GCP Classic VPN ee Terraform: ka dhig tunnel-ka mid ku salaysan waddooyinka

Qorshaha si nadiif ah ayaa loo dabaqaa, tunnel-ku wuu soo baxaa, konsolka-na wuxuu u yaqaannaa mid ku salaysan siyaasadda. Gaadiidku wali ma gudbo, raadinta badhan ku salaysan waddooyinka ee kheyraadka Terraform meelna ma gaadho sababtoo ah ma jiro goob sidan oo kale ah. Classic VPN dhexdiisa, habdhaqanka ku salaysan waddooyinka maaha qaab aad dooratay. Waxaa la helaa marka dooro maxalliga ah ee gaadiidka uu yahay 0.0.0.0/0, doorooyinka fog ay liis-gareeyaan shabakadaha aad runtii rabto, iyo waddo tilmaamaysa tunnel-ka. Saddex shay, calaamadduna way raacdaa.

Khallad: goob qaab tunnel

Calaamadda konsolka waxay ka tarjumaysaa waxa API-ga ku arko doorooyinka. Waxba kheyraadka kuma sheegto ku salaysan waddooyinka, sidaas darteed waxba ma jiraan lagu dejiyo run.

Raadinta goobtaas waxay cunaysaa saacadda ugu horreysa ee dhibaatada, halka akhrinta qiimaha doorooyinka ay qaadanayso shanta daqiiqo ee ugu dambeysa.

Waxa ku salaysan waddooyinka halkan loola jeedo

Google waxay tunnel-ada Classic VPN ee ku salaysan waddooyinka u qortaa sidii tunnel-o ku salaysan siyaasadaha oo dooro maxalligoodu yahay 0.0.0.0/0. Kaliya baaxadda fog ayaa la magacaabaa, dhinaca maxalliga ahna waxaa loo arkaa sida cinwaan kasta. Taasi waa sababta calaamadda ku jirta habayntaadu ay tahay qiime ee maaha qaab. Qor labada dooro si cad oo ka akhri natiijada qorshaha:

local_traffic_selector  = ["0.0.0.0/0"]
remote_traffic_selector = ["10.20.0.0/16"]

Horgalaha lammaanaha ee qaybtaas waa tusaale; qaabka ayaa muhiim.

Waddadu waa shay gaar ah

Shayga tunnel-ku ma rakibo waddo. Baakaduhu waxay la jaanqaadi karaan siyaasadda tunnel-ka oo weli aan haysan meel ay aadaan, sababtoo ah boodhka xiga waxaa go'aamiya shaxda socodka VPC. Waddadu waxay u baahan tahay baaxadda meesha loo socdo, shabakadda, tunnel-ka sida boodhka xiga iyo mudnaan ka guuleysata wax kasta oo ballaadhan. Haddii aad iloowdo, waxaad helaysaa tunnel sheegaya in xiriirku dhisan yahay iyo baaritaan waligiis ka bixin VPC.

resource "google_compute_route" "office" {
  name                = "office-via-vpn"
  dest_range          = "10.20.0.0/16"
  network             = google_compute_network.vpc.name
  next_hop_vpn_tunnel = google_compute_vpn_tunnel.to_office.id
  priority            = 1000
}

Abuur waddada isla module-ka tunnel-ku ku jiro, si labadoodu aysan u kala fogaansho dib-u-eegista.

Ka tarji doorooyinka lammaanaha

Qalabka fog waa in lagu habeeyaa sawir muraayad ah: baaxaddiisa maxalliga ah waa doorooyinkaaga fog, baaxaddiisa fogna waa inuu daboolaa subnet-yada GCP ee aad filayso inaad isticmaasho. Haddii dhinac kasta uu cidhiidhiyo, wajiga 2 wuu guuldareystaa inkastoo wajiga 1 guuleysto. Tani waa qaabka ugu caansan ee habayn u eg mid sax ah konsolka oo aan qaadin gaadiid.

Daabac doorooyinka labada dhinac oo isku dhinac ah inta lagu jiro dib-u-eegista isbeddelka.

U kala qaybi cinwaanka taagan laba codsi

Abuurista cinwaanka kaydsan iyo tunnel-ka tixraacaya isla codsi keliya waa il caan ah oo xasillooni-darro, sababtoo ah cinwaanku waa inuu jiraa ka hor inta qaanuunka gudbinta uusan isticmaali karin. Marka hore codso kaliya kheyraadka cinwaanka, kadib ku dar iridda, qaanuunnada gudbinta iyo tunnel-ka oo mar kale codso. Terraform wuxuu akhriyaa cinwaanka jira xaaladda codsiga labaad oo dib u isticmaalaa. Haddii aad tan seegto, tunnel-ku wuxuu heli karaa cinwaan dadweyne cusub codsi kasta, taas oo jabisa habaynta lammaanaha mar kasta.

Laba codsi hadda way ka jaban yihiin isbeddelka lammaanaha ee daabacaad kasta.

Xaqiiji wada-hadalka, ma aha calaamadda

Kadib codsiga, hubi saddex xaqiiqo oo kala duwan: tunnel-ku wuxuu sheegayaa in xiriirku dhisan yahay, waddadu way jirtaa boodhka xiga ee loogu talagalay, lammaanahuna wuxuu sheegayaa in wajiga 1 iyo wajiga 2 labaduba sare yihiin.

Tunnel sare ku jira oo wajiga 2 hoose ku jira macneheedu waa labada dhinac kuma heshiin doorooyinka:

• Dhinac keliya wuxuu liis-gareeyaa subnet aan dhinaca kale liis-gareyn.
• Dhinac keliya wuxuu isticmaalaa isku-dar uu dhinaca kale cidhiidhiyay.
• Waddadu way jirtaa laakiin waxay tilmaamaysaa tunnel kale.

Classic VPN waa hal tunnel oo SLA hooseeya marka loo eego HA VPN, HA VPN-na wuxuu isticmaalaa laba interface, laba tunnel iyo BGP oo leh noocyo kheyraad oo kala duwan. Koobista tusaale caadi ah gelinta habaynta HA iyo filashada in goobaha doorooyinku isla si ahaan u dhaqmaan waa khalad gaar ah oo mudan in laga fogaado. Goobaha tunnel-ka laftoodu waxay ku qoran yihiin tixraaca google_compute_vpn_tunnel.