VPN zuwa VPC yana aiki, amma sabis ɗin da ake sarrafawa yana ƙarewa cikin lokaci
Ramin yana ƙarewa a gefenka, ba a ƙofar gaban mai bayarwa ba. Rarraba manufar a matsayin wadda aka shirya a VM, haɗe da VPC ko ta jama'a kawai kafin ka canza hanya.
Samun damar wani rumbun adana bayanai da ake sarrafawa ta hanyar VPN yakan kasa saboda wani dalili da babu wanda ya rubuta a cikin littafin jagora: ramin yana ƙarewa a gefen cibiyar sadarwarka, alhali sabis ɗin bai taɓa kasancewa a gefenka ba. Teburin hanyoyi yana da kyau, ramin yana bayar da rahoton cewa yana aiki, amma haɗin yana ƙarewa cikin lokaci duk da haka. Bi gwaje-gwajen huɗu da ke ƙasa a jere ka tsaya a na farko da yanayin nasa na wucewa bai cika ba, domin kowane gwaji na baya yana ɗaukan cewa na gaba sun wuce.
Gwaji na ɗaya: a ina ƙarshen wurin yake da gaske?
Ƙofar VPN tana haɗa cibiyoyin sadarwa biyu waɗanda kake sarrafa adireshinsu. Sabis ɗin da ake sarrafawa ana gudanar da shi a bayan ƙofar gaban mai bayarwa da kansa, kuma wannan ƙofar tana ɗaukar ɗaya daga cikin sifofi uku dangane da samfurin. Idan ba ka san wace siffa kake mu'amala da ita ba, babu aikin hanya da zai taimaka, domin gazawar wataƙila ba gazawar hanya ba ce kwata-kwata.
| Shape | What it means | Pass condition |
|---|---|---|
| Software on your VM | Ordinary subnet addressing | Route and security group permit the client |
| Attached to your VPC | Private, but only inside that VPC | Endpoint associated, source allowed, route present |
| Provider-hosted, public endpoint | Optional private link, not private by default | A private endpoint exists and DNS points at it |
Yawancin la'asar da ake ɓatawa suna zuwa ne daga tsallake wannan rarrabuwa da kai tsaye zuwa teburin hanyoyi. Sabis ɗin da aka shirya a wurin mai bayarwa mai ƙarshen wuri na jama'a ba ya bayan raminka ko me zanen ya ce, kuma wanda aka haɗa da VPC ba zai taɓa bayyana a amsar DNS ta jama'a ba.
Gwaji na biyu: sabis ɗin da aka haɗa da VPC kamar ElastiCache
Irin wannan ajiya ana adireshi a cikin VPC ɗinka, kuma ba shi da wani mai sauraro da ke fuskantar intanet kwata-kwata. VPN na abokin ciniki da ya ƙare a cikin wannan VPC na iya isa gare su, amma sai idan sharuɗɗa uku sun haɗu. Ƙarshen wurin ajiyar dole ya kasance yana da alaƙa da ƙananan cibiyoyin sadarwa da raminka zai iya gani, ƙungiyar tsaronta dole ta ba da izinin adireshin da abokan cinikinka suke zuwa daga gare shi, kuma gefen abokin ciniki yana buƙatar hanyar da ta rufe ƙananan cibiyoyin ajiyar.
Kuskuren da aka saba shine a ɗauka cewa haɗi a wani wuri kusa yana ƙidaya. Haɗa VPN da wani VPC, ko dogaro da peering kawai, ba ya faɗaɗa ƙungiyar tsaron ajiyar ko teburin hanyoyin ƙaramin cibiyarta zuwa abokan cinikinka. Lokacin da ramin da ke akwai ya ƙare a wani wuri, mai masaukin tsalle ko sabar VPN da aka ajiye a cikin wannan VPC shine maganin da aka saba. Wannan magani hanya ce ta zagayawa ba ƙira ba, kuma ya kamata a yi masa alama haka a cikin littafin jagora.
Gwaji na uku: ƙarshen wurin PaaS mai sunan jama'a
Azure Database for PostgreSQL yana gabatar da sunan uwar garke na jama'a. Ba ya ba ka adireshi mai sirri da za ka iya liƙawa a fayil ɗin hosts ka bi ta wata ƙofa. Ƙarshen wuraren sabis na cibiyar sadarwa ta kama-da-wane suna iyakance waɗanne ƙananan cibiyoyi za su iya isa wata hanya; ba sa ba da izini ga abokin ciniki na gida wanda ke zuwa ta VPN.
Samun dama mai sirri yana nufin shigar da ƙarshen wuri mai sirri ko tsarin haɗin sirri, sannan a ƙara yankin DNS mai sirri domin sunan jama'a ya amsa da wannan ƙarshen wuri maimakon intanet. VPN da aka haɗa da ka'idar ƙarshen wurin sabis wata gine-gine ce daban wadda kawai ta yi kama a zane. App Service yana bin wannan tunani daga wata hanya: haɗin VNet yana barin manhajar yin kira mai fita zuwa cikin VNet, kuma ba ya ƙirƙirar hanyar sirri mai shiga daga raminka. Don haka dama mai sirri mai shiga tana buƙatar ƙarshen wuri mai sirri, yanayin App Service ko ƙofa a gaban manhajar, kuma wanne daga cikinsu za ka iya amfani da shi ya dogara da shirin.
Gwaji na huɗu: samfuran da suke da ƙofar gabansu
Ba za a iya haɗa Firebase Hosting da Cloud VPN ba, domin matakin shiryawa gaban gaba ne na duniya ba wani abu a cikin VPC na aiki ba. Madadin da aka rubuta shi ne ka gina wurin shiga da aka sarrafa da kanka, da misalin wakili ko mai daidaita nauyi da aka tallafa da kwano. Ko ta yaya, shafin ya daina zama samfurin shiryawa tsantsa kuma ya zama kayan aiki da kake gudanarwa yanzu. Wannan musanya ya cancanci a ambata kafin wani ya yi alkawarin cewa ramin zai rufe shi.
Private API Gateway yana tsaye kusa da gefen ayyukan VPC: ƙarshen wurin VPC na interface yana buga sunan mai masauki wanda amsoshinsa adireshi ne masu sirri, kuma zirga-zirga daga harabar ka tana zuwa ta ramin ko ta haɗin kai na musamman. Ƙarshen wurin dole ya kasance yana da alaƙa da API ɗin, kuma takardar shaidar tare da sunan mai masauki dole su dace da yankin da aka keɓance da masu kira suke amfani da shi.
Ramin Google Cloud VPN suna ɗaure da adireshin IP na abokan tarayya, ba da sunaye ba. Ana saita tura DNS daban, wanda shine dalilin da yasa rami zai iya kasancewa cikakke cikin lafiya yayin da bincike a yankin sirri mai nisa har yanzu yana kasa.
Sannan gano iyaka
Gudanar da wannan haɗin daga VM a cikin VPC. Idan ya yi nasara a can kuma ya kasa daga abokin cinikin VPN, gibin yana tsakanin hanyar abokin ciniki da ƙarshen wurin sabis: hanya, ƙungiyar tsaro, manufar ƙarshen wuri ko suna. Idan duka ƙoƙarin biyu suka kasa, babu abin da ke cikin wannan cibiyar da zai isa sabis ɗin, kuma VPN bai taɓa zama cikas ba.
getent hosts db.internal.example
nc -vz db.internal.example 5432Yi binciken suna da gwajin tashar daban, domin suna kasawa saboda dalilai daban-daban kuma ma'auratan suna gaya maka wane rabin hanya ya karye. Sunan da ke warwarewa zuwa adireshin jama'a yana gaya maka cewa yankin DNS mai sirri ba ya aiki.