Adiresoshin IP guda biyu na jama'a akan VM ɗaya na VPN Azure: wanne ke yin me

Adiresoshin IP guda biyu na jama'a akan VM ɗaya na VPN Azure suna haifar da tsammanin da ba kasafai yake tabbata ba: adireshin da abokan ciniki ke haɗawa da shi zai kasance adireshin da shafukan yanar gizo ke gani. Hukunce-hukunce uku masu zaman kansu ne ke haifar da wannan sakamakon, kuma na farko ne kaɗai ya shafi mai sauraron ramin. Na biyu shi ne tushen baƙo da ake amfani da shi don zirga-zirgar abokin ciniki da aka tura, na uku kuma hanyar fita ta Azure da ta shafi wannan tushen. Canza ɗaya, sauran biyun kuma suna zama inda suke, don haka ku yanke shawara kan kowanne a bayyane.

Shawara 1: inda ramin ke ƙarewa

Ana danganta IP na jama'a na Azure da tsarin IP na sirri a kan NIC; ba adireshi ba ne da kuke ƙarawa cikin tsarin aiki na baƙo. Ku karanta taswirar maimakon ɗauka: az network nic show --ids /subscriptions/.../networkInterfaces/vpn-nic --query 'ipConfigurations[].{private:privateIPAddress,public:publicIPAddress.id}'. Duk wane adireshi na sirri wannan tambayar ta dawo da shi, shi ne wanda baƙo dole ya riƙe a zahiri.

NIC ɗaya na iya ɗaukar tsare-tsaren IP da yawa, don haka adiresoshin jama'a biyu ba sa buƙatar NIC biyu. Idan tsarin ya yi amfani da NIC biyu, kowanne yana kawo hanyoyinsa na baƙo da tsalle-tsalle na gaba, kuma kun ƙara shawarar tafiyar da hanya maimakon sauƙaƙa ta.

Don sabis mai bayyanannen ɗauri na gida, ku ɗaure zuwa ainihin adireshin sirri na baƙo, kada ku taɓa ɗaure zuwa maƙasudin jama'a. Mai sauraro da ke karɓar duk adiresoshin yana karɓar zirga-zirga ta kowane tsarin IP da ya isa gare shi, don haka ku iyakance shigarwa da ƙungiyar tsaron cibiyar sadarwa da katangar wuta ta mai masaukai maimakon fatan tsarin ɗaurin zai yanke hukunci.

Shawara 2: wane tushe abokin ciniki da aka tura ke amfani da shi

Bayan ƙofar ta warware buƙatar abokin ciniki, fakitin da take turawa ya bambanta da wanda ya isa mai sauraron VPN. Baƙo yana buƙatar tura a kunna, manufar katangar wuta da ke ba da izinin kwarara, da adireshin tushe da tsarin girgijen ya yarda. Idan kun fassara adireshin ciki na abokin ciniki, wannan fassarar tushen ce Azure zai tantance, ba adireshin ciki na abokin ciniki ba.

Ƙaramin ƙa'idar SNAT na iya zaɓar tushen sirri na baƙo, amma ba za ta iya rinjaye fassarar Azure ta gaba ba. Ku zaɓi SNAT lokacin da kuke buƙatar lissafin kowane abokin ciniki cikin VM; ku tsallake shi lokacin da tsarin fita na subnet ya riga ya ba da tabbataccen tushe na jama'a kuma fassara ta biyu za ta ƙara yanayi kawai.

Shawara 3: wace hanyar fita ta Azure ce ke cin nasara

Microsoft yana rubutatsarin fifikon fita: hanyar da ta dace zuwa na'ura ko ƙofa tana da fifiko, kuma haɗin subnet NAT Gateway yana da fifiko bisa IP na jama'a na matakin misali a kan hanyar da ta dace. Wannan tsari shi ne dalilin da yasa fassara zuwa 10.20.0.5 ba ta tabbatar da cewa shafi zai ga 198.51.100.20 ba. Ku karanta teburin hanyoyi mai aiki, haɗin NAT Gateway da IP na jama'a na NIC tare kafin ku karɓi tsarin fita.

Ku riƙesaitin turawa na NIC na Azuredabam da turawa a Linux. Tutar girgijen tana ba da izinin fakiti waɗanda ba a sanya tushensu ko inda suka nufa ga NIC ba; ba ta kunna net.ipv4.ip_forward ba, kuma saitin baƙo ba ya ba da izinin girgijen.

Soket ɗin ramin yana da nasa shawarar tushe

Address na WireGuard ƙarƙashin wg-quick yana sanya adireshi ga muƙashin WireGuard; ba umarnin ɗaurin UDP na waje ba ne. Tushen soket ɗin da aka ɓoye yana bin teburin hanyoyi, don haka hanyar manufa ko tsohuwar hanyar da aka saba na iya motsa shi ba tare da taɓa adireshin muƙashin ba.OpenVPN: zaɓin local da UDP multihome suna yin haka: sun shafi mai sauraro da amsoshinsa, ba tushen intanet na kowane abokin ciniki da aka tura ba.

Ku kiyaye hanyar ƙasan da ke ɗaukar ramin, kuma ku tabbatar abokin ciniki har yanzu yana samun amsoshi da aka tabbatar daga tsarin shigarwa da ake tsammani. Kada ku dogara ga tsarin jerin adireshi a matsayin manufar zaɓen tushe ta dindindin, domin adireshin gaba da za a ƙara wa NIC zai iya canza wanda zai yi nasara.

Abin da za a karɓa, kuma a wace oda

Ku karɓi sakamako uku daban. Na farko, abokin ciniki na waje ya isa shigarwar VPN da aka nufa. Na biyu, sabuwar buƙata da aka yarda daga wannan abokin ciniki na VPN ta fito ta hanyar fitar intanet da aka rubuta. Na uku, hanyoyin sauraro da turawa da ba a nufa ba sun kasance an hana su. Ku rubuta taswirar jama'a-zuwa-sirri da masu kula da baƙo da girgijen na kowace shawara a wuri ɗaya.

Ramin da ya yi nasara yana tabbatar da sashi na farko kawai. Ku gwada fitar da sabon kwarara, domin haɗin da aka adana zai iya ci gaba da amfani da tsohon tushe da daɗewa bayan an canza hanyar.