Me ya sa AWS Client VPN ke watsar da zirga-zirga ba tare da hanyar da ta dace ba

Client VPN yana ba abokin ciniki adireshi, musafaha ya kammala, amma haɗin bai isa ko'ina ba. Kafin ka taɓa takardun shaida ko sigogin abokin ciniki, duba teburin hanyoyin ƙarshen da kansa. Ƙarshen AWS Client VPN yana tura fakiti ne kawai idan ɗaya daga cikin hanyoyinsa ya rufe prefix ɗin manufa; idan babu abin da ya dace, an watsar da fakitin a ƙarshen kuma mai karɓar manufa ba ya ganin SYN.

Wannan shawara ce ta turawa, ba ta tabbatarwa ba. Yana faruwa bayan ramin ya tashi kuma bayan an kimanta ka'idojin izini, shi ya sa takardar shaida mai inganci da rukuni mai inganci na iya haifar da mataccen haɗi.

Ƙarshen yana tura abin da teburin hanyoyinsa ya rufe kawai

Kowace hanya ita ce CIDR na manufa da subnet ɗin da ya kamata ya karɓi zirga-zirgar. Ƙarshen yana kwatanta manufar abokin ciniki da wannan jerin, ya zaɓi shigarwar da ta dace kuma ya aika fakitin zuwa subnet ɗin da ke da alaƙa. Babu shigarwa yana nufin babu tsalle na gaba.

Lura abin da hanyar ba ta kasance ba. Ba shigarwa ba ce a teburin hanyoyin VPC, kuma ba ta ba da izini ga komai. Ka'idojin izini suna yanke hukunci ko rukuni zai iya isa manufa; hanyoyi suna yanke hukunci ko ƙarshen yana da inda zai aika fakitin. Dukansu dole su dace, kuma suna kasawa da alamomi daban-daban, don haka yin hasashe wanene ya lalace yana ɓata rana.

Rashin daidaituwar gargajiya ita ce VPC mai peer. Wani yana ƙara hanya don 10.20.0.0/24 yayin da mai karɓar yake zaune a 10.20.4.0/24, don haka adireshin ya faɗi wajen kowace shigarwa. Kama a gefen abokin ciniki yana nuna maimaita SYN ba tare da amsa ba, kuma log ɗin manufa ba sa nuna komai.

Karanta jerin hanyoyi kafin takardar shaida

Hanyoyin ƙarshen abu ne na daban, don haka tambaye su kai tsaye maimakon karanta teburin VPC:

aws ec2 describe-client-vpn-routes --client-vpn-endpoint-id cvpn-endpoint-0123456789abcdef0 --query 'Routes[].{Dest:DestinationCidr,Target:TargetSubnet,Origin:Origin}'

Ɗauki ainihin adireshi da tsawon prefix daga abokin ciniki da ke kasawa, sannan duba ɗaukar hoto harafi da harafi. Ana amfani da daidaiton prefix mafi tsayi, don haka hanya mafi faɗi ba za ta cece ka ba idan mafi ƙunci tana nuni zuwa wani wuri dabam.

Albarkatu ɗaya ga kowace manufa da for_each

Rubutattun sassan hanyoyi da hannu suna motsi a lokacin da wani ya ƙara prefix a cikin console. Ka riƙe manufofin a cikin taswira kuma ka ƙirƙiri albarkatu ɗaya ga kowace maɓalli, domin kowace ƙari ko cirewa ta kasance keɓe.

variable "client_vpn_routes" {
  type = map(string)
  default = {
    "10.20.0.0/16"  = "subnet-0aa11bb22cc33dd44"
    "172.31.0.0/20" = "subnet-0aa11bb22cc33dd44"
  }
}

resource "aws_ec2_client_vpn_route" "this" {
  for_each               = var.client_vpn_routes
  client_vpn_endpoint_id = var.client_vpn_endpoint_id
  destination_cidr_block = each.key
  target_vpc_subnet_id   = each.value
  depends_on             = [aws_ec2_client_vpn_network_association.this]
}

Ka riƙe dogaro da haɗin cibiyar sadarwa. Hanya tana buƙatar subnet mai alaƙa, don haka apply da ke ƙirƙirar duka biyu dole ya tsara haɗin farko, kuma ba tare da wannan magana ba Terraform na da 'yanci ya gwada hanyar farko. Sannan karanta shirin: adadin ƙarin hanyoyi ya kamata ya dace da prefixes ɗin da ka ƙara. Idan shirin kuma ya maye gurbin ƙarshen, an rubuta albarkatun ƙarshen ba daidai ba, kuma amfani da shi yana cire kowane abokin ciniki da ke haɗe.

Karɓar ƙarshen da ba ka ƙirƙira ba

Yawancin ƙungiyoyi suna gado ƙarshen da aka gina a cikin console, shi ya sa babu lambar hanyoyi. Kada ka kafa ƙarshen na biyu don kawai shigar da hanyoyi cikin Terraform.

A maimakon haka shigo da su, ko ka wuce ids a matsayin masu canji kuma ka bar abubuwan da aka gado ba tare da kulawa ba. Shigo da su yana buƙatar tsarin ganowa da mai bayarwa ya rubuta don kowane nau'in albarkatu; yana ɓoye ƙarshen, prefix ɗin manufa da subnet ɗin da aka yi niyya. Kwafi wannan igiyar daga takardun albarkatun maimakon haɗa ta daga ƙwaƙwalwa, gudanar da shiri, kuma ka yi tsammanin babu canje-canje kafin ka ƙara wani sabon abu.

Bi fakitin a cikin tsarin da yake tafiya

Lokacin da hanyar ta wanzu kuma haɗin har yanzu yana kasawa, bi hanyar a tsari maimakon yin hasashe a saman Layer.

1. Hanya: prefix yana rufe manufa kuma yana nuni zuwa subnet mai alaƙa da ƙarshen.
2. Izini: ka'idar izini ta yarda da wannan manufar ga rukunin mai amfani. Hanya ita kaɗai ba ta taɓa ba da dama ba.
3. Hanyar dawowa: teburin hanyoyin subnet ɗin manufa yana tura amsoshi zuwa ga ƙarshen, kuma rukunin tsaro yana yarda da tashar daga tafkin adireshin abokin ciniki.
4. Aikace-aikace: buɗe ainihin haɗin TCP daga abokin ciniki, sannan tabbatar da log ɗin manufa suna nuna adireshin tushen da ake tsammani daga tafkin.

Canza prefix ɗaya kowane apply, sake karanta jerin hanyoyi bayan haka, kuma rubuta manufa, ka'idar izini da hanyar dawowa tare. Mutum na gaba da zai gyara haɗin da aka ƙi ya kamata ya fara daga wannan jerin, ba daga ka'idar takardar shaida ba.