I-AWS Client VPN ixhunyiwe kodwa ayikho i-internet: ukuhlolwa kwemizila

I-AWS Client VPN ixhunyiwe kodwa ayikho ukufinyelela ku-internet? Hlola imizila yeklayenti, ukugunyazwa kwendawo yokugcina, ukuphuma kwesubneti kanye ne-DNS ngalolo hlelo.

Uxhumene nendawo yokugcina ye-AWS Client VPN, isubneti yangasese iyaphendula, kodwa ikhasi ngalinye lomphakathi liphetha ngokuphelelwa yisikhathi. Le nhlanganisela inciphisa inkinga kwenye yezinto ezintathu ohlangothini oluphethwe: umzila okufakwa yiklayenti, umzila wendawo yokugcina kanye nomthetho wayo wokugunyaza, noma ukugxuma okulandelayo kwesubneti exhunyiwe. Ngihlola lezi ngalolo hlelo ngoba ukwehluleka ngakunye kubonakala ngendlela ehlukile kuklayenti. Lo mhlahlandlela ukhuluma ngendawo yokugcina ephethwe exhunywe ne-VPC, hhayi iseva ye-OpenVPN kusikhathi se-EC2 futhi hhayi ukuxhumana kwe-Cloud WAN noma i-Transit Gateway.

Qala ngalokho iklayenti elikuhambisa ngempela

Isimo sokuxhumana sifakazela isikhathi se-TLS nokwabiwa kwe-CIDR kuklayenti, akukho okunye. Buza uhlelo lokusebenza ukuthi ikheli lomphakathi lizoya kuphi ngenkathi umhubhe uvuliwe. Ku-Linux, ip route get 1.1.1.1 kufanele ibale isixhumi somhubhe; ku-macOS, netstat -rn -f inet | head -5 ikhombisa okungenisiwe okuzenzakalelayo; ku-Windows, Find-NetRoute -RemoteIPAddress 1.1.1.1 iphrinta isixhumi esikhethiwe nokugxuma okulandelayo.

Bese ufunda ifulegi le-split-tunnel, ngoba yilo elinquma ukuthi imizila eshicilelwe yindawo yokugcina iyizindawo kuphela iklayenti elizithumela emhubheni:

aws ec2 describe-client-vpn-endpoints \
  --client-vpn-endpoint-ids cvpn-endpoint-0123456789abcdef0 \
  --query 'ClientVpnEndpoints[0].SplitTunnel'

Lapho SplitTunnel kungu-true, indawo yomphakathi isebenzisa umhubhe kuphela lapho indawo yokugcina ishicilela umzila oyimbozayo, ngakho 0.0.0.0/0 engekho ishiya lokho kuthutha kusixhumi sasendaweni. Uma kungu-false, iklayenti libamba ukuthutha, kodwa indawo yokugcina kusafanele iwuhambise futhi iwugunyaze; uma kungenjalo amaphakethe angena emhubheni futhi ayeke lapho. Xhuma kabusha iklayenti ngemva kokushintsha noma yikuphi kwalokhu kulungiselelwa okubili, ngoba imizila namaseva e-DNS anikezwa ngesikhathi sokuxhumana futhi iklayenti elisebenzayo lingagcina isethi yakudala.

Funda umzila wendawo yokugcina nomthetho wokugunyaza ngokwehlukana

Lezi zinto ezimbili, futhi ukwakha enye akwakhi enye. Bhala imizila yendawo yokugcina bese ufuna umzila ozenzakalelayo okuyi-subneti exhunyiwe umgomo wawo:

aws ec2 describe-client-vpn-routes \
  --client-vpn-endpoint-id cvpn-endpoint-0123456789abcdef0

Wonke umzila unesubneti eyodwa yomgomo, ngakho ukuxhumana okuthathu kudinga umzila ozenzakalelayo ohambisanayo komunye nomunye. I-AWS ibhala le mfuneko yokumboza, futhi uphawu olusebenzayo lwesikhala umsebenzisi osebenza esubnetini eyodwa ahluleke kwesinye, okufundwa njengokwehluleka kwezikhathi ezithile esikhundleni somzila ongakho. Imibhalo yesimo se-Client VPN esemthethweni ichaza ukuhlelwa kwesubneti yomphakathi okungokwale mizila.

Ukugunyaza kuyinto yesibili. Lapho kungekho mthetho ohlanganisa indawo yomphakathi, umhubhe uthwala iphakethe bese isevisi ilihlakaza, ngakho izinsiza zangasese ziyaqhubeka zisebenza kuyilapho i-internet ingasebenzi:

aws ec2 describe-client-vpn-authorization-rules \
  --client-vpn-endpoint-id cvpn-endpoint-0123456789abcdef0

Umthetho we-CIDR ye-VPC awusho lutho mayelana 0.0.0.0/0. Ukwengeza izingxenye ezingekho kumhubhe ogcwele kusho umzila owodwa esubnetini ngayinye exhunyiwe kanye nomthetho wokugunyaza ongawuhlola kamuva:

aws ec2 create-client-vpn-route \
  --client-vpn-endpoint-id cvpn-endpoint-0123456789abcdef0 \
  --destination-cidr-block 0.0.0.0/0 \
  --target-vpc-subnet-id subnet-0a1b2c3d4e5f67890
aws ec2 create-client-vpn-authorization-rule \
  --client-vpn-endpoint-id cvpn-endpoint-0123456789abcdef0 \
  --destination-cidr-block 0.0.0.0/0 \
  --access-all \
  --description "internet egress for full tunnel"

--access-all unikeza umgomo kuklayenti ngalinye lendawo yokugcina, ngakho gcina kuphela ngesikhathi umhubhe kufanele ugcwale; umthetho oboshelwe eqenjini lencwadi uyingcono lapho uneqembu ongalibopha.

Landela iphakethe ngaphandle kwesubneti exhunyiwe

Umzila wendawo yokugcina unquma ukuthi i-AWS inikeza iphakethe kuleso subneti. Awunqumi ukugxuma okulandelayo ngemva kwalokho, okuhlala kuthebula lemizila ye-VPC yesubneti uqobo:

aws ec2 describe-route-tables \
  --filters Name=association.subnet-id,Values=subnet-0a1b2c3d4e5f67890 \
  --query 'RouteTables[].Routes[?DestinationCidrBlock==`0.0.0.0/0`]'

Umzila ozenzakalelayo osebenzisekayo ukhomba esangweni le-internet lesubneti yomphakathi, noma esangweni le-NAT lesubneti yangasese, futhi isimo blackhole sisho ukuthi umgomo ususiwe futhi indlela manje ifa buthule. Lawa ngamathebula ahlukile ohlwini lwemizila lwendawo yokugcina, futhi ukulungisa elilodwa akulungisi elinye.

Kule gxumo kuhlala izihlungi ezimbili. Iqembu lokuvikela elisetshenziswe ekuxhumaneni kwenethiwekhi yomgomo kufanele livumele ukuthutha okuphumayo okuya endaweni yomphakathi, futhi noma iyiphi i-ACL yenethiwekhi esebenzayo kufanele ivumele isicelo nokuthutha okubuyayo emachwebeni esikhashana. Iqembu lokuvikela lokuxhumana elivimbayo liyisizathu esivamile sokuthi ukufinyelela kwangasese kusebenze kuyilapho okomphakathi kungasebenzi.

Khetha ungqimba lokuqala ngophawu esikhundleni sokushintsha zontathu kanye kanye:

What you observeLayer to check first
No tunnel interface for a public IPClient route or split-tunnel flag
Tunnel interface chosen, request times outEndpoint route and authorization rule
Endpoint route present, still times outSubnet route table, association security group
Named host fails, numeric address worksDNS servers and their own authorization

Hlukanisa ukwehluleka kwe-DNS nomzila ofile

Ukuhumusha amagama kwehluleka ngendlela ehlukile kunokwedlulisela, futhi umhubhe ogcwele wenza umehluko ubaluleke ngoba isixazululi esiphushwayo manje sifinyelelwa ngomhubhe. Uma indawo yokugcina icacisa amaseva e-DNS e-VPC, amakheli awo adinga ukumbozwa komzila nokugunyazwa njenganoma iyiphi enye indawo. Buza isixazululi ngqo ukuze ubone ukuthi yikuphi ukwehluleka onakho: dig +short example.com @10.0.0.2, noma nslookup example.com 10.0.0.2 ku-Windows.

Lapho i-URL yenombolo iphendula futhi eyegama ingaphenduli, yeka ukuhlela umzila ozenzakalelayo futhi usebenze ku-DNS. Isicelo esiya ekhelini le-IP asifakazi lutho ngomsingathi wangempela onegama kanye nesitifiketi sakhe, ngakho gcina ukuhlolwa okukodwa okwegama ekuhloleni kokugcina.

Isikhathi siyasiza. Ukuxhumana kwe-TCP okungatholi impendulo phakathi namasekhondi ambalwa kukhombisa ukuhambisa noma isihlungi, kuyilapho isicelo esilenga ekufuneni igama sikhombisa isixazululi. Ukushintsha umzila ozenzakalelayo ngenkathi isixazululi singafinyeleleki kuvame ukwenza ukwehluleka okukodwa kube kubili.

Buyisela emuva ngokuhlanzekile, bese uqinisekisa indlela yokuphuma

Zombili izinto bezazengeza, ngakho ukubuyisela emuva ukususa hhayi ukulungisa:

aws ec2 delete-client-vpn-route \
  --client-vpn-endpoint-id cvpn-endpoint-0123456789abcdef0 \
  --destination-cidr-block 0.0.0.0/0 \
  --target-vpc-subnet-id subnet-0a1b2c3d4e5f67890
aws ec2 delete-client-vpn-authorization-rule \
  --client-vpn-endpoint-id cvpn-endpoint-0123456789abcdef0 \
  --destination-cidr-block 0.0.0.0/0 \
  --access-all

Xhuma kabusha bese uqinisekisa ukuthi ukuthutha kuphuma ngakuphi. Qhathanisa ikheli lomphakathi elibonwayo nekheli le-IP elinwebekayo lesango le-NAT, noma nesango le-internet obuhlela ukulisebenzisa, futhi uhlole ukuthi insiza yangasese isaphendula esikhathini esifanayo.

Qeda ngohlu olufushane, futhi thatha into yokugcina njengengxenye yoshintsho hhayi njengemibhalo:

  • Umzila 0.0.0.0/0 owodwa wendawo yokugcina esubnetini ngayinye exhunyiwe.
  • Umthetho wokugunyaza ohlanganisa 0.0.0.0/0 wamaklayenti ofuna ukuwasiza.
  • Umzila ozenzakalelayo we-VPC ongekho esimweni se-blackhole esubnetini ngayinye exhunyiwe.
  • Ukuphuma kweqembu lokuvikelela lokuxhumana, kanye nokuthutha okubuyayo kwe-ACL.
  • Amakheli esixazululi ahambisiwe futhi agunyaziwe, aqinisekiswa ngesicelo segama.
  • Ukubuyiselwa emuva okubhaliwe komzila nomthetho.

Umbhalo owodwa womkhawulo: lena indlela ye-IPv4. Iklayenti elinezingqimba ezimbili ligcina ukuxhumana kwe-IPv6 elinakho kakade, ngakho umzila ozenzakalelayo we-IPv6 uyisinqumo esihlukile esinokugunyazwa kwawo hhayi umphumela oseceleni walena.

Izihloko ezihlobene