Wace IP ta asali ce NAT gateway na AWS ke amfani da ita zuwa VPN?

Kuna buɗe VPC console saboda abokin tarayya ya tambaya wace kewayon tushe za ta zo ta VPN na site-to-site. Shafin NAT gateways yana nuna gateway na jama'a da ke da Elastic IP a haɗe, kuma jarabar ita ce a aika wannan adireshin sannan a ci gaba. Ita ce amsar da ta dace don hanyar intanet kuma amsar da ba ta dace ba don hanyar VPN, kuma bambancin shi ne wace gateway teburin hanya ke nunawa. Bi hanyar kafin ka rubuta jerin da aka yarda da su.

Fara daga shafin NAT gateways, ba daga jerin da aka yarda ba

Shafin NAT gateways yana gaya maka subnet, nau'i da Elastic IP, kuma waɗannan filaye uku sun isa don farawa. Abin da ba ya gaya maka shi ne hanyar da zirga-zirgar ke biyo baya. Wannan yana fitowa daga teburin hanyoyi da ke haɗe da subnet na NAT gateway.

Fara karanta nau'in, domin na jama'a ko na sirri shi ke ƙayyade ko gateway na intanet zai bayyana daga baya a sarkar. Sannan ka karanta subnet, domin a nan ne hanya ta biyu take.

Bi fassarar biyu

Duk NAT gateways na jama'a da na sirri suna fassara tushen IPv4 na sirri na aikin zuwa adireshin IPv4 na sirri na NAT gateway kanta. Wannan fassarar ta farko tana faruwa ba tare da la'akari da nau'i ba. Fassarar ta biyu ita ce da mutane suke mantawa da ita: NAT gateway na jama'a tana ba da zirga-zirga ga gateway na intanet, wadda ke daidaita adireshin zuwa Elastic IP da ke haɗe.

workload 10.20.1.5 -> NAT gateway 10.20.2.10 -> internet gateway -> Elastic IP 203.0.113.25
workload 10.20.1.5 -> NAT gateway 10.20.2.10 -> transit or virtual private gateway -> partner sees 10.20.2.10

A hanyar sirri babu gateway na intanet a sarkar. Lokacin da zirga-zirga ta fita ta transit gateway ko gateway na sirri na kama-da-wane, jagorar NAT gateways tana rubuta adireshin sirri na NAT gateway a matsayin tushen da gefen nesa ke karɓa. Wannan shi ne adireshin da abokin tarayya ya kamata ya yarda da shi, ba Elastic IP ba.

Hanyar VPN yawanci tana nuna adireshin sirri

Don aiki a cikin 10.20.1.0/24 wanda ya isa prefik na abokin tarayya, teburin hanya na subnet na aikin yana nuna zuwa NAT gateway, kuma teburin hanya na subnet na NAT gateway yana nuna zuwa hanyar gateway na sirri. Duk tsalle-tsallen biyu suna da muhimmanci, kuma na biyu kaɗai ke ƙayyade abin da abokin tarayya ke gani. Idan subnet na NAT ba shi da wata hanya zuwa hanyar VPN, fakitin ba zai taɓa isowa ba, kuma wannan gazawa ce daban da adireshin tushe mara kyau.

Tabbatar da wannan hanya ta biyu kafin ka yi magana kan adireshi kwata-kwata. Hanya da ba ta nan da tushen da aka bayar da rahoto ba daidai ba suna kama da juna ga abokin tarayya wanda kawai ba ya ganin zirga-zirga.

Lokacin da fassara ta biyu ta canza amsar

AWS kuma tana ba da bayyanannen daidaitaccen taswirar NAT ɗaya-zuwa-ɗaya a kan haɗin transit gateway. Wannan taswirar na iya sake fassara tushen kafin sabis ɗin nesa ya gan shi, kuma ba dabi'ar tsoho ba ce da ke yin hanya kawai. Domin dole ne a daidaita shi da gangan, ɗauke shi a matsayin keɓancewar ƙira ba wani abu da ka gado bisa kuskure ba. Idan babu wanda a ƙungiyarka ya tuna ya kunna shi, ɗauka ba ya nan har sai ka karanta haɗin.

Idan ƙirarka na amfani da shi, jerin da aka yarda dole ya bayyana taswirar ƙarshe ba adireshin NAT gateway ba. Irin wannan taka tsantsan ya shafi hanyoyin samuwa: idan adireshin gateway da yawa suna da hannu, saitin tushen da ake tsammani shi ne haɗuwa, ba adireshi ɗaya mai wakilci ba. Rubuta wace fassara kowane adireshi yake ciki, domin jerin da ba shi da asali ba za a iya bincika shi daga baya ba.

Ba za a iya ba NAT gateway na sirri sabis na intanet ta hanyar nuna shi ga gateway na intanet ba; AWS ta rubuta cewa irin wannan zirga-zirga ana watsi da ita. Zaɓi nau'in daga cikakkiyar hanya, ba daga kalmar VPN a cikin buƙatar ba.

Rubuta yarjejeniyar da abokin tarayyarka zai iya aiki da ita

Yarjejeniyar da za a iya amfani da ita tana da sassa huɗu: alkiblar da ake fara kwarara daga gare ta, fassararriyar shaidar da abokin tarayya zai gani, hanyar dawowa ga wannan shaidar, da iyakar kariya da ta shafi. Ana fara kwararar NAT gateway daga gefen tushen da ake tallafawa, don haka wannan ba sabis ɗin tura tashar jiragen ruwa mai shigowa ba ne don fallasa aikin sirri. Faɗin hakan da ƙarfi da wuri yana hana bitar ƙira inda kowane gefe ya ɗauka cewa ɗayan ne ya fara.

Fassara tana kawo sauƙi daga rikicewar adireshi da manufar tushe mai iya hasashe, kuma tana ɗauke maka shaidar aikin ɗaiɗai a cikin rajistan abokin tarayya. Idan bincike na buƙatar jingina ga kowane aiki, riƙe wannan shaidar a matakin aikace-aikace maimakon ƙoƙarin dawo da ita daga fassararren adireshin tushe.

Sannan sake duba duk teburin hanya biyu bayan kowane canji, domin sabon haɗi ko subnet da aka sake haɗawa yana sake rubuta amsar a shiru.