OpenVPN akan GCE: ƙara alias IP kafin push routes

Push ɗin route ba ya mai da VM next hop. Ƙara kewayon alias IP, daidaita shi da pool ɗin uwar garke kuma ƙirƙiri hanyar dawowa a cikin VPC kafin gwada abokan ciniki.

Abokin ciniki ya buga uwar garken OpenVPN a kan VM na Compute Engine, taga yanayi ta ce an haɗa, kuma ping zuwa mai masauki a cikin VPC har yanzu bai isa ko'ina ba. Ilhami ita ce ƙara wani layin push, kuma wannan ba ya gyara shi har abada. Compute Engine yana yanke shawara inda fakiti za su je bisa ga teburin sa na route da adiresoshin da interface ɗin VM ke riƙe da gaske, don haka pool ɗin tunnel da VM ba ya mallaka shi ne pool da babu wanda ke isar da shi.

Bi ka bin fakitin da ke gazawa maimakon fayil ɗin saitin, kuma sassan da suka ɓace za su bayyana bisa tsari.

Fara daga fakitin da ke mutuwa

SYN yana barin abokin ciniki, ya shiga tunnel kuma ya isa VM a matsayin fakiti da aka lulluɓe zuwa wata manufa a cikin VPC. OpenVPN yana buɗe shi kuma yana ƙoƙarin turawa ta eth0, inda fabric ke yin tambaya ɗaya kafin komai: shin wannan instance yana mallakar adireshin manufar. Pool ɗin tunnel da aka yanke daga subnet ɗin wani ya kasa wannan tambayar, kuma ana jefar da fakitin kafin a duba kowace route ko ƙa'idar firewall.

Don haka alkiblar daga abokin ciniki zuwa VPC tana da buƙatu biyu daban-daban, kuma ɗayansu ba umarnin push ba ne. VM yana buƙatar kewayon alias wanda ke rufe pool ɗin tunnel, kuma wannan ne ya sa ya zama halaltaccen mai adiresoshin. VPC yana buƙatar hanyar da ke ambaci VM a matsayin next hop ga kowane prefix da aka kare. Idan ɗaya ya ɓace fakitin yana mutuwa a wani wuri, yayin da abokin ciniki ke ganin wannan shiru.

Karanta gazawar a wannan tsari, domin daga ɓangaren abokin ciniki sharuɗɗan biyu suna kama da juna. Tunnel ɗin da ke bayar da rahoton an haɗa yayin da babu abin da ke amsa alama ce ta matsalar topology, ba ta cipher mara kyau ba.

Shin instance yana mallakar pool ɗin tunnel

Ba VM kewayon na biyu a cikin subnet ɗin sa, sannan ka sa OpenVPN ya raba adiresoshi daga wannan kewayon daidai. A kan instance ɗin da babban adireshinsa 10.156.0.10/20 ne, alias ɗin /28 yana raba pool ɗin da adiresoshin da wasu instance ɗin suka riga suka mallaka:

gcloud compute instances network-interfaces update openvpn-vm \
  --zone=europe-west1-b \
  --aliases=eth0:10.156.1.0/28

Sa'an nan umarnin server dole ya bayyana wannan block ɗin. Adireshinsa na farko ya zama gateway ɗin tunnel, sauran adiresoshin kuma ana raba su ga abokan ciniki. A nan lambobi biyu suna bayyana block ɗaya, cibiyar sadarwa da netmask, kuma wannan ita ce ƙa'idar pool da OpenVPN har yanzu yake tsammani.

server 10.156.1.0 255.255.255.240

Tabbatar cewa adireshin ya sauka a kan interface da gaske ba kawai a cikin saitin OpenVPN ba. Fabric yana wucewa abin da NIC ke bayarwa, ba abin da daemon ya yi imani ba. Umarni ɗaya yana warware shi:

ip -4 addr show dev eth0

Adireshin na biyu da ba ya taɓa isa eth0, ko pool ɗin da ya yi karo da wani subnet, yana bayyana daga baya a matsayin asarar lokaci-lokaci ba a matsayin kuskuren farawa ba. Daemon yana farawa, abokan ciniki suna haɗawa, kuma wasu manufofin ne kawai ke yin kuskure. Ka riƙe kewayon alias ɗin kaɗan domin a sauƙaƙe gane pool ɗin a teburin route. Kada ka taɓa yanke shi daga subnet da wani instance ke amfani da shi.

Ba trafik ɗin dawowa next hop

Amsa daga mai masauki a cikin VPC ana aika ta zuwa adireshin abokin ciniki a cikin pool ɗin tunnel, wanda ba ya cikin kowane subnet da VPC ya sani. Idan babu route don wannan pool, amsar tana tsayawa a hop ɗin farko da ba shi da daidaito, kuma mai yiwuwa buƙatar ta yi nasara a wancan gefen.

gcloud compute routes create openvpn-return \
  --network=prod-vpc \
  --destination-range=192.168.127.0/24 \
  --next-hop-instance=openvpn-vm \
  --next-hop-instance-zone=europe-west1-b \
  --priority=800

Wannan route ɗin ana buƙatarsa ga kowane prefix da ke bayan abokin ciniki maimakon cikin VPC. Waɗannan prefix ɗin suna buƙatar kuma shigarwar iroute a cikin fayil ɗin ccd na wannan abokin ciniki. Wannan shigarwar lissafi ne a ɓangaren uwar garke: tana gaya wa uwar garken wane abokin ciniki ne ya mallaki prefix ɗin, kuma ba ta shigar da komai a kan abokin ciniki kansa ba.

Ka riƙe jerin push don ɓangaren abokin ciniki na tattaunawar, domin yana ƙara routes ne kawai a kan na'urar da ke haɗawa. Layin push don subnet ɗin VPC da route ɗin VPC zuwa pool ɗin rabi biyu ne na hanya ɗaya, kuma kowane rabi shi kaɗai yana samar da tunnel da ke ɗaukar buƙatu amma ba amsoshi.

Firewall, turawa da hops ɗin da ke tsakani

Firewall ɗin VPC yana kimanta fakitin da aka buɗe, don haka ƙa'idar ingress dole ta yarda da pool ɗin tunnel da kowane prefix ɗin shafi da ke isa VM ta wannan hanyar. Matsayin default-deny yana gazawa a shiru a nan: ana jefar da fakitin bayan an buɗe shi, kuma log ɗin OpenVPN yana nuna zama mai lafiya.

A kowane mai masaukin Linux da ke turawa maimakon ƙarewa, duba ko net.ipv4.ip_forward yana kunne. Ƙa'idar mallaka tana aiki a can kuma: na'urar da ke turawa don subnet ɗin da ba ta mallaka tana jefar da fakitin kamar yadda VM zai yi. Karanta darajar kafin ka zargi tunnel ɗin.

Lokacin da prefix ɗaya daidai ya gaza

Gazawar wani ɓangare ita ce shari'ar da aka fi sauƙin karantawa, domin duk sauran abin da ke kan hanya an riga an tabbatar da shi. Fara da jerin route kuma karanta kewayon manufa da next hop na shigarwar da ya kamata ta rufe prefix ɗin, sannan karanta bayanin instance ɗin kuma kwatanta kewayon alias ɗinsa da pool ɗin da uwar garken ke rabawa.

gcloud compute routes list --filter=destination-range~10.164.0.0
 gcloud compute instances describe openvpn-vm --format=get(networkInterfaces[0].aliasIpRanges)

Route ɗin da ya ɓace yana bayyana a matsayin babu next hop ga prefix ɗin, yayin da alias ɗin da ya ɓace yana bayyana a matsayin fakitin da aka jefa a interface; daga abokin ciniki biyun suna kama da juna kuma a waɗannan fitarwa biyu sun bambanta sarai. Idan duka biyu suna nan, wanda ake zargi da ya rage shi ne iroute ɗin ccd na abokin cinikin da ke da'awar prefix ɗin.

Rubuta darajoji huɗu a gefen tunnel ɗin: kewayon alias, pool ɗin uwar garke, prefix ɗin da aka push, route ɗin VPC. Tsohon alias yana lalata kowane adireshin pool, tsohon route yana lalata alkibla ɗaya, push ɗin da ya ɓace yana ɓoye prefix ɗin daga abokin ciniki, kuma kuskuren iroute yana aika prefix ɗin zuwa ga peer ɗin da bai dace ba. Mutumin da zai ƙara subnet na gaba yana buƙatar duka huɗun a wuri ɗaya, kuma wannan rubutun ya fi maraice arha.

Labarai masu alaƙa