Cloud VPN ilaa VM ku yaal GCP: isticmaal IP-ga gudaha, ma aha IP-ga NAT

Marka shabakad maxalli ah ay VPC ku gaarto Cloud VPN, bartilmaameedka adeegga Compute Engine badanaa waa cinwaanka gudaha ee VM. Cinwaanka IPv4 dibadda ma aha cinwaan labaad oo aad ku beddeli karto isla waddada gaarka ah. Inta badan jahwareerka goobtan waxa uu ka yimaadaa in saddex cinwaan oo saddex shaqo leh loo arko kuwo is-beddel kara, marka ku bilow magacaabista kee ay baakad gaar ah isticmaalayso.

Saddex cinwaan, saddex shaqo

Magaca saddexda ka hor inta aadan midkoodna hagaajin, maxaa yeelay jawaabtu waxay beddelaysaa shayga aad xigta baari doonto.

Kii ugu horreeya wuxuu ka tirsan yahay tunnel-ka. Kii labaad wuxuu ka tirsan yahay naqshadda waddada iyo firewall-kaaga. Kii saddexaad wuxuu ka tirsan yahay gelitaanka internetka ee soo galaya waana la khariidadayaa, lama lifaaqo. Naqshad u shaqaysa midkood wax wax kama sheegto labada kale.

Sababta cinwaanka dibadda aanu u ahayn interface labaad

Hagaha cinwaannada ayaa ah awoodda ku saabsan sida helitaanka gudaha iyo dibaddu u kala duwan yihiin Compute Engine. IPv4 dibadda ee Compute Engine waa khariidad hal-ilaa-hal oo ku taal NIC-ga gudaha ee keliya ee instance-ka, marka martida waligeed ma arko interface labaad ama cinwaan labaad NIC-gaas. Waxa VM soo sheegto gudaha wali waa hal cinwaan gudaha oo aasaasi ah.

Taasi waa sababta macmiil gaar ah oo tunnel-ka u mara 10.24.1.7 iyo macmiil bartilmaameed ka dhiga cinwaanka dibadda ee VM ay ku jiraan waddooyin kala duwan. Furitaanka qaanuun firewall ee cinwaanka dadweynaha wax wax ka beddelin maayo waddada VPC ee qasabka ah inay qaaddo taraafikada tunnel-ka, iyo tafatirka waddo ku taal martida ma dhaqaajiso khariidadda madal. Dooro cinwaanka waddadaadu magacaabayso, ka dibna baar oo kaliya shayada maamula. Anshaxaas waxa uu ka saarayaa inta badan mala-awaalka waddadan xallinta dhibaatada.

Waddada ku mar gcloud

Ka bilow instance-ka oo akhri labada cinwaan isla shay ka mid ah, si aad u ogaato kee ay dokumentigaagu ka hadlayo:

gcloud compute instances describe app-1 --zone=europe-west1-b \
  --format="value(networkInterfaces[0].networkIP,networkInterfaces[0].accessConfigs[0].natIP)"

Ka dibna xaqiiji waddada iyo fasaxa uu waddadu runtii ku tiirsan yahay:

gcloud compute routes list --filter="destRange:10.24.1.0/24"
gcloud compute firewall-rules list --filter="sourceRanges:10.99.0.0/24"
gcloud compute vpn-tunnels describe TUNNEL_NAME --region=europe-west1

Akhri xaddiga tunnel-ku ku dhawaaqay oo bartay, waddada VPC ee subnet-ka culeyska shaqada, iyo qaanuunka firewall ee oggolaada isha maxalliga ah. Saddexdaan waa inay isku raacaan ka hor inta dhegeystaha martida xitaa macno u yeelan.

Ka dibna baar martida: adeeggu ma ku dhegeystaa cinwaanka gudaha, oo waddada dib u noqoshada ma maraa VPC mar kale? Dhegeyste ku xidhan oo kaliya cinwaan dadweyne ayaa ku dhici doona imtixaankan xitaa marka shay kasta oo dhinaca daruuraha ah uu sax yahay.

Prefix dadweyne waa su'aal kale

Wax ka mid ah kor ku xusan macnaheedu maaha in cinwaan kasta oo lagu qaado VPN gudihiisa uu noqdo RFC1918. Shabakad fog ayaa si sharci ah loogu nambari karaa meel bannaan oo dadweyne, haddii madalku taageero waddada oo hawlwadeenku leeyahay awoodda cinwaanka. Taasi waa doorasho naqshadeed caadi ah.

Tani la mid maaha in cinwaan NAT dibadda caadi ah loola dhaqmo sidii cinwaan subnet gudaha oo kale. Mid waa prefix aad waddo ka dhigto; kan kalena waa khariidad ay madalku ku dabaqdo gelitaanka soo galaya.

IPv6 dibadda iyo habeennada cinwaan ee si gaar ah loo qaabeeyay waxay leeyihiin macnahaooda gaar ah. Haddii qorshahaagu ku tiirsan yahay mid ka mid ah, akhri dokumentiga madalka ee muuqaaladaas halkii aad ka guudayn lahayd kiiska IPv4. Khariidadda IPv4 waa kiiska caadiga ah, ma aha kan keliya, iyo qaanuun kasta oo ka mid ah wuxuu leeyahay qawaaniintiisa.

Xaddiga is-dhaafa waa dhibaato kale

Xaddiga gaarka ah ee is-dhaafa waa sabab dhab ah oo dadku ugu dhawaadaan cinwaanka dadweynaha, waana aaladda khaldan. Beddelidda bartilmaameedka una beddelaysa cinwaanka NAT ee VM ma xallinayso is-dhaafnaanta; waxay beddelaysaa cinwaanka baakaddu sheegato inuu u yahay, iyada oo aan qeexin sida waddada dib u noqoshada u shaqayso.

Is-dhaafnaanta si ula kac ah u xalli: dib u nambari, isticmaal naqshad turjumaad la taageeray, ama ka mar shabakad aan prefix-yadu isku dhicin. Mid kasta oo kuwan waa naqshad leh milkiile. Cinwaanka NAT ma aha naqshad.

Dokumenti labada goob si gooni ah

Diiwaangeli lammaanaha tunnel-ka iyo bartilmaameedka culeyska shaqada sida laba goobood oo runbook ah oo gooni ah, mid walba oo la socda waddada iyo qaanuunka firewall ee taageera. Tunnel IPsec oo soo baxa wuxuu kaliya kuu sheegayaa in dhinacyadu isku raaceen; wax ma sheegto cinwaanka culeyska shaqadu ku heli karo, iyo sidoo kale ma sheegto haddii waddadiisa gaarku buuxda tahay.

Ku xaqiiji macmiil dhab ah dhinaca kale: xalli magaca, xaqiiji inuu soo celiyo cinwaanka gudaha, isku xidh, oo baar taraafikada soo noqota. Dokumentiga cinwaannada IP ee Compute Engine waa tixraaca kala duwanaanshaha gudaha iyo dibadda ee kor loo isticmaalay.