I-AWS Client VPN ixhunyiwe, kodwa i-EC2 ayiphenduli

I-laptop yami ikhombisa ukuthi ixhunyiwe. Iklayenti le-AWS Client VPN likhombise isimo salo esiluhlaza, i-endpoint yabhala iseshini, futhi nokho angikwazanga ukuvula imbobo ye-MongoDB ku-EC2 instance kusubneti eyimfihlo. Akukho okwakubonakala kugobile: isitifiketi sasivumelekile, iphrofayili yaqhamuka kukhonsoli, futhi itheneli yayithwala ithrafikhi. Iphutha kwakungelami, ngoba ngangifunda ukuxhunyiwe njengokugunyaziwe.

Ukungena kuphendula umbuzo owodwa nje: ingabe lobu bunjalo bungasungula iseshini? Konke okulandela lokho kunqunywa imithetho ehlukile engakaze ibone isitifiketi sakho. Iseshini eqinisekisayo kanye nephakethe elifikayo kuyimpumelelo emibili ehlukile, futhi igebe phakathi kwazo yilapho izikhalazo eziningi zohlobo lwe-VPN ivuliwe kodwa umsingathi akafinyeleleki zihlala khona.

Izinto zokuhlola ezingezansi yiwo ukulandelana engikulandela manje.

Yini iseshini exhunyiwe ekufakazelayo ngempela

Ngesikhathi sokuxhawulana i-endpoint iqinisekisa isitifiketi sekhlayenti ngokuqondene ne-trust store yayo, noma iqondisa isiphequluli kumhlinzeki wakho wobunjalo lapho i-SAML ilungiselelwe. Uma lokho kudlula, ikhlayenti lithola ikheli elivela ku-CIDR yekhlayenti ye-endpoint futhi ikhonsoli ikhombisa ukuxhumana okusebenzayo. Akukho sikhathi kulokho kushintshana lapho kudingwa khona ukuthi ungafinyelela yini ku-10.0.4.17 embobeni engu-27017.

Imvume yendawo oya kuyo iyinto ehlukile ku-endpoint. Yonke imigudu iqhathaniswa nemithetho yegunya, futhi ngamunye uhlanganisa i-CIDR yendawo oya kuyo neqembu okunikezwe lona umthetho. Lapho kungekho mthetho ohlanganisa indawo oya kuyo, i-endpoint iyamukela iseshini bese ilahla ithrafikhi. Akukho bhanela, akukho mjikelezo wokuxhuma kabusha, futhi akukho lutho kusixhumi sinokusebenza sekhlayenti esithi kunqatshiwe.

Qhathanisa umthetho wegunya nomthombo, hhayi ne-VPC

Bhala imithetho bese uyibeka eceleni kwekheli isakhiwo esinalo ngempela:

aws ec2 describe-client-vpn-authorization-rules \
  --client-vpn-endpoint-id cvpn-endpoint-0a1b2c3d4e5f6a7b8

Umphumela ukhombisa i-CIDR yendawo oya kuyo kanye ne-ID yeqembu kumthetho ngamunye. Kukhona ukwehluleka okubili okucashile kuwo. Umthetho ungagunyaza i-10.0.0.0/16 kuyilapho isakhiwo sikwi-VPC ehlanganiswe nge-peering ku-10.1.0.0/16; umzila we-peering ukhona, kodwa akekho obhale umthetho wegunya lwebanga lesibili. Noma umthetho ukhomba eqenjini lohlu lwamabhuku umsebenzisi angilungu lalo kuhlu, kodwa hhayi eqenjini elihlolwa yi-endpoint.

Bhala umthetho omncane kakhulu ohlanganisa indawo oya kuyo, futhi wengeze owesibili kuphela lapho i-CIDR yesibili idingeka ngempela. Umthetho obanzi we-0.0.0.0/0 ovela ekuqaliseni okusheshayo uyasebenza, futhi yikho lokho okwenza uhlale uze ufike ekukhiqizeni futhi ufihle imodeli.

Amathebula amabili emizila anquma ukuthi iphakethe liyahamba yini

Umzila we-endpoint uhlanganisa i-CIDR yendawo oya kuyo neyodwa yezisubneti i-endpoint exhumeke kuzo. Leyo yingxenye yendlela. Ithebula lemizila lesubneti ngokwalo kusamele lazi ukuthi lingadlulisela kanjani iphakethe phambili, futhi lokho kubalulekile lapho indawo oya kuyo ingemuva kokuxhumana kwe-peering, kwe-transit gateway noma kwebanga lasekhaya elifinyeleleka ngetheneli le-site-to-site.

aws ec2 describe-client-vpn-routes \
  --client-vpn-endpoint-id cvpn-endpoint-0a1b2c3d4e5f6a7b8

Funa umzila okufana kwawo indawo oya kuyo ne-CIDR yomthombo futhi umgomo wawo kuyisubneti exhunyiwe. Uma umzila ungekho, wengeze. Uma ukhona futhi umsingathi uthule, igebe liseceleni kwe-VPC, ngakho qhathanisa nethebula lemizila lesubneti yokuxhumana.

Isilungiselelo esisodwa ohlangothini lwekhlayenti sehlukanisa umzila ngaphandle kokuhlukanisa itheneli: iphrofayili equkethe i-route-nopull. Leso siyalo sitshela ikhlayenti elisekelwe ku-OpenVPN ukuthi lishaye indiva imizila eyiswa iseva, ngakho isixhumi sikhasa kuphela ngekheli le-endpoint uqobo futhi indawo oya kuyo ayinawo umzila nhlobo. Hlola nge-ip route show ku-Linux noma nge-netstat -rn ku-macOS ukuthi ukhona yini umzila onqamula isixhumi se-tun. Uma ungekho, susa i-route-nopull kuphrofayili ekhishiwe bese uxhuma kabusha ukuze imizila eyisiwe isebenze.

Amaqembu okuvikeleka awaliboni ikheli lekhlayenti lakho

Le yingxenye engayenza ngokungalungile ingxenye yosuku. Ku-endpoint ye-IPv4 exhumene nesubneti, isevisi ihumusha ikheli lomthombo lekhlayenti laba ikheli lesixhumi senethiwekhi se-endpoint kuleyo subneti. Iphakethe elifika esakhiweni alithwali ikheli ikhlayenti lakho elalikhombisa, ngakho umthetho weqembu lokuvikela ovumela ichibi lamakhlayenti, ake sithi 172.16.0.0/22, awuhambisani nalutho.

Vumela imbobo isuka eqenjini lokuvikela le-endpoint, elixhunywe esixhumini sokuxhumana, hhayi isuka ku-CIDR yekhlayenti. Ukubhekisela eqenjini kuqinile kunokufaka ikheli ngamandla, ngoba ikheli lesixhumi akulona elakho ukulilawula. Ama-ACL enethiwekhi awanazo izimo, ngakho lapho kukhona okufakiwe okukhethekile, kokubili ukuqondisa kokungena nokuphuma kufanele kuvume ukugeleza.

Xhuma futhi nekheli langasese lesakhiwo. I-IP yomphakathi ikhipha iphakethe ku-VPC bese ilibuyisela ngaphakathi ngomunye umzila oneminye imithetho, ngakho ukuhlola ngekheli lomphakathi akusho lutho ngomzila wangasese.

Ukulandelana kokwehlukanisa okuma ekwehlulekeni kokuqala

Dabula lezi ngokulandelana futhi ume lapho okukodwa kwehluleka khona. Isinyathelo ngasinye sisusa isendlalelo esisodwa, hhayi zonke.

1. Qinisekisa ukuthi iseshini isebenzise buphi ubunjalo nokuthi i-endpoint ihlola liphi iqembu. Isitifiketi esivela ku-trust store eyodwa asisona isiqu esifanayo njengesimemezelo se-SAML esivela kuhlu lwamabhuku.
2. Qinisekisa ukuthi umthetho wegunya uhlanganisa i-CIDR yomthombo yalelo qembu.
3. Qinisekisa ukuthi umzila we-endpoint ukhona futhi uqondise esubnetini exhunyiwe, bese uqinisekisa ukuthi ithebula lemizila lesubneti lingadlulisela phambili.
4. Qinisekisa ukuthi iqembu lokuvikela livumela imbobo isuka esixhumini se-endpoint hhayi esuka echibini lamakhlayenti.
5. Hlola ngaphakathi kwe-VPC, ngeseshini ye-SSM kwesinye isakhiwo kuleyo subneti, ukuze uhlukanise inkinga yohlelo lokusebenza nenkinga yomzila wekhlayenti.

Lapho izinyathelo zinganqumi, yileli thebula engithembela kulo:

Imininingwane emibili ye-akhawunti ikhiqiza izimpawu ezibonakala njengokwehluleka kwemvume. Umsebenzisi ngamunye udinga isitifiketi sekhlayenti esihlukile; ukwabelana ngesisodwa phakathi kwemishini emibili kwenza amaseshini acindezelane, futhi umphumela uba umjikelezo wokuxhuma kabusha, hhayi ukunqatshwa. Lapho kwakhiwa i-endpoint entsha, ikhonsoli ikhombisa igama le-DNS amanye amavesi ekhlayenti alivumayo kuphela ngesiqalo esingahleliwe esikhonjiswe ekhasini le-endpoint, ngakho kopisha igama eliphelele esikhundleni sokulakha kabusha.

Uma isinyathelo sesihlanu sikubamba, donsa ilogi yokuxhumana ye-endpoint futhi ufunde okufakiwe kwegunya ngaphambi kokushintsha noma yini. Ilogi isho indawo oya kuyo ehloliwe kanye nomthetho ohambisanayo noma ongahambisani, futhi lokho kunciphisa umbuzo wezingqimba ezine ube impendulo eyodwa.