsayin matsalar firewall ta gida.

Virtual private gateway da transit gateway

Virtual private gateway na VPC ɗaya ne. Yana ƙare VPN ɗin, yana saka hanyoyi a teburin hanyoyin wannan VPC ɗin, sannan ya tsaya a nan. Ba shi da tsarin haɗi, don haka ba zai iya miƙa zirga-zirga ga wani VPC ko ga sashen fita da aka raba ba. Wannan iyakar VPC ɗaya ita ce dukan iyaka, kuma babu wata hanya da ka ƙara cikin VPC ɗin da za ta canza ta.

Transit gateway cibiyar yanki ce inda VPN, kowane spoke VPC da VPC na ayyukan da aka raba duk suna bayyana a matsayin haɗi. Yana da nasa teburin hanyoyi, waɗanda ke zaɓar haɗin da zai karɓi wani prefix.

Wannan cibiyar ce ke sa fitarwa ta tsakiya ta yiwu: VPN tana sauka a matsayin haɗi ɗaya, VPC na fita a matsayin wani, kuma teburin hanyoyin transit gateway yana aika prefixes na intanet daga na farko zuwa na biyu. Da virtual private gateway babu wani haɗi na biyu da za a aika wani abu zuwa gare shi, shi ya sa ba za a iya gyara tsarin daga baya ba.

Hanyar fita da aka goyi bayan, mataki-mataki

Tsarin misali yana da matakai biyar kuma kowace kibiya shawara ce ta turawa da za ka saita. Zirga-zirga tana barin cibiyar sadarwar gida zuwa haɗin Site-to-Site VPN, teburin transit gateway yana tura shi zuwa haɗin VPC na fita, inda teburin subnet ke tura shi zuwa NAT gateway na jama'a. NAT gateway yana fassara tushen kuma internet gateway yana fitar da fakitin.

On-premises network
  -> Site-to-Site VPN attachment on the transit gateway
  -> transit gateway route table
  -> egress VPC attachment
  -> public NAT gateway in that VPC
  -> internet gateway

Cikakkun bayanai biyu ne ke ƙayyade ko matakan ƙarshe za su yi aiki. NAT gateway dole ne ya kasance na jama'a, da elastic IP da hanya zuwa internet gateway, domin NAT gateway mai zaman kansa yana fassara tsakanin cibiyoyin sadarwa kuma ba ya zama hanyar fita ta intanet.

Shirya NAT gateway ɗaya ga kowane Availability Zone da kake son yi wa hidima, kuma kowane teburin subnet ya nuna ga na gida. Riƙe teburin transit gateway da teburin VPC a matsayin abubuwa daban a cikin bayananka, domin ɗaya yana zaɓar haɗi ɗayan kuma yana zaɓar wata hanya cikin VPC. Hanya ta asali a ɗaya daga cikinsu kawai tana barin rabin hanyar ba ta bayyana ba kuma tana haifar da gazawa na wani ɓangare waɗanda suka fi wahalar dangantawa.

Hanyar dawowa ita ce inda waɗannan tsare-tsare suke gazawa

NAT gateway yana riƙe da yanayin kwararru da ya riga ya gani, don haka amsoshin haɗin da ke fita suna dawowa ba tare da sabon ƙa'idar shiga ba. Wannan siffa ba ta wallafa wani sabis na gida a intanet ba, kuma ɗauka cewa tana yin haka shi ne yadda ƙungiya ke kashe rana tana gyara haɗin da ba zai taɓa kafuwa ba. Ga zirga-zirgar da abokin ciniki ya fara, hanyoyi huɗu dole su yarda: manufar gida, teburin transit gateway, teburin subnet na fita da teburin subnet na NAT. Idan ka rasa na ƙarshe, buƙatar tana barin ginin yayin da amsar ke mutuwa cikin AWS.

Tabbatar da wani abokin ciniki na gaske a bayan VPN ka duba wane adireshin tushe na jama'a yake gabatarwa. Idan shine elastic IP na NAT gateway, ana fassara; idan wani abu ne daban, kana auna wata hanyar fita.

Yana da kyau a gane sigar rashin daidaituwa ta wannan gazawar da wuri. Lokacin da teburin subnet na NAT na wata Availability Zone yana da hanyar dawowa zuwa prefix na abokin ciniki ɗayan kuma ba shi da ita, sabbin haɗe-haɗe suna yin nasara ko gazawa dangane da yankin da kwararru ta faɗo, kuma ana karanta tsarin a matsayin intanet mara ƙarfi. Kwatanta teburin subnet na kowane yanki da kake yi wa hidima maimakon gyara wanda aka buɗe tikitin a ciki, domin hanyar da ta ɓace ita ce dukan laifin kuma babu abin da ke buƙatar canzawa a ɗaya gefen.

Yaushe proxy bayyananne shine mafi kyawun tsari

HTTP proxy a kan instance cikin VPC na fita shine madadin da ya halatta kuma galibi mafi arha. An saita abokan ciniki su yi amfani da shi, proxy ɗin yana buɗe nasa haɗin waje, kuma hanyar dawowa matsalarsa ce maimakon wuyar warwarewar turawa mai daidaito. Ga ƴan aikace-aikace wannan yana kawar da yawancin aikin transit gateway. Hakanan yana ba ka rikodin kowane mai amfani wanda NAT gateway ba zai iya samarwa ba.

Amma ba a bayyane yake ba. Duk abin da ya yi watsi da saitin proxy, da kowane yarjejeniya da ba HTTP ba, ba za su bi wannan hanyar ba.

Zaɓin ya dogara da abin da aikace-aikacenka suke magana da gaske da nawa ainihi kake buƙata a cikin rikodin. Inda suke magana da HTTP, proxy ɗin yana samun wurinsa; inda kake buƙatar fitarwa gama-gari ga kowane yarjejeniya, tsarin transit gateway shine wanda AWS ke goyi bayan. Yanke shawarar hakan tun farko ya fi arha fiye da gano shi bayan an gina teburin hanyoyi.