Sababta EC2 uusan u gaari karin laptopkaaga AWS Client VPN
Client VPN waxay u tarjumtaa isha IPv4 ee macmiilka interface-ka endpoint-ka. Taasi waa sababta jawaabtu u shaqeyso, xiriir cusub oo ka yimaada EC2-na uusan u shaqeynin.
Laptop ku xiran AWS Client VPN wuxuu gaaraa application EC2 ah isagoo aan dhib la kulmin. Kadib waxaad isku daydaa lidka, EC2 ilaa ciwaanka macmiilka la siiyay, xiriirku wuu istaagaa ama waa la diidaa. Isku dheelli-tirnaan la'aantan ayaa dhif ah inay tahay qaanuun koox ammaan oo maqan. Endpoint Client VPN oo ku xiran subnet-yada VPC, AWS waxay u tarjumtaa isha IPv4 ee macmiilka interface-ka shabakada endpoint-ka, sidaas darteed ma jiro ciwaan VPC soo galaya oo matala laptopkaaga.
Ka bilow waxa qabashada muujinayso
Qabo qabasho hostka EC2 inta macmiilku xirmayo, oo akhri ciwaanka isha ee application-ku dhab ahaan arko. Haddii uu yahay interface-ka endpoint-ka dhinaca VPC oo aan ahayn ciwaan ka yimid barkada macmiillada, tarjumaadda waa la xaqiijiyay ka hor intaadan beddelin xitaa hal qaanuun.
Barkada macmiillada waa xadkii qoondaynta, ma aha subnet leh dariiqa soo noqodka. Farqigaas ayaa inta badan baaritaannadan ku khaldamaan.
Tarjumaadda sharraxaysa isku dheelli-tirnaan la'aanta
Saddex qulqul ayaa lagu qaldaa midba midka kale, oo kaliya midkood ayaa ah kan dadku tijaabiyaan.
| Flow | Started by | What the VPC sees | Outcome |
|---|---|---|---|
| Client to EC2 service | The client | A translated source at the endpoint interface | Works, with a stateful reply |
| EC2 host to client pool address | The EC2 host | A destination with no route and no translation state | No usable path |
| Client to client | A client, when the feature is configured | Traffic mediated by the endpoint | Works only with that feature and its authorisation |
Sharaxaadda qaybaha Client VPN waxay si cad u sheegtaa in isha IPv4 ee macmiilka loo tarjumo interface-ka endpoint-ka, taas oo ku filan in la arko sababta safka dhexe uusan wax u laaban karin.
Xiriir cusub wuxuu u baahan yahay dariiq, tallaabo xallinta ciwaanka iyo go'aan fasax. Xaaladda tarjumaadda ee kalfadhi qof kale ma bixiso midkoodna saddexdaas.
Sababta jawaabtu aanay ahayn xiriir cusub
Jawaabta TCP waxaa lagu barbardhigaa gelitaan jira, taas ayaa sababta dariiqa soo noqodku u shaqeeyo isagoo aan lahayn qaanuun soo gal ah. SYN cusub oo ka yimaada hostka EC2 ma haysto gelitaan uu la barbardhigo, sidaas darteed wuxuu noqdaa isku day bax ah oo caadi ah oo u jeeda meel VPC aanay garanayn sida loo gaaro.
Taas ayaa sidoo kale sababta sharraxaadda tan inay tahay taraafik hal jiho kaliya u socda ay marin-halayn tahay. Taraafikka soo noqodka ayaa si joogto ah u qulqula kalfadhiyadan. Qaybta aan dariiq lahayn waa bilowga.
Maxaa weli jebiya kalfadhi ay tahay inay shaqeyso
Kooxaha ammaanka, ACL-yada shabakada iyo firewall-ka laptopka laftiisu dhammaantood waxay muhiim u yihiin xiriirada ay tahay inay guuleystaan. Ping guuldareystay ayaa ugu yar sheegta, sababtoo ah siyaasadda ICMP inta badan waxay ka duwan tahay siyaasadda TCP ee aad danaynayso.
Qaanuunnadan u qor isha la tarjumay, ee ma aha ciwaanka macmiilka. Qaanuunnada ku xiran ciwaanka marnaba ka soo muuqan shabakada ayaa ah cilladda ugu badan ee qofka isagu keeno naqshaddan.
Marka VPC dhab ahaan tahay inuu bilaabo wada-hadalka
Haddii adeeg u baahan yahay inuu ogeysiiyo saldhig shaqo, rog jihada oo u ogolow macmiilka inuu hayo kanaal bax joogto ah oo adeeggu ka jawaabo. Haddii shabakad fog oo dhan ay tahay in laga gaari karo VPC, dooro naqshad daabacda horgalayaasheeda iyo siyaasadda gelitaankeeda halkii aad ka fikiri lahayd in Client VPN uu hore u sameeyo. Gelitaanka macmiil-ilaa-macmiil waa kiis saddexaad oo cidhiidhi ah, oo leh dariiqiisa iyo walxaha fasaxdiisa. Midkoodna ma aha kaliya sanduuq calaamadeed endpoint-ka jira.
Xadka sharaxaadda IPv4 sidoo kale si daacad ah u hay. Dukumeentiga AWS ee hadda jira wuxuu kala soocaa IPv6, halkaas oo tarjumaaddaas aan la dalban, iyo qaababka kale ee isku xirka oo si kale u jiheeya.
Ku tijaabi saddex tallaabo oo calaamaysan: macmiilku wuxuu furaa kalfadhi la ogolaaday, adeegga VPC ayaa ka jawaaba kalfadhaas, host VPC na wuxuu u furaa kalfadhi cusub macmiilka. In labada hore guuleystaan oo saddexaad guuldareysto waa qaabka la filayay naqshaddan, ma aha cillad lagu eryanayo qaanuunnada firewall.