Google API iyada oo VPN ah: u marso VIP-ka, ma aha kaliya subnet-ka
Waddada loo maro subnet-ka VPC ma doorato cinwaannada VIP ee API-ga. Xalliso magacyada saxda ah, ku dhawaaq prefix-ka VIP, hayso waddada soo noqodka VPC, ka dibna tijaabi HTTPS.
Ku gal server-ka maxalliga ah SSH, kor u qaad tunnel-ka, VM-ka gaarka ahna wuu jawaabaa; ka dib wicitaanka ugu horreeya ee Google API wuu guuldareystaa waddo la'aan. Subnet-ka VM iyo cinwaannada VIP ee API waa goobo kala duwan, sidaas darteed waddo mid ka mid ah ma doorato kan kale. Saddex shuruudood waa inay dhacaan ka hor inta wicitaan API gaar ah uu shaqeeyo. Magaca API waa inuu ku xalliso VIP, prefix-ka VIP waa in lagu dhawaaqo tunnel-ka, VPC-na waa inuu ogaado sida jawaabta loo celiyo. Ping wax ka mid ah taas ma sheego, iyo fadhi SSH oo shaqeeya oo mashiinka ku jira subnet-ka sidoo kale ma sheego.
Cinwaannada VIP ee API waa goobo gooni ah
Google waxay daabacdaa VIP gaar ah oo loogu talagalay gelitaanka API ee shabakadda maxalliga ah, oo kuwaas waa cinwaannada DNS-kaagu ay tahay inuu ku celiyo magacyada API. Labaduba waa prefix yar yar oo midkoodna maaha bannaan RFC 1918:
| Record | Resolves to | What it does not give you |
|---|---|---|
| private.googleapis.com | 199.36.153.8/30, the general front door for Google APIs | not a bypass around a service perimeter |
| restricted.googleapis.com | 199.36.153.4/30, reachable only for services a perimeter allows | not the whole API surface, so some names stay out of reach |
Cinwaanno u eg kuwo dadweyne ma macna aha in waddadu ay ka baxdo tunnel-ka internet-ka caadiga ah. Prefix-yadu waxay u jiraan si macmiil maxalli ah uu u gaaro dhinacyada hore ee Google iyada oo loo marayo waddo la taageeray halkii uu ka mari lahaa barta bixitaan aan loo baahnayn. U qaado sidii goobo tunnel-ka ku deel ah, ma aha sidii martigeliyeyaal la baadho. Sharci firewall oo loo qoray bixitaanka internet-ka ayaa badanaa tuura iyaga, taasina waa sabab caadi ah oo wicitaanku ugu guuldareysto ka hor inta uusan bilaaban.
DNS ayaa go'aamiya endpoint-ka aad gaarto
U jeedi xallinta maxalliga ah diiwaannada Google uu u diiwaangeliyo endpoint-ka la doortay, si magacyada ay u baahan tahay barnaamijku ugu jawaabaan VIP-kaas. Kaliya googleapis.com ma aha liis: diiwaannada xirmooyinka, diiwaannada weelasha iyo isku xirka guuritaanka waxay leeyihiin magacyo la diiwaangeliyay oo u gaar ah. VIP-ka xaddidan sidoo kale ma qaado adeeg kasta, sidaas darteed magac la xalliyo wali waa laga yaabaa in aan la taageerin. Qor domain-yada barnaamijku si dhab ah ula xiriiro ka hor inta aanad taaban xallinta.
Qiyaasidda cinwaan VM ee VPC halkii magac adeeg waa xal ma aha, oo badanaa waxay qarinaysaa farqiga DNS ilaa macmiil kale uu guuldareysto.
Ku dhawaaq prefix-ka VIP, hayso inta kale
Xiriir ku saleysan BGP, Cloud Router waa inuu ku dhawaaqaa prefix-ka VIP la doortay si router-ka maxalliga ahi u barto tiradaas isagoo maraya fadhiga loogu talagalay. Ku dhawaaqista kaliya subnet-yada VPC ma daro tiradaas, router-ka maxalligana wuxuu sii wadaa isticmaalka waddadiisa caadiga ah cinwaannadaas. Prefix-ka ku jira shaxda marinnada waa caddaynta kaliya ee ah in dhawaaqa uu dhaafay fadhiga.
Hayso dhawaaqyada jira inta aad ku darayso kan cusub, maxaa yeelay xulashooyinka heerka router-ka iyo heerka asaagga waxay leeyihiin gaadhitaan kala duwan, beddelka qaybtaana wuu ka noqon karaa shabakado hore u shaqeynayay. Ka dib hubi dhawaaqa waxtarka leh fadhi kasta halkii aad ka hubin lahayd router-ka oo dhan. Prefix maqan iyo prefix la noqday waxay u muuqdaan isku mid dhanka maxalliga ah, sidaas darteed aragtida fadhiga ayaa kala soocda ka-tagista iyo dib-u-dhaca.
Dhinaca VPC wuxuu u baahan yahay waddadiisa iyo waddada soo noqodka
Gudaha VPC, waddada VIP waa inay isticmaashaa iridda internet-ka caadiga ah sida boodhka xiga, iyo inkastoo magaca, taraafikadaas waxay ku sii jirtaa shabakadda Google. VPC sidoo kale wuxuu u baahan yahay waddo ku noqota isha maxalliga ah iyada oo loo marayo VPN, taas oo ah shay ka duwan prefix-ka la dhawaaqay. Tixgeli shuruudaha marinnada gobolka ee la diiwaangeliyay marka tunnel-ka iyo macmiilku aanay isku gobol ku jirin.
Waddada soo noqodka si madaxbannaan u hubi, maxaa yeelay jihada codsiga oo shaqeysa waxay qarin kartaa jihada jawaabta oo jabtay. Laba jiho, laba waddo, mid kastaana wuxuu ku guuldareystaa calaamadiisa.
Tijaabi codsiga, ka dib akhri diidmada
ICMP echo ma helo jawaab cinwaannadaan VIP, sidaas darteed ping guuldareystay wax ma caddeeyo, kan guuleystaana aad buu u yar yahay. Macmiilka dhabta ah, baadh jawaabta magaca iyo waddada la doortay, ka dibna samee codsi HTTPS oo la ogolaaday adeegga aad danaynayso. Haddii codsigu gaaro adeegga oo la diido, eeg aqoonsiga, IAM iyo siyaasad kasta oo xadka adeegga ah oo khuseysa.
Marinnada gaarka ah ma bixiyaan ogolaansho API mana beddelaan waxa aqoonsigu qaban karo. Guusha gaadiidka iyo jawaab la ogolaaday waa natiijooyin gooni ah, labadabaana waad u baahan tahay. Waddada IPv6 sidoo kale si cad u hayso, maxaa yeelay qaabeynta prefix-yada IPv4 wax ma sheegto macmiilka doorbida IPv6.
Hagaha Google ee ku saabsan Private Google Access ee ka yimaada shabakadda maxalliga ah wuxuu si wada jir ah u daboolaa diiwaannada DNS iyo shuruudaha marinnada, sidaas darteed isbarbardhig dhigistaada xallinta iyo dhawaaqa isaga, ma aha qoraal madal ah. Ka dib mar kale samee isla codsigaas oo qor jawaabta iyo waddada isla tikitka.