Tunnel buuxa ee Access Server ee EC2: sababta sanduuq hal ah uusan ku filnayn

Dami fiiro gaar ah oo laga joojiyay EC2 waa jawaabta ugu badan ee lagu celceliyo su aalaha ku saabsan bixitaanka internet Access Server, waana keligiis wax ma u qabto macmiilkaaga. Fiiro gaar ah waa xaddidaad gudbin AWS: waxay ka dhigtaa aaladda inay aqbasho baakadaha aan isha ama meesha loo socdo ahayn cinwaankeeda. Ma u sheegto macmiilka inuu traffic internet ku diro tunnelka, ma abuurto waddo kor u kacda, kamana daro NAT. Khuraafaadka ayaa ah in sanduuqa calaamaduhu uu yahay shaqada lafta.

Waxa fiiro gaar ah uu dhab ahaan xakameeyo

Interface kasta oo shabakadeed EC2 wuxuu tuuraa traffic aan loo jeedin isaga, ilaa aaladda ay u shaqayso sida router, qalab NAT ama irrid VPN oo aad damiso fiiro gaar ah. Daminta waxay siinaysaa fasax gudbin. Fasax ma aha qaabayn: aaladda waxay weli u baahan tahay waddo irrid internet ama qalab NAT, shaxda waddooyinka VPC waxay weli u baahan tahay gelitaanka u dhigma, kooxaha ammaanku waa inay weli oggolaadaan qulqulka, serverkuna waa inuu weli turjumo ama waddo ka dhigo traffic soo noqda.

Hubi qiimaha hadda jira aws ec2 describe-instance-attribute --instance-id i-0123456789abcdef0 --attribute sourceDestCheck ka hor intaadan wax beddelin. Haddii aad ka beddesho console-ka, u beddel sababtoo ah aaladda waxay u gudbisaa kuwa kale, ma aha sababtoo ah macmiil ma gaaro internetka.

Siyaasadda waddooyinka macmiilka waxaa leh Access Server

Gudaha Access Server 3, fur Access Controls oo hel qaybta Internet Access and DNS. Doorashada Internet Gateway waxay bixisaa tunnel buuxa ama tunnel qaybsan; tunnel buuxa wuxuu macmiilka ku yidhaahdaa inuu traffic-kiisa caadiga ah u jiheeyo VPN, tunnel qaybsan wuxuu traffic internetka ku reebaa waddada maxalliga macmiilka. Kaydi oo ku dhaqan gal habka shaqada badeecada, ka dib dib u xidh macmiil tijaabo, sababtoo ah siyaasadda waxaa la gaarsiiyaa waqtiga xidhitaanka.

Noocyada hore waxay isticmaalaan menu kala duwan oo qaar ka mid ah dhismayaasha Community OpenVPN ma laha xakameyn u dhigma. Hubi nooca ugu weyn ee la rakibay ka hor intaadan raadin shaashad aan jirin. Ka dib xaqiiji waxa macmiilka helay: profile tunnel buuxa waa inuu dhigaa waddo caadi ah oo tunnelka mara, profile tunnel qaybsanna waa inuusan sidaas yeelin.

Raac baakadda tunnelka ka dib

Marka macmiilku traffic internetka u diro tunnelka, serverku waa inuu gudbiyo oo inta badan turjumo. Access Server wuxuu maamulaa xeerarkiisa NAT iyo waddooyin, sidaas darteed akhri qaabaynta shaqaysa halkii aad ku dari lahayd xeerarka Community OpenVPN faylasha la abuuray; xeerarka aan la maamulin waa la dul qoraa ama way is khilaafaan cusboonaysiinta badeecada ee xigta. sudo iptables -t nat -L -n -v ama u dhigma nftables wuxuu muujinayaa waxa dhab ahaan la turjumayo.

Dhinaca AWS waa waddo gooni ah. Aaladda ku jirta subnet dadweyne waxay si toos ah u gaartaa irrid internet oo waxay haysataa cinwaankeeda dadweyne ama IP dabacsan. Aaladda ku jirta subnet gaar ah waxay u baahan tahay waddo irrid NAT ama aalad NAT, qalabka NAT-na wuxuu u baahan yahay waddadiisa irrid internet. Ku xidhka irrid internet VPC keligiis ma siiyo isha gaar ah cinwaan soo noqod dadweyne, taas ayaa sababta isla qaabaynta Access Server ay uga shaqayso subnet aad uga guuldareysato mid kale si aamusan.

Hubi shaxda waddooyinka la xidhiidha subnet-ka aaladda, ma aha oo kaliya shaxda ugu weyn VPC. Xidhiidhka subnet-yada waxay ka sarreeyaan shaxda weyn, xidhiidh duugoobayna waa sababta caadiga ah ee qaabayn shaqeynaysay ay u joogsato dib u dhismaha ka dib.

Kala sooc bixitaanka IP iyo DNS

Tijaabi marka hore cinwaan qoraal ah, ka dib magac, isla barnaamijka macmiilka. Haddii curl -4 https://checkip.amazonaws.com soo celiyo cinwaan dadweyne laakiin magacyada martigeliyaha guuldareystaan, tunnelka iyo waddada NAT way shaqeeyaan oo dhibaatadu waa DNS: resolver la diray, xaaladda resolver macmiilka, ama koox ammaan oo xannibta resolver. Dejinta DNS Access Server waxay ku jirtaa isla aagga Internet Access, laakiin waxay maraan waddo kood oo kale.

Isbarbar dhig cinwaanka la soo celiyay iyo bixitaanka aad qorsheysay. Haddii uu yahay cinwaanka dadweyne ee aaladda, aaladda ayaa turjumeysa traffic-ka; haddii uu yahay cinwaan irrid NAT, waddada subnet gaar ah ayaa la isticmaalayaa. Labaduba way sax noqon karaan. Waxa aadan soo gabagabeyn karin waa in browser ku jira serverku caddeeyo gudbinta macmiilka.

Ha u ogolaan sanduuq keliya inuu baaritaanka xiro

IPv6 waa go aan gooni ah. Siyaasadda tunnel buuxa ee IPv4 wax ma sheegto ku saabsan haddii IPv6 la qaado, la xannibo ama la soo daayo, macmiil leh laba lakabna wuxuu sii wadi karaa isticmaalka waddadiisa IPv6 maxalliga ah inta IPv4 uu tunnelka ku jiro. Tijaabi qoyska cinwaanka aad dhab ahaan danaynayso, oo si cad u go aanso haddii kan kale la damiyo.

Ugu dambeyn, tijaabi xaaladda la gooyay. Doorashada tunnel buuxa waxay qeexdaa siyaasadda waddooyinka inta aad xidhan tahay, ma aha waxa dhaca marka tunnelku dhaco. Haddii shuruuddu tahay in aan traffic ka bixin VPN-ka, taas waa su aal kill-switch iyo derbi dab ah, waxayna u baahan tahay tijaabadeeda halkii laga soo saari lahaa shaxda waddooyinka.