AWS Client VPN waa ku xiran yahay laakiin internet ma jiro: hubinta waddooyinka

AWS Client VPN waa ku xiran yahay laakiin marin u helista internet ma jiro? Hubi waddooyinka macmiilka, fasaxa barta dambe, bixista shabakadda hoose iyo DNS isla nidaamkaas.

Waxaad ku xiran tahay barta dambe ee AWS Client VPN, shabakadda hoose ee gaarka ah way jawaabtaa, haddana bog kasta oo dadweyne wakhti ayuu ku dhammaadaa. Isku darkaas wuxuu dhibaatada ku koobaa mid ka mid ah saddex shay oo ku yaal dhinaca la maareeyo: waddada macmiilku rakibo, waddada barta dambe oo ay weheliso qaanuunka fasaxeed, ama boodhka xiga ee shabakadda hoose ee xiriirka leh. Waxaan ku hubiyaa isla nidaamkaas sababtoo ah cilad kastaa si kale ayay uga muuqataa macmiilka. Hanbuugan wuxuu daboolaa barta dambe ee la maareeyo ee VPC la xiriirta, ma aha server OpenVPN oo ku yaal EC2 iyo ma aha xiriirka Cloud WAN ama Transit Gateway.

Ka bilow waxa macmiilku dhab ahaan u maro

Xaaladda xiriirku waxay caddaynaysaa fadhiga TLS iyo qoondaynta CIDR ee macmiilka, wax kale ma aha. Weydii nidaamka hawlgalka halka ciwaanka dadweynuhu u socon doono inta tunnel-ku taagan yahay. Linux ip route get 1.1.1.1 waa inuu sheegaa interface-ka tunnel-ka; macOS netstat -rn -f inet | head -5 wuxuu muujiyaa gelitaanka caadiga; Windows Find-NetRoute -RemoteIPAddress 1.1.1.1 wuxuu daabacaa interface-ka la doortay iyo boodhka xiga.

Kadib akhri calaamadda split-tunnel, sababtoo ah waxay go'aaminaysaa in waddooyinka barta dambe ay daabacday ay yihiin kaliya meelaha macmiilku u diro tunnel-ka:

aws ec2 describe-client-vpn-endpoints \
  --client-vpn-endpoint-ids cvpn-endpoint-0123456789abcdef0 \
  --query 'ClientVpnEndpoints[0].SplitTunnel'

Marka SplitTunnel true tahay, meel dadweyne waxay isticmaashaa tunnel-ka kaliya marka barta dambe ay daabacdo waddo daboolaysa, sidaas darteed 0.0.0.0/0 maqan waxay uga tagtaa gaadiidkaas interface-ka maxalliga. Marka false tahay, macmiilku wuu qabtaa gaadiidka, laakiin barta dambe wali waa inay u mariso oo fasaxdo; haddii kale baakaduhu waxay galaan tunnel-ka oo halkaas ku hakadaan. Dib u xiriir macmiilka ka dib beddelka mid ka mid ah labada dejinta, sababtoo ah waddooyinka iyo server-yada DNS waxaa la bixiyaa wakhtiga xiriirka oo macmiilka socda ayaa laga yaabaa inuu hayo kooxdii hore.

Si gooni ah u akhri waddada barta dambe iyo qaanuunka fasaxa

Kuwani waa laba shay, abuurista midna ma abuurto kan kale. Liis waddooyinka barta dambe oo raadi waddo caadi ah oo bartilmaameedkeedu yahay shabakad hoose oo xiriir leh:

aws ec2 describe-client-vpn-routes \
  --client-vpn-endpoint-id cvpn-endpoint-0123456789abcdef0

Waddo kastaa waxay leedahay hal bartilmaameed oo shabakad hoose, sidaas darteed saddex xiriir waxay u baahan yihiin waddo caadi ah oo u dhigma mid kasta. AWS waxay diiwaangelisaa shuruudan daboolka, calaamadda wax ku oolka ah ee bannaaniduna waa isticmaale ka shaqeeya shabakad hoose oo ku xanniban mid kale, taas oo loo akhriyaa cilad goos-goos ah halkii ay ahaan lahayd waddo maqan. Dukumeetiga rasmiga ah ee xaaladda Client VPN wuxuu qeexayaa habaynta shabakadda hoose ee dadweynaha ee waddooyinkani ka tirsan yihiin.

Fasaxu waa shayga labaad. Marka qaanuun uusan daboolin meesha dadweynaha, tunnel-ku wuxuu qaadaa baakadda oo adeeggu wuu tuuraa, sidaas darteed kheyraadka gaarka ah way sii shaqeeyaan halka internet-ku uusan shaqeyn:

aws ec2 describe-client-vpn-authorization-rules \
  --client-vpn-endpoint-id cvpn-endpoint-0123456789abcdef0

Qaanuunka CIDR-ka VPC waxba kama sheegto 0.0.0.0/0. Ku darista qaybaha maqan ee tunnel buuxa waxay la macno tahay hal waddo shabakad hoose oo xiriir leh kasta iyo qaanuun fasax ah oo aad hadhow baari karto:

aws ec2 create-client-vpn-route \
  --client-vpn-endpoint-id cvpn-endpoint-0123456789abcdef0 \
  --destination-cidr-block 0.0.0.0/0 \
  --target-vpc-subnet-id subnet-0a1b2c3d4e5f67890
aws ec2 create-client-vpn-authorization-rule \
  --client-vpn-endpoint-id cvpn-endpoint-0123456789abcdef0 \
  --destination-cidr-block 0.0.0.0/0 \
  --access-all \
  --description "internet egress for full tunnel"

--access-all waxay siinaysaa meesha macmiil kasta oo barta dambe, sidaas darteed hayso kaliya inta tunnel-ku buuxa yahay; qaanuun ku xiran koox hagaha ayaa ka fiican marka aad haysato kooxo aad ku xirto.

Raac baakadda ka bixitaanka shabakadda hoose ee xiriirka leh

Waddada barta dambe waxay go'aamisaa in AWS baakadda siiso shabakaddaas hoose. Ma go'aamiso boodhka xiga ee ka dambeeya, kaas oo ku nool shaxda waddooyinka VPC ee shabakadda hoose lafteeda:

aws ec2 describe-route-tables \
  --filters Name=association.subnet-id,Values=subnet-0a1b2c3d4e5f67890 \
  --query 'RouteTables[].Routes[?DestinationCidrBlock==`0.0.0.0/0`]'

Waddo caadi ah oo la isticmaali karo waxay tilmaamaysaa albaabka internet-ka ee shabakad hoose oo dadweyne, ama albaabka NAT ee mid gaar ah, xaaladda blackhole waxay ka dhigan tahay bartilmaameedka waa la tirtiray oo jidku hadda aamusnaan buu u dhintaa. Kuwani waa shaxo ka duwan liiska waddooyinka barta dambe, mid hagaajintuna ma hagaajiso kan kale.

Boodhkan waxaa fadhiya laba shaandheyn. Kooxda amniga ee lagu dabaqay xiriirka shabakadda bartilmaameedka waa inay oggolaato gaadiidka baxa ee u socda meesha dadweynaha, iyo ACL kasta oo shabakadeed oo khuseeya waa inuu oggolaado codsiga iyo gaadiidka soo noqodka ee dekedaha muddada gaaban. Koox amniga xiriir xaddidan ayaa sabab caadi ah oo marin gaar ah u shaqeeyo halka kan dadweynuhu uusan shaqeyn.

Dooro lakabka koowaad calaamadda, halkii aad saddexda oo dhan isku mar beddeli lahayd:

What you observeLayer to check first
No tunnel interface for a public IPClient route or split-tunnel flag
Tunnel interface chosen, request times outEndpoint route and authorization rule
Endpoint route present, still times outSubnet route table, association security group
Named host fails, numeric address worksDNS servers and their own authorization

Ka sooc cilada DNS waddo dhintay

Xallinta magacyada si ka duwan ayay u guuldareysataa marka la eego gudbinta, tunnel buuxana wuxuu ka dhigaa farqigaas muhiim sababtoo ah xalliyaha la riixay hadda tunnel-ka ayaa lagu gaaraa. Haddii barta dambe ay sheegto server-yada DNS ee VPC, cinwaannadoodu waxay u baahan yihiin daboolka waddo iyo fasax sida meel kasta oo kale. Si toos ah u weydii xalliyaha si aad u aragto cilada aad haysato: dig +short example.com @10.0.0.2, ama nslookup example.com 10.0.0.2 Windows.

Marka URL tiro leh jawaabto mid magac lehna uusan jawaabin, jooji tafatirka waddada caadiga oo ka shaqee DNS. Codsiga ciwaanka IP waxba kama caddeeyo martigeliyaha fikradeed ee magaca leh iyo shahaadadiisa, sidaas darteed ku hay mid ka mid ah imtixaan magac leh hubinta ugu dambeysa.

Waqtigu wuu caawiyaa. Xiriirka TCP oo aan dhowr ilbiriqsi gudahood jawaab helin waxay tilmaamaysaa marin ama shaandheyn, halka codsi ku dhegan raadinta magaca uu tilmaamayo xalliyaha. Beddelka waddada caadiga inta xalliyuhu aan la gaari karin wuxuu inta badan ka dhigaa hal cilad laba.

Si nadiif ah dib ugu noqo, kadib xaqiiji jidka bixitaanka

Labada shayba waxay ahaayeen kuwo lagu daro, sidaas darteed dib u noqodku waa tirtirid ma aha hagaajin:

aws ec2 delete-client-vpn-route \
  --client-vpn-endpoint-id cvpn-endpoint-0123456789abcdef0 \
  --destination-cidr-block 0.0.0.0/0 \
  --target-vpc-subnet-id subnet-0a1b2c3d4e5f67890
aws ec2 delete-client-vpn-authorization-rule \
  --client-vpn-endpoint-id cvpn-endpoint-0123456789abcdef0 \
  --destination-cidr-block 0.0.0.0/0 \
  --access-all

Dib u xiriir, kadib xaqiiji jidka ay gaadiidku u baxdo. Isbarbar dhig ciwaanka dadweynaha la arkay iyo ciwaanka IP-ga dabacsan ee albaabka NAT, ama albaabka internet-ka ee aad doonayay inaad isticmaasho, oo hubi in kheyraad gaar ah uu wali jawaabayo isla fadhigaas.

Ku dhammee liis gaaban, oo qaybta ugu dambeysa u qaado qayb ka mid ah isbeddelka ma aha dukumeeti:

  • Hal 0.0.0.0/0 waddo barta dambe ee shabakad hoose oo xiriir leh kasta.
  • Qaanuun fasax ah oo daboolaya 0.0.0.0/0 macmiilada aad rabto inaad u adeegto.
  • Waddo caadi ah oo VPC ah oo aan blackhole ku jirin shabakad hoose oo xiriir leh kasta.
  • Bixista kooxda amniga xiriirka, iyo gaadiidka soo noqodka ACL.
  • Ciwaannada xalliyaha la maray oo la fasaxay, lagu xaqiijiyay codsi magac leh.
  • Dib u noqod la diiwaangeliyay ee waddada iyo qaanuunka.

Hal qoraal oo ku saabsan baaxadda: kani waa jid IPv4. Macmiil laba-stack ah wuxuu hayaa xiriirka IPv6 uu hore u lahaa, sidaas darteed waddo caadi ah oo IPv6 ah waa go'aan gooni ah oo leh fasaxiisa, ma aha saameyn dhinac ah oo kan.

Maqaallo la xiriira