I-CIDR yeklayenti ye-AWS Client VPN ayikwazi ukugqagqana nebanga le-VPC

Indawo yokugcina ye-AWS Client VPN isabalalisa amakheli eklayenti isuka ephulini olikhethayo, futhi i-AWS ihlola lelo phuli ngokuqhathanisa nenethiwekhi eqondiwe ngaphambi kokwakha indawo yokugcina. Ukuhlola akukhona ukuthi i-subnet ibonakala ingenalutho. Kukhona ukuthi iphuli liyagqagqana yini nebanga le-VPC, futhi impendulo iyafana noma ngabe i-EC2 instance isebenzisa lawo makheli namuhla noma cha. Ukugqagqana kuwumbuzo wamabanga, hhayi wokwabiwa.

Dlula ezihlokweni ezinhlanu zokuhlola ngokulandelana. Ma endaweni yokuqala ehlulekayo, ngoba asikho isinyathelo sakamuva esingalungisa isinqumo sangaphambilini.

Ukugqagqana ukuhlolwa kwamabanga, hhayi ukuhlolwa kwamakheli angenalutho

Qala ku-CIDR ye-VPC, hhayi ku-subnet ohlela ukuyixhuma. Iphuli lika-172.20.0.0/22 likhona ngaphakathi kwe-VPC ka-172.20.0.0/16 futhi liyanqatshwa ngisho nalapho kungekho subnet elihlalayo, ngoba ukugqagqana kuyisici samabanga, hhayi sezabelo zamanje. Bese wengeza izindawo lapho indawo yokugcina ihambisa khona: ama-VPC angabanye, i-transit gateway kanye namabanga endawo ngoxhumano lwe-site-to-site. Noma yiliphi ibanga iklayenti elingase lidinge ukufinyelela kulo lisekuhleni.

Ziqoqe zisuka ku-akhawunti, hhayi enkumbulweni: aws ec2 describe-vpcs --query "Vpcs[].CidrBlock", kanye namarekhodi etafula lomzila we-subnet ohlela ukuyixhuma.

Usayizi wephuli unqunywa ngaphambi kokwakha

I-AWS yamukela iphuli leklayenti le-IPv4 phakathi kuka-/22 no-/12 ku-Client VPN. U-/24 mncane kakhulu, u-/8 ungeyona ingxenye yebanga elibhaliwe, futhi womabili amaphutha avela ekukaleni iphuli njenge-subnet yomsebenzi. Likale ngokwamaklayenti alindelekile angaleso sikhathi kanye nendawo yokuphefumula, bese uyindilinga ku-prefix evunyelwe.

Hlola izibalo ngaphambi kokuzithayipha kukhonsoli, ngoba i-prefix ethayiphiwe kabi ishintsha usayizi wephuli ngaphandle kwesixwayiso:

python3 -c "import ipaddress; p=ipaddress.ip_network('172.16.0.0/22'); print(p.num_addresses, p.prefixlen, p.overlaps(ipaddress.ip_network('172.20.0.0/16')))"

Lokho kuphrinta inani lamakheli, ubude be-prefix kanye nokuthi umfakisicelo uyangqubuzana yini nebanga le-VPC, okuyashesha kunokucabanga ngama-netmask ekupheleni kwewindi loshintsho.

I-resolver inendima yayo yekheli

I-resolver ye-VPC iphendula ekhelini lesisekelo lebanga le-VPC kanye nambili, okungase kungabi ngaphakathi kwe-subnet oyixhumile. Ukucabanga ukuthi i-resolver kufanele ihlale kumaphuli eklayenti, noma ukwakha i-subnet ezungeze lelo kheli, kunezela izinto ngaphandle kokushintsha lutho. Okubalulekile ukuthi indawo yokugcina iphathe isethingi ye-DNS iklayenti elingayisebenzisa nokuthi i-resolver iyafinyeleleka isuka kuthambisa.

Rekhoda i-resolver, iphuli leklayenti kanye ne-subnet exhunyiwe njengezinto ezintathu ezihlukene kuhlelo lwamakheli. Zihluleka ngokuzimela, futhi ukuthi enye ilungile akusho lutho ngezinye ezimbili.

Izinkambu ezine ozibophezela kuzo ngesikhathi sokwakha

I-CIDR ye-IPv4 yeklayenti ibekwa ngesikhathi sokwakha. Ukushintsha iseva ye-DNS, ukwengeza uxhumano, ukushintsha iqembu lokuphepha, ukuhlela imithetho yokugunyaza noma ukushintsha imizila ye-split-tunnel konke kungukuhlela okuvamile, futhi akukho okushintsha igama lephuli. Lokho kungalingani yikona okwenza lokhu kufanele ukubuyekezwa: izilungiselelo ezishibhile yilezo ozofuna ukuzishintsha kamuva, futhi okubizayo yikho ozibophezela kukho kuqala. Funda incazelo yendawo yokugcina ngaphambi kokuhlela iwindi loshintsho.

Hlola indawo yokugcina esetshenzisiwe ngaphambi kokucabanga ukwakhiwa kabusha. I-aws ec2 describe-client-vpn-endpoints ibuyisela iphuli, i-DNS, ifulegi le-split-tunnel kanye nokuxhumana empendulweni eyodwa, okuvame ukwanele ukukhipha ukwakhiwa kabusha.

Shintsha indawo yokugcina esikhundleni sokuyilungisa

Indawo yokugcina entsha iyindawo yokugcina entsha, hhayi ukufuduka. Amaseshini akhona awadluleli kuyo, amaphrofayili eklayenti akhomba kwelinye igama, futhi zonke izilungiselelo obuzithatha njengeziyisisekelo kufanele zakhiwe kabusha: isitifiketi seseva, ukuqinisekisa, ukuxhumana, imizila, amaqembu okugunyaza, ukuloga. Qinisekisa ngeklayenti elilodwa ngokumelene nensizakalo eyimfihlo edingekayo nangokumelene nendawo okufanele yenqatshwe, bese wandisa ukufinyelela. Noma yini oyishiyayo iba yithikithi losekelo kamuva.

Gcina indawo yokugcina endala isebenza kuze kudlule lokho kuqinisekisa, futhi gcina indlela yokuphatha engathembeli kwentsha.

Umngcele owodwa okufanele ushiwo: lokhu kuhlanganisa iphuli leklayenti le-IPv4. Izilungiselelo zethrafikhi ye-dual-stack ne-IPv6 ku-Client VPN zilandela imodeli yazo yamakheli, ngakho-ke ungakopishi lolu hlu ngaphandle kokufunda imibhalo yalowo modo.