I-tunnel ephelele ye-Access Server ku-EC2: kungani ibhokisi elilodwa lokuhlola linganele

Ukucisha ukuhlolwa komthombo nendawo ekuyiwa kuyo kudivayisi ye-EC2 yimpendulo ephindwa kakhulu emibuzweni mayelana nokuphuma kwe-Access Server ku-inthanethi, futhi iyodwa ayenzeli amaklayenti akho lutho. Ukuhlolwa kuwumkhawulo wokudlulisa we-AWS: kwenza idivayisi yamukele amaphakethe omthombo noma indawo ekuyiwa kuyo okungewona ikheli layo. Akutsheli iklayenti ukuthi lithume ithrafikhi ye-inthanethi ngomhubhe, akudali indlela eya phezulu futhi akungezi i-NAT. Inganekwane iwukuthi ibhokisi lokuhlola liwukusebenza ngokwakho.

Ukuhlolwa kulawula ini ngempela

Yonke i-interface yenethiwekhi ye-EC2 ilahla ithrafikhi engathunyelwanga kuyo, ngaphandle uma idivayisi isebenza njenge-router, idivayisi ye-NAT noma isango le-VPN futhi uwucishile lowo mkhawulo. Ukuwucisha kunikeza imvume yokudlulisa. Imvume ayisiwo ukulungiselela: idivayisi isadinga indlela eya esangweni le-inthanethi noma kudivayisi ye-NAT, ithebula lemizila ye-VPC isadinga umugqa ohambisanayo, amaqembu okuphepha kumele avume ukugeleza, futhi iseva kumele ihumushe noma ihambise ithrafikhi ebuyayo.

Hlola inani lamanje nge-aws ec2 describe-instance-attribute --instance-id i-0123456789abcdef0 --attribute sourceDestCheck ngaphambi kokushintsha noma yini. Uma ulishintsha kukhonsoli, lishintshe ngoba idivayisi idlulisela abanye, hhayi ngoba iklayenti alifinyeleli i-inthanethi.

Inqubomgomo yomzila weklayenti ingeyakwa-Access Server

Ku-Access Server 3, vula i-Access Controls futhi uthole isigaba se-Internet Access and DNS. Ukukhetha kwe-Internet Gateway kunikeza i-tunnel ephelele noma ehlukanisiwe; i-tunnel ephelele itshela iklayenti ukuthi lihambise ithrafikhi yalo ezenzakalelayo phakathi kwe-VPN, i-tunnel ehlukanisiwe ishiya ithrafikhi ye-inthanethi endleleni yendawo yeklayenti. Gcina futhi usebenzise ngomgudu wokusebenza womkhiqizo, bese uxhuma kabusha iklayenti lokuhlola, ngoba inqubomgomo ilethwa ngesikhathi sokuxhumana.

Izinguqulo ezindala zisebenzisa amamenyu ahlukene futhi ezinye izakhiwo ze-Community OpenVPN azinakho ukulawula okulinganayo. Hlola inguqulo enkulu efakiwe ngaphambi kokufuna isikrini esingekho. Bese uqinisekisa ukuthi iklayenti lathola ini: iphrofayela ye-tunnel ephelele kufanele ifake umzila ozenzakalelayo ngomhubhe, futhi iphrofayela ye-tunnel ehlukanisiwe akufanele yenze lokho.

Landela iphakethe ngemuva komhubhe

Uma iklayenti selithumele ithrafikhi ye-inthanethi emhubheni, iseva kufanele iyidlulise futhi ngokuvamile iyihumushe. I-Access Server ilawula imithetho yayo ye-NAT nemizila, ngakho funda ukulungiselela okusebenzayo esikhundleni sokwengeza imithetho ye-Community OpenVPN kumafayela akhiwe; imithetho engalawulwa iyasuswa noma ishayisane ekubuyekezweni komkhiqizo okulandelayo. I-sudo iptables -t nat -L -n -v noma okulingana nayo ku-nftables kukhombisa okuhunyushwayo ngempela.

Uhlangothi lwe-AWS luwumzila ohlukile. Idivayisi esebenzisa isethi engaphansi yomphakathi ifinyelela isango le-inthanethi ngqo futhi igcina ikheli layo lomphakathi noma i-IP enwebekayo. Idivayisi esebenzisa isethi engaphansi eyimfihlo idinga umzila oya esangweni le-NAT noma kudivayisi ye-NAT, futhi idivayisi ye-NAT idinga umzila wayo oya esangweni le-inthanethi. Ukuxhuma isango le-inthanethi ku-VPC ngokwako akunikezi noma yimuphi umthombo oyimfihlo ikheli lokubuya lomphakathi, yingakho ukulungiselela okufanayo kwe-Access Server kusebenza kwesinye isethi futhi kuhluleke buthule kwesinye.

Hlola ithebula lemizila elihlobene nesethi engaphansi yedivayisi, hhayi ithebula eliyinhloko le-VPC kuphela. Ukuhlobana kwamasethi angaphansi kudlula ithebula eliyinhloko, futhi ukuhlobana okudala kuyisizathu esivamile sokuthi ukulungiselela obekusebenza kume ngemuva kokwakhiwa kabusha.

Gcina ukuphuma kwe-IP ne-DNS kuhlukene

Hlola ikheli elibhaliwe kuqala, bese igama, kusuka kuhlelo lokusebenza lweklayenti elifanayo. Uma i-curl -4 https://checkip.amazonaws.com ibuyisela ikheli lomphakathi kodwa amagama ama-host ehluleka, i-tunnel nomzila we-NAT kuyasebenza futhi inkinga ise-DNS: isixazululi esithunyelwe, isimo sesixazululi seklayenti, noma iqembu lokuphepha elivimbela isixazululi. Izilungiselelo ze-DNS ze-Access Server zikuso kanye isifunda se-Internet Access, kodwa zihamba ngomzila wekhodi ohlukile.

Qhathanisa ikheli elibuyisiwe nokuphuma obukuhlosile. Uma kuyikheli lomphakathi ledivayisi, ithrafikhi ihunyushwa yidivayisi; uma kuyikheli lesango le-NAT, kusetshenziswa umzila wesethi engaphansi eyimfihlo. Kokubili kungase kulungile. Ongakwazi ukuphetha ngakho ukuthi isiphequluli esiseva sifakazela ukudluliswa kweklayenti.

Ungavumeli ibhokisi elilodwa livala uphenyo

I-IPv6 iyisinqumo esihlukile. Inqubomgomo ye-tunnel ephelele ye-IPv4 ayisho lutho mayelana nokuthi i-IPv6 iyathwalwa, iyavinjwa noma iyavuza, futhi iklayenti elinezingqimba ezimbili lingaqhubeka lisebenzisa umzila wendawo we-IPv6 ngenkathi i-IPv4 isemhubheni. Hlola umndeni wekheli okukhathaza ngempela, futhi unqume ngokucacile ukuthi omunye kufanele ucishwe yini.

Ekugcineni, hlola isimo sokunqanyulwa. Ukukhetha i-tunnel ephelele kuchaza inqubomgomo yomzila ngenkathi uxhumekile, hhayi okwenzeka uma i-tunnel iwa. Uma imfuneko iwukuthi akukho thrafikhi ephunyuka ngaphandle kwe-VPN, lowo umbuzo we-kill-switch nomthombo womlilo, futhi udinga ukuhlolwa kwawo esikhundleni sokucabanga okuvela kuthebula lemizila.