Me ya sa EC2 ba ya iya isa kwamfutar tafi-da-gida ta AWS Client VPN
Client VPN yana fassara tushen IPv4 na abokin ciniki zuwa intercefin ƙarshen hanya. Shi ya sa amsa ke aiki, sabon haɗi daga EC2 kuma ba ya aiki.
Kwamfutar tafi-da-gida da aka haɗa ta AWS Client VPN tana isa ga manhajar EC2 ba tare da matsala ba. Sa'an nan ka gwada akasin haka, daga EC2 zuwa adireshin da aka ba abokin ciniki, kuma haɗin yana ratsewa ko an ƙi shi. Wannan rashin daidaito ba safai yake faruwa saboda ƙa'idar ƙungiyar tsaro da ta ɓace ba. A kan ƙarshen hanyar Client VPN da ke da alaƙa da rassan yanar gizo na VPC, AWS yana fassara tushen IPv4 na abokin ciniki zuwa intercefin cibiyar sadarwa na ƙarshen hanyar, don haka babu wani adireshin VPC mai shigowa da ke wakiltar kwamfutar tafi-da-gidanka.
Fara da abin da rikodin ya nuna
Yi rikodin a kan uwar garken EC2 yayin da abokin ciniki ke haɗawa, ka karanta adireshin tushe da manhajar ke gani a zahiri. Idan intercefin ƙarshen hanyar ne a gefen VPC ba adireshi daga tafkin abokan ciniki ba, an tabbatar da fassarar kafin ka canza ko ɗaya ƙa'ida.
Tafkin abokan ciniki yanki ne na rabo, ba rassan yanar gizo mai hanyar dawowa ba. Wannan bambanci ne inda yawancin waɗannan binciken ke kuskure.
Fassarar da ke bayyana rashin daidaiton
Ana rikita kwarara uku da juna, kuma ɗaya kaɗai ne wanda mutane suke gwadawa.
| Flow | Started by | What the VPC sees | Outcome |
|---|---|---|---|
| Client to EC2 service | The client | A translated source at the endpoint interface | Works, with a stateful reply |
| EC2 host to client pool address | The EC2 host | A destination with no route and no translation state | No usable path |
| Client to client | A client, when the feature is configured | Traffic mediated by the endpoint | Works only with that feature and its authorisation |
Bayanin sassan Client VPN ya bayyana sarai cewa ana fassara tushen IPv4 na abokin ciniki zuwa intercefin ƙarshen hanyar, wanda ya isa a ga me ya sa layin tsakiya ba shi da abin da zai daidaita.
Sabon haɗi yana buƙatar hanya, matakin warware adireshi da shawarar izini. Yanayin fassara daga zaman wani ba ya samar da ko ɗaya daga cikin ukun.
Me ya sa amsa ba sabon haɗi ba ce
Ana daidaita amsar TCP da wani bayanin da ke akwai, shi ya sa hanyar dawowa ke aiki ba tare da kowace ƙa'idar shigowa ba. Sabon SYN daga uwar garken EC2 ba shi da bayanin da zai daidaita, don haka ya zama ƙoƙarin fita na yau da kullum zuwa wurin da VPC bai san yadda za a isa ba.
Shi ya sa kuma kwatanta wannan a matsayin zirga-zirgar da ke tafiya gefe ɗaya kawai yake ɓatarwa. Zirga-zirgar dawowa tana gudana a kai a kai a cikin waɗannan zaman. Sashen da ba shi da hanya shi ne farawa.
Me har yanzu ke lalata zaman da ya kamata ya yi aiki
Ƙungiyoyin tsaro, ACL na cibiyar sadarwa da na'urar hana wuta ta kwamfutar da kanta duk suna da muhimmanci ga haɗin da ya kamata su yi nasara. Ping da ya gaza shi ne ya fi ƙarancin bayani, domin manufar ICMP sau da yawa ta bambanta da manufar TCP da kake damuwa da ita.
Rubuta waɗannan ƙa'idojin dangane da tushen da aka fassara, ba adireshin abokin ciniki ba. Ƙa'idojin da suka dogara da adireshin da ba ya taɓa bayyana a cibiyar sadarwa su ne mafi yawan gazawar da mutum ya jawo wa kansa a wannan ƙira.
Lokacin da VPC da gaske ya kamata ya fara tattaunawa
Idan sabis ya kamata ya sanar da tashar aiki, juya alkibla ka bar abokin ciniki ya riƙe tashar fita mai dorewa wadda sabis ɗin ke amsawa a kanta. Idan dukan cibiyar sadarwa mai nisa ya kamata a iya isa gare ta daga VPC, zaɓi gine-ginen da ke wallafa prefix ɗinsa da manufar shiga maimakon ɗauka cewa Client VPN ya riga ya yi hakan. Shiga daga abokin ciniki zuwa abokin ciniki na uku ne, mafi ƙunci, da nasa abubuwan hanya da izini. Babu ɗaya daga cikin waɗannan da ya zama akwatin zaɓi kawai a kan ƙarshen hanyar da ke akwai.
Ka riƙe iyakar bayanin IPv4 da gaskiya ma. Takardun AWS na yanzu sun raba IPv6, inda ba a yi wannan fassarar ba, da sauran tsarin haɗin da ke bin hanya daban.
Gwada a matakai uku masu alama: abokin ciniki ya buɗe zaman da aka halatta, sabis ɗin VPC ya amsa wannan zaman, kuma uwar garken VPC ya buɗe sabon zaman zuwa ga abokin ciniki. Samun nasarar biyun farko yayin da na uku ya gaza shi ne siffar da ake tsammani na wannan ƙira, ba lahani da za a bi da ƙa'idojin na'urar hana wuta ba.