strongSwan EC2: VPC ha u hoggaansanto culeyska shaqada

Tunnel-ku wuu shaqeeyaa, instance-ka iriddu wuxuu ping karaa shabakadda fog, oo instance-ka codsiga ee agtiisa ma gaaro waxba. Waxba ma jaban. Tijaabadii guulaysatay waxay ka bilaabatay host-ka VPN, oo waligeed ma weydiin karo in host-kaasi qaadi karo ciwaan isha kale oo ku dhex jira isla xiriirka IPsec. Buuggan hawlgalku wuxuu xidhaa farqigaas afar tallaabo, sida loo ilaaliyo khalad kasta inuu muuqdo.

Marka hore qor afar ciwaan

Tallaabo kasta oo hoose waxay tixraacaysaa kuwaan, marka buuxi iyaga akoonkaaga ka hor inta aadan taaban shaxda marinka.

VPC:             10.60.0.0/16
Gateway subnet:  10.60.1.0/24, gateway ENI address 10.60.1.10
Workload subnet: 10.60.2.0/24, application address 10.60.2.20
Remote network:  10.90.0.0/24

Tusaaluhu wuxuu u malaynayaa isku xirka IPsec oo la ansixiyay oo shaqeeya oo ku salaysan siyaasad, iyo qulqul ilka ilaaliya. Kani ma aha macmiil gelitaan fog oo NAT leh oo amaahda ciwaan la qoondeeyay, oo farqigaas ayaa go'aaminaya haddii xulayaasha ay tahay in la beddelo.

Tallaabo 1: sii subnet-ka culeyska shaqada marrin

Shaxda marinka ee dhab ahaan ku xiran subnet-ka culeyska shaqada waxay u baahan tahay waddo loogu talagalay horgalaynta fog oo tilmaamaysa interface-ka shabakadda iridda. Marinka martida ee lagu rakibay gudaha instance-ka ma aha gelitaan ku jira shaxda marinka AWS, oo wax qiyaas ah oo strongSwan ah ma abuurayo mid.

Hagaha AWS ee ku saabsan marinka iyada oo loo marayo qalabka wuxuu qeexayaa bartilmaameedyada interface-ka shabakadda iyo shuruudda hubinta isha/goobka ee instance-ka gudbinaya. Ku xaddid beddelka hubintaas doorka iridda, oo ka tag instance-yada codsiga caadiga ah.

Ha beddelin marinka maxalliga ah ee VPC ama gelitaan kasta oo jira si aad u samaysato meel shabakad la ansixiyay ah. Baadh waxa xiran oo firfircoon, halkii ay tahay waxa bogga console-ka muujinayo shaxda marinka aan qofna isticmaalin. Laba shax oo isku mid ah ayaa yeelan kara xiriirro kala duwan. Tan muhiimka ah waa tan subnet-ka culeyska shaqada ku xiran yahay.

Tallaabo 2: ku shid gudbinta martida

sysctl -w net.ipv4.ip_forward=1
# persist in /etc/sysctl.d/ and re-apply after reboot

Kernel-ku waa inuu gudbiyaa, oo firewall-ka host-ka waa inuu oggolaadaa gudbinta. Ku dar xeerarka gudbinta ee loogu talagalay horgalaynta culeyska shaqada iyo tan fog halkii aad aqbali lahayd wax kasta, oo xaqiiji in subnet-ka iriddu uu haysto waddo gaadiid oo la isticmaali karo taraafikadiisa.

Kooxaha amniga ayaa ah meesha tallaabadani inta badan ku hakato. Qalabka dhexe ma dhaxlo habdhaqanka tixraaca kooxda amniga ee isgaadhsiinta tooska ah ee instance-yada, sidaas darteed xeer laga soo guuriyay tusaale Client VPN la maareeyo ayaa laga yaabaa in aanu waligiis u dhigmin. Hubi kooxda amniga iyo ACL-ka subnet-ka waddada dhabta ah, labada jiho.

Tallaabo 3: ballaadhi xulayaasha ilaha dhabta ah

Siyaasad ku hadlaysa oo kaliya 10.60.1.10/32 dhinaca AWS waxay sharraxaysaa guul ka timid iridda iyada oo aan ku hadlin 10.60.2.20. Waddo ku wajahan goobta fog ma ballaadhineyso xulaasha taraafikada, oo taasi waa qaybta labaad ee isla yaabkaas.

swanctl --list-sas
# read the installed CHILD-SA local and remote traffic selectors

Haddii nashqadda la isku raacay ay ilaaliso VPC oo dhan, labada dhinac waa inay aqbalaan 10.60.0.0/16 iyo 10.90.0.0/24. Haddii ay ilaaliso hal culeys shaqo, si ula kac ah u isticmaal horgalaynta cidhiidhiga ah. Si kastaba ha ahaatee, baadh siyaasadda CHILD-SA ee la rakibay, sababtoo ah qaabeynta aad tafatirtay iyo dhinac si kale u cidhiidhiyay ma aha heshiis isku mid ah.

Goobta fog sidoo kale waa inay u mariso jawaabaha ilaha VPC ee la kaydiyay dib uga soo mara iridda IPsec ee loogu talagalay. Hayso ka-tagidda NAT ee la taageeray taraafikada la ilaaliyay halka ay jiraan xeerar kale oo NAT isha; in culeys shaqo aan la ansixin loo tarjumo ciwaan host la oggol yahay waa heshiis aqoonsi kale, ma aha waddo gaaban oo loo maro gelitaanka aad rabtay.

Tallaabo 4: xaqiiji, ka dibna dib u celi haddii loo baahdo

Ka tijaabi culeyska shaqada laftiisa iyada oo la isticmaalayo hawlgalka codsiga cusub ee la oggol yahay, ka dibna ku celi goob fog oo ay tahay in laga reebo. Qor ciwaanka isha ee ay aragto adeegga fog iyo waddada soo noqodka ee ay isticmaasho. Ping iridda ama xaaladda IKE oo cagaar ah ma aha tijaabadaas.

Haddii culeyska shaqadu weli ku guuldareysto inta iriddu shaqeyneyso, dib ugu noqo tallaabooyinka sida ay u kala horreeyaan: xulaash, ka dibna gudbin iyo kooxaha amniga, ka dibna shaxda marinka ee xiran. Mid kastaa wuxuu leeyahay calaamad gaar ah, oo qiyaasidda waxay ka boodaa tan run ahaantii khaldan.

Dib u celintu waxay rogtaa isla nidaamkaas. Ka saar marinka subnet-ka culeyska shaqada ugu dambeeya, ka dib markaad soo celiso xulayaashii hore, si aadan uga tagin subnet tilmaamaya irid aan hadda ilaalinaynin ilahaheeda. Martigelinta kelida ah waxay u adeegi kartaa wax ka badan host-ka iridda marka heshiisyadaas jiraan, oo Site-to-Site VPN ee AWS maamusho waa qaab hawleed kale oo strongSwan uu ku fadhiyi karo dhinaca iridda macmiilka.