Cinwaan kee ayuu firewall daruuro arkaa marka VPN-kaagu daaran yahay
Tunnel buuxa wuxuu beddelaa cinwaanka isha ee ay database-kaagu arko. Dhaqaajiso liiska oggolaanshaha, wadada gaarka ah ama tunnel-ka qaybsan, ma aha aqoonsiga.
Database shaqeeya ka hor inta uusan VPN-ku xidhmin oo fashilma ka dib, dhif ayaa ah dhibaato aqoonsi. Firewall-yada daruuraha waxay isbarbardhigaan cinwaannada isha, tunnel buuxaana wuxuu beddelaa kan ay isbarbardhigayeen. Farqiga u dhexeeya waxa aad u malaynayso in laptop-kaagu diro iyo waxa server-ku helo waa cilladda oo dhan, waxaana lagu cabbiri karaa hal tallaabo.
Cinwaanka ishu waxa uu noqdaa
Tunnel buuxa, packet kastaa wuxuu ka baxaa dhex mara gateway-ga VPN, sidaas darteed server-ku wuxuu arkaa cinwaanka bixidda gateway-ga halkii uu ka arki lahaa xiriirkaaga guriga. Haddii proxy hore u socda uu jidka ku jiro, cinwaankiisa ayaa yimaada. Labaduba waa ilo sharci ah, midkoodna ma aha cinwaanka ku jira qaanuunkaaga asalka ah.
Xeerarka firewall-ka Azure SQL ee heerka server-ka iyo heerka database-ka waxay isbarbardhigaan cinwaanka macmiilka gaara server-ka macquulka ah, taas oo tunnel buuxa ka dib ay tahay cinwaanka bixidda. Koox ammaan AWS oo oggolaata hal cinwaan ayaa sidaas oo kale u dhaqma. Packet-ka waa la tuuraa ka hor xaqiijinta, sidaas darteed khaladka soo noqdaa wuxuu u muuqdaa sida guuldarro shabakadeed halkii ay ahaan lahayd dhibaato fasax. Taasi waa sababta dadku u bilaabaan dib u dejinta furayaasha sirta.
Liiska oggolaanshaha meesha lagu go'aamiyo
Akhri qaanuunka u dhigma wadada fashilma, ma aha qaanuunka aad xasuusato inaad abuurtay. Ogaaw baaxaddiisa, dekeddiisa, borotokoolkiisa iyo haddii la qiimeeyo ka hor wax kasta oo hubin aqoonsi.
Kadib go'aanso lakabka si sharci ah u leh go'aankaas. Qaanuunka cinwaanku wuxuu ka jawaabaa halka taraafikadu ka timaado. Barta dhammaadka gaarka ah waxay ka jawaabtaa haddii adeegga lagu gaari karo wadada gaarka ah gabi ahaanba. Ka-reebista tunnel-ka qaybsan waxay ka jawaabtaa meelaha loo socdo ee ka gudba tunnel-ka. Lama beddeli karo, mid kastaa si ka duwan ayuu u fashilmaa marka tunnel-ku is beddelo.
Saddex hagaajin, saddex lakab
Ikhtiyaar kasta oo hoose wuxuu hagaajiyaa qulqulka sabab kale, doorashada qaldanna waxay soo saartaa xiriir shaqeeya ilaa isbeddelka gateway-ga xiga.
| Repair | Layer it changes | What it does not fix |
|---|---|---|
| Add the egress address to the rule | Source address matching | Nothing about routing, and it breaks when the egress moves |
| Use a private endpoint | Whether the service is reached privately | A client that still resolves the public name |
| Add a split-tunnel exception | Which flows bypass the tunnel | An expired credential or a wrong password |
Ku darista cinwaanka bixidda waa isbeddelka ugu yar iyo kan ugu jilicsan, sababtoo ah gateway cusub ama gobol kale ayaa si aamusnaan ah u burinaya. Diiwaangeli cinwaanka agtiisa qeexidda tunnel-ka si labaduba wada socdaan. Baaxad ballaaran oo ku meel gaar ah waa ogaal, ma aha hagaajin; meesha ku reebidda waa sida adeegyada gudaha ay ugu dambayntii u soo shaac baxaan.
Sababta platform maamulan aysan ugu biiri karin tunnel-ka
Platform-yada codsiga sida Heroku, AppHarbor ama CloudBees waxay koodkaaga ku socodsiiyaan deegaan aan lahayn qalab tun ama tap iyo aan lahayn awood ay ku abuuraan mid. Qaabkooda soo-dhexgalka waa HTTP ma aha socket dhageysan aan loo baahnayn. Buildpack-ka qaada binary VPN weli ma hayo meel uu interface-ka dhigo. Qaababka shaqeeya waa cinwaan bixid joogto ah oo database-ku oggolaan karo, badeeco xiriir gaar ah oo platform-ku bixiso, ama proxy ku jira DMZ oo HTTPS lagu gaaro.
Proxy-gaas waa waddo gelitaan leh xaqiijin iyo diiwaangelin u gaar ah. Ma ka dhigto platform-ka xubin VPN-kaaga, sharaxaaddaasna waxay soo saartaa xeerar aan cidna hubin karin.
Ka xaqiiji macmiilka fashilmay
Dib u xiriir oo ku celi wadada saxda ah ee macmiilka. Hubi cinwaanka isha ee adeeggu diiwaangeliyo, wadada uu macmiilku u doorto magaca database-ka, iyo natiijada wareysiga dhabta ah, isla nidaamkaas. Tijaabada laga sameeyo gateway-ga waxay caddeynaysaa in gateway-gu shaqeeyo, taas oo aan weligeed shaki ku jirin. Haddii xiriirku hadda la xaqiijiyo oo wareysigu wali fashilmo, dhibaatada hadhay waa fasaxa database-ka.
Dib u eeg xeerarkan mar kasta oo tunnel-ku is beddelo. Gateway la beddelay ama baaxad bixid cusub ayaa jebiya wadada iyada oo aan wax isbeddel ah lagu samayn habaynta codsiga.