EC2 Windows: macmiil VPN, server VPN ama irrid AWS?
Istaan EC2 Windows waxay karti u leedahay inay socodsiiso software VPN, laakiin macmiil, server is-maamul ah iyo irrid AWS waa doorar kala duwan oo leh milkiilayaal kala duwan.
Koox waxay u baahan tahay xiriir VPN oo loogu talagalay app ku socda istan EC2 Windows, waxay heshaa software macmiil oo ku habboon, way rakibtaa, ka dibna waxay waydiisaa sababta qaybta kale ee VPC aysan u isticmaali karin. Rakibidda way shaqeysay; doorka weligiis lama go'aansan. Software-ka ku socda gudaha martida wuxuu noqon karaa macmiil ku biira shabakadda qof kale, server aqbala macmiil kale, ama midkoodna labada badeeco VPN ee AWS maamusho, door kastana wuxuu kuu reebayaa shaqo kala duwan.
Calaamaddu inta badan waa doorka khaldan
Calaamadda caadiga ah waa tunnel shaqeeya oo xalliya dhibaatada khaldan. Macmiilka ku jira VM wuxuu VM-daas siinayaa waddo bax ah; kamana siiyo laptop-kaaga, xafiiskaaga ama subnet kale waddo soo gal ah. Serverka ku jira VM wuxuu kuwa kale siinayaa waddo soo gal ah, laakiin hadda adigaa leh dhageystaha, xaqiijinta iyo gudbinta.
Adeegyada la maamulo waxay u raraan socodsiinta adeegga AWS waxayna kuu reebaan naqshadeynta. Site-to-Site VPN wuxuu ku xiraa shabakadaha irrid macmiilka iyo irrid AWS, Client VPN-na wuxuu qalabka fog siinayaa barta ugu dambeysa oo la maamulo. Labada xaaladba waddooyinka, xeerarka ogolaanshaha iyo isha aqoonsiga waa habayntaada, oo midkoodna badeecadaha kama rakibo macmiil guud gudaha martida Windows.
Afar qaab ayaa suurtagal ah, shaxduna waxay u kala soocdaa waxa waxa ku xirma iyo cidda qaada culayska hawlgalka.
| Role | What connects | Who owns the VPN software |
|---|---|---|
| Client in the Windows VM | This VM dials out into someone else's network | You, plus the software vendor |
| Server in the Windows VM | Inbound clients and sites attach to this VM | You, end to end |
| AWS Site-to-Site VPN | Two networks meet through a customer gateway and an AWS gateway | AWS operates the tunnels; you own the peer and route design |
| AWS Client VPN | User devices attach to an endpoint AWS operates | AWS operates it; you own the access rules |
Akhri safka, ma aha magaca badeecada: isla istanka Windows wuxuu ku noqon karaa laba saf oo kala duwan iyadoo ku xiran software-ka ku socda.
Macmiil gudaha VM: VM waxay ku biirtaa shabakad
Macmiilka baxa wuxuu u baahan yahay in la hubiyo nooca Windows, qaab dhismeedka iyo shuruudaha darawalka ka hor inta wax la rakibo. Macmiilku wuxuu beddeli doonaa waddooyinka iyo DNS-ka istanka, taas oo saameyn karta adeegyada horey ugu socda halkaas, oo ay ku jirto waddada aad u isticmaasho maamulka fog. Qor magaca adapterka iyo cabbirka interface-ka uu macmiilku dejiyo, sababtoo ah interface-ka cusub ayaa laga yaabaa inuu mudnaan ka helo kan jira. Haddii istanka lagu maamulo maareeyaha fadhiyada halkii SSH ama RDP, xaqiiji in waddadaas weli shaqeyso ka dib marka macmiilku xirmo.
Go'aanso taraafikada macmiilku qaado ka hor inta aanad daadin. Tunnel buuxa wuxuu qaban karaa fadhiga maamulka oo dibadda kaa xiri karaa, tunnel qaybsan-na wuxuu u oggolaan karaa istanka inuu gaaro shabakadda gaarka ah iyadoo taraafikadeeda kale qaadanayso bax kale. Tijaabi iyadoo waddo maamul oo labaad diyaar tahay, oo qor waddooyinka uu macmiilku rakibo si isbeddel dambe loo sharraxo.
Server gudaha VM: macmiil kale ayaa ku biira
Server is-maamul ah waxaad leedahay dhageystaha, shahaadada ama maaddada fure, keydka isticmaalayaasha iyo xeerarka gudbinta. Haddii serverku taraafikada u gudbiyo macmiil kale, istanku wuxuu noqdaa rooder, taasna waxay u baahan tahay gudbin heer marti ah oo lagu daray isbeddello waddooyin iyo kooxo amni heer AWS ah.
Baar dhageystaha martida iyo mar kale subnet kale, ka dibna baar host uu istanku u gudbiyo. Adeeg maxalli ah oo caafimaad qaba waxba kama caddeeyo waddada la gudbiyay, sidaas darteed qor labada natiijo qoraalka isbeddelka.
Irridaha la maamulo waxay hayaan adeegga, ee ma aha naqshadeyntaada gelitaanka
AWS Site-to-Site VPN wuxuu diiwaangeliyaa doorarka tunnel ee irrid macmiilka iyo irrid AWS, iibsashada xiriirkaasna ma beddelo naqshad kasta oo gelitaan fog. Client VPN wuxuu diiwaangeliyaa barta ugu dambeysa oo la maamulo oo leh shakhsiyaadka macmiilka, halka xeerarka ogolaanshaha iyo waddooyinka bartilmaameedka ay yihiin kuwaaga. AWS waxay hayaan barta ugu dambeysa iyo shahaadooyinkeeda shaqeynaya; cidda gaari karta app tee weli waa xeer ogolaansho aad qorto oo aad ilaaliso.
Ka dooro badeecadaha shan dhidib: doorka kastaa ciyaaro, borotokoolka uu aqbalo, isha aqoonsiga uu filayo, sida taraafikada loo gudbiyo iyo sida helitaanka loo bixiyo. Iska indhatir tiro kasta oo hal ah oo ku qoran mawduuca madasha, sababtoo ah awoodda la daabacay way la socotaa adeegga. Oo ha u malayn in lammaane tunnel la maamulo uu beddelo dhaqanka macmiil marti ah oo aan loo dooran.
Dooro doorka ka hor badeecada
Qor hal jumlad oo magacaabaya jihada: VM-kan waxay ku biirtaa shabakad, VM-kan waxay aqbalaa macmiillyo, ama irrid AWS waxay isku xirtaa shabakado qeexan.
Jumladaas ayaa go'aamisa liiska gaaban ee badeecadaha, milkiilaha software-ka iyo hababka guuldarada aad ku hagaajin doonto. Haddii shuruuddu tahay in isticmaalayaasha fog gaaraan app, macmiil lagu rakibay VM-ga appka waa qaab khaldan. Haddii shuruuddu tahay in hal VM gaaro shabakad lammaane, irrid site-to-site la maamulo ayaa ka badan mishiinada shaqadu u baahan tahay. Labada jawaabba waa sharci; mid keliya ayaa u dhigma jumlada aad qortay.