I-DNS ku-AWS Client VPN: sebenzisa i-resolver ye-VPC, hhayi i-subnet

I-endpoint ise-10.0.8.0/24, ngakho i-resolver kufanele ibe yi-10.0.8.2. Lesi yisizathu engisizwa kakhulu, futhi asilungile kabili. I-Route 53 Resolver iphendula endaweni eyinhloko ye-IPv4 ye-VPC kanye nambili, okuthi ku-VPC ye-10.0.0.0/16 kube yi-10.0.0.2, noma iyiphi i-subnet esetshenziswa yi-endpoint. Iphutha lesibili lithule kakhulu: ukubeka ikheli elifanele ku-endpoint akusho ukuthi uhlelo lokusebenza lweklayenti luzoke likubuza okuthile. Womabili amaphutha anikeza uphawu olufanayo: ukuxazululwa kwamagama kuyasebenza kwamanye amaklayenti kodwa kwehluleka kwamanye.

Inganekwane iqala ekuxhumaneni kwe-subnet

Ukuxhumana kumayelana nokuthi ama-elastic network interfaces okuxhumana kwamaklayenti akhona kuphi, hhayi ukuthi iyiphi ikheli le-resolver ekhona. Ama-subnet e-endpoint anikeza amaklayenti ikheli ngaphakathi kwe-VPC, futhi awakho i-resolver yawo ngayinye.

Uma uhlukanisa le mibono emibili, izibalo ziyeka ukuba yimfihlo futhi ukuxazulula izinkinga kudlulela eklayentini, lapho iningi lalezi zigameko liphelela khona ngempela.

Bala ikheli kusuka endaweni eyinhloko ye-VPC

Thatha i-CIDR eyinhloko ye-IPv4 ye-VPC bese ufaka okubili ekhelini lenethiwekhi. 10.0.0.0/16 inikeza i-10.0.0.2, i-172.31.0.0/16 inikeza i-172.31.0.2, futhi i-VPC enendawo yesibili igcina i-resolver endaweni eyinhloko. I-subnet ye-10.0.8.0/24 ngaphakathi kuleyo VPC ayiyisusi. Bhala ikheli eceleni kwe-VPC ID ngaphambi kokuthinta i-endpoint, ngoba le nombolo iyisici se-VPC hhayi sokuxhumana.

I-VPC iphendula futhi ekhelini le-link-local 169.254.169.253. Lelo kheli liyafinyeleleka ngaphakathi kwe-VPC, kodwa akulona indawo evamile yomzila yekhompyutha ephathekayo ngaphesheya komhubhe.

Ngakho kunamakheli amabili e-resolver avumelekile, futhi alikho nelilodwa lawo eliyi-subnet kanye nambili.

Okwenza isethingi ye-endpoint nokungakwenzi

I-endpoint ye-Client VPN inezinkambu zeseva ye-DNS, futhi lapho i-console inikeza ukukhetha kwe-resolver ye-VPC igcwalisa umqondo ofanayo. Ukuzisetha kushintsha lokho okuyikho okunikezwa yisevisi emaklayentini ngesikhathi sokuxhuma. Akushintshi lokho okwenziwa yiklayenti le-OpenVPN elingaphethwe ngalelo nani, ngoba iklayenti kusamele liyisebenzise ohlelweni lokusebenza. Kulo msantshwe kuqhamuka «kukhanda ku-Mac yami kodwa hhayi kubhokisi le-Linux».

Ku-Linux ukuhlanganiswa kwe-resolver kuphethwe umphathi wokuxhuma hhayi umsebenzisi. Ukuhlela i-/etc/resolv.conf ngesandla kufakazela ukuthi ikheli liyasebenza esikhathini esisodwa bese linyamalala lapho uxhuma kabusha — yingakho izigameko eziningi ezilungisiwe zibuya ngakusasa ekuseni.

Hlola i-resolver esebenzayo kuklayenti ngemva kokuxhuma, hhayi ikhasi lokulungiselela le-endpoint.

I-split tunneling ingahlula i-resolver efanele

Nge-split tunneling kusetshenziswa kuphela imizila efakwe emhubheni. Uma ikheli le-resolver lingamboziwe ngumzila, umbuzo uphuma ngobuso lwendawo futhi i-router yasekhaya iyaphendula. Ikheli eliku-endpoint lisalungile futhi ukusesha kusahluleka. Faka umzila we-resolver, bese uhlola futhi.

Izindawo zasendaweni ezigqagqene zinikeza umphumela ofanayo ngendlela embi kakhulu: umbuzo uyaphendulwa, kodwa iseva engalungile.

Ungavuli ama-security groups ekhelini le-Amazon DNS

Umzwelo uma ukusesha kuphelelwa yisikhathi ukwengeza umthetho ovumela i-UDP 53 ekhelini le-resolver. I-AWS ibhala ukuthi ama-security groups nama-ACL enethiwekhi awakuhlungi ukugcwala kwe-Amazon DNS njengoba kuhlunga ukugcwala okuya ku-DNS instance yakho. Ukuvula leyo mithetho akushintshi lutho ku-resolver ye-VPC futhi kwandisa umngcele ngaphandle kwesizathu. I-resolver oyisebenzisayo wena iyisigameko esihlukile futhi idinga imithetho yayo ngempela.

Uma kokubili kuvela kumklamo wakho, hlola ukuthi iklayenti likhomba kukuphi ngempela ngaphambi kokuhlela noma yimuphi umthetho.

Qinisekisa indlela, bese ukala okunye

Xazulula igama lomphakathi, xazulula igama eliyimfihlo elibhaliswe endaweni ephethwe ngasese exhumene ne-VPC, futhi phakathi kwazo funda i-resolver esebenzayo yeklayenti. Leyo landelano yehlukanisa «ikheli le-resolver alilungile» ku-«indawo ayixhunyiwe» kanye naku-«iklayenti lishaye indiva isethingi». Ngayinye inokulungiswa okuhlukile, futhi akukho nesisodwa esiyinkinga ye-throughput.

Ukusesha okuphumelelayo akusho lutho ngesivinini sokudlulisa esiqhubekayo, ngakho hlukanisa lezi zingxoxo ezimbili uma ubika.