I-DNS yesiphetho se-AWS Client VPN: kungani ukugxilisa i-IP exazululiwe kuhluleka
Shintsha igama lesiphetho se-AWS Client VPN likube ikheli olixazulule, futhi umhubhe uyoyeka ukusebenza kamuva. Gcina igama elithunyelwe ngaphandle kanye nesiqalo salo esingahleliwe.
Ngesonto eledlule dig +short ikunikeze ikheli elilodwa lomsele wesiphetho kuphrofayela yakho ye-AWS Client VPN, futhi umhubhe waxhuma. Ngaleli sonto iphrofayela efanayo ime ku-'Connecting' kukhompyutha yakho yesikwiza ngenkathi ikhophi yomlingani wakho engathintwanga isasebenza. Akukho okwavinjelwa futhi isitifiketi asiphelelanga. Othile washintsha igama lomsingathi wesiphetho walifaka lelo kheli elixazululiwe, futhi insizakalo ayiphenduli lapho. Igama elithunyelwe ngaphandle yingxenye eyakhelwe ukumelana nalolo shintsho.
Igama kuphrofayela yakho kungenzeka lingelona igama elibuzwayo
Amaphrofayela athunyelwa ngaphandle ku-Client VPN ngokuvamile ane-remote-random-hostname. Uma leyo nketho ivuliwe, iklayenti lakha ilebula lesikhathi esisodwa, liyixhumanisa negama lesiphetho ngedothi, bese lixazulula igama elihlanganisiwe. Irekhodi le-wildcard esifundeni sesiphetho liphendula noma iyiphi ilebula, yingakho isiqalo esiqanjiwe sixazululeka futhi yingakho leli qhinga lihlala lingabonakali uma uzama ukuphinda umbuzo ngesandla.
Ngakho-ke uma unamathisela igama lesiphetho kutheminali futhi uthola impendulo, usuxazulule igama elihlukile kunalelo iklayenti elilisebenzisayo lapho lixhuma. Lokho kungafani akusona iphutha okufanele lilungiswe kuphrofayela. Ilebulu lenziwa kabusha ngamabomu: le nketho ivimbela amakhashi ukuthi angagcini impendulo endala, futhi ayikaze ikhombe umshini wakho noma isikhathi sakho.
Ngihlangabezane nesimo sokuhambisana lapho iklayenti lingayinaki ngokuphelele le nketho. I-AWS ibhala isisombululo: gcina igama langempela lesiphetho bese ufaka phambi kwalo umucu ongahleliwe nedothi, ukuphatha njengephethini yokuqamba hhayi njengevelu okufanele inamathiselwe. Ukukusebenzisa kuklayenti elidala kunengqondo; ukufaka ikhodi eqinile yomucu onesiqalo njengesiphetho akunangqondo.
Kungani impendulo egciniwe ingeke ihlale ilungile
Amakheli esiphetho se-Client VPN aphethwe yi-AWS futhi ayashintsha ngokuhamba kwesikhathi, okushiwo ngokucacile yidokhumenti yemikhuba emihle. Impendulo ethunjiwe iyisithombe sesixazululo esisodwa. Iphrofayela eyenza ikhodi eqinile yayo izoba iphrofayela eqondise kumsingathi ongasekho ngokushesha uma insizakalo isuka, futhi ukwehluleka akuvamisile ukubukeka njenge-DNS: uthola isikhathi sokuxhuma siphela noma i-handshake emile, ngakho abantu bajaha umzila nezitifiketi.
Impendulo efanayo ku-/etc/hosts izuza isikhathi esifanayo sokuphelelwa kanye nenkinga eyengeziwe. Umugqa we-hosts uhlala unqoba ukuqalisa kabusha, ukuthunyelwa kwangaphandle futhi nokulungiswa kwe-'faka kabusha iklayenti', ngakho ukwehluleka kubuya njalo lapho ikheli lihamba. Ngike ngabona elilodwa lilele ngokungenabungozi amasonto, bese livala wonke umshini owawulithweleyo ngenkathi ukufakwa okusha kuxhuma ngokujwayelekile. Lokho kwehlukanisa, iqembu elilodwa lihluleka kanti elinye lilungile ku-akhawunti efanayo, yiwona mkhondo oshibhe kakhulu ongawuthola.
Nquma kahle ububanzi bokungahleliwe. Kwenzeka ngakunye ukuzama ukuxhuma. Umhubhe osusunguliwe awuxazululi futhi isiphetho sawo, awushintshi amaseva phakathi nesikhathi, futhi izicelo zohlelo ezizodwa azikhethi ngayinye umsingathi omusha we-VPN. Ukuzama okulandelayo kuphela okuxazulula futhi, yingakho isikhathi esisebenza ntambama yonke asisho lutho ngakusasa ekuseni.
Yini insizakalo eyihlolayo lapho umhubhe ukhuphuka
I-Client VPN idinga ukuthi ikheli oxhumene nalo lihambisane nekheli elixazululiwe legama le-DNS lesiphetho. Leso sidingo esisodwa sichaza ukwehluleka okuningana okubonakala kungahlangene: irekhodi le-DNS elenzelwe elikhomba kwenye indawo, i-frontend elenzelwe edlulisela ekhelini langempela lesiphetho, kanye nephrofayela ebhalwe kabusha yaba ikheli elingahluziwe. I-AWS ibhala ukuhlelwa kwerekhodi elenzelwe kanye nokudlulisa njengokwehluleka namaklayenti amasha anikezwe yi-AWS. Ukuhlola kuncane; akusona isinqumo sokuthi wonke amagama angamanye avinjelwe.
Futhi akusona umthetho jikelele mayelana neziphrothokholi ze-VPN. I-remote yezinombolo isemthethweni ngokuphelele ku-ukusetshenziswa okujwayelekile kwe-OpenVPN, futhi eziningi zisebenza kanjalo. Umkhawulo uvela ekuhlelweni okulawulwayo, hhayi kusiphrothokholi esingaphansi kwaso.
Yikho okwenza ukukhulula ukuqinisekiswa kwesitifiketi kube impendulo engalungile. Uma iphrofayela yehluleka ngemva kokushintshwa kwekheli, ukucisha ukuqinisekiswa kweseva kuhambisa iphutha esikhundleni sokulungisa ukuxazululwa noma isidingo sokufana kwekheli, futhi kushiya iklayenti elizothemba noma yini. Gcina i-CA ethunyelwe ngaphandle, ukuqinisekiswa kweseva kanye nezilungiselelo zokuqinisekisa okuhlanganyelwe njengoba zifike.
Uhlu lwezimvume, ukuphuma kanye ne-DNS eyimfihlo kuyizinkinga ezintathu ezihlukene
Umthetho we-firewall okufanele uvume indawo ngaphambi kokuthi ikhompyutha yesikwiza ixhume umayelana nesilaleli sangaphandle. Nikeza umnikazi wenethiwekhi igama lesiphetho, ukuthutha kanye nechweba elilungisiwe, bese ubuza ukuthi ingabe ukulawula kwabo kungalandela ukuziphatha kwe-DNS kwensizakalo. Umthetho ogcina ikheli elilodwa elithunjiwe uyisithombe esinesikhathi sokuphelelwa esingabhalwanga. Uma ukulawula kwamukela kuphela izindawo ezingashintshi, xazulula lelo gebe ngaphambi kokwethulwa esikhundleni sokufaka ikhodi eqinile yempendulo buthule.
Uzakwethu odinga ikheli lomthombo eliqinile lezicelo ezenziwa ngemva kokuba umhubhe ukhuphukile unesidingo esihlukile: ukuphuma. Lokho okuyibona isizindalwazi kuncike kumzila wohlelo kanye nenqubomgomo yomhubhe ohlukanisiwe, hhayi ekhelini iklayenti elixhume ngalo. Ukuhamba komhubhe ohlukanisiwe kungase kungayithinti neze i-AWS.
I-DNS eyimfihlo ngaphakathi komhubhe iyisendlalelo sesithathu. Isixazululi esinikezwa amaklayenti siphendula amagama angaphakathi ngemva kokuxhuma; asikwazi ukuxazulula isiphetho esidlangalaleni ngaphambi kokuba umhubhe ube khona. Ukwehluleka kokuxazulula isiphetho nokwehluleka kokuxazulula uhlelo lwangaphakathi kwenzeka ngezigaba ezihlukile, futhi ukuzihlanganisa kukuholela kuyi-log engalungile.
Umndeni wekheli nawo usohlwini olufanayo. Impendulo ye-IPv4 aisho lutho ngomzila ovunyelwe wesiphetho se-IPv6 noma semigqa emibili, ngakho isithombe esithathwe emndenini owodwa akusona ubufakazi komunye.
Hlola ukuxhumana ngaphandle kokugxilisa noma yini
Qala kuphrofayela njengoba yathunyelwa ngaphandle bese ufunda ukuthi ifunani ngempela:
grep -nE '^remote|remote-random-hostname' profile.ovpn
dig +short cvpn-endpoint-ID.prod.clientvpn.REGION.amazonaws.com
ss -tnp | grep -E ':(443|1194)'Bese uqhathanisa izinto ezintathu: igama lesiphetho eliphethwe iphrofayela, ikheli iklayenti elilibikayo ngokuzama okusha, kanye nalokho igama elixazulula kukho manje. Igama elixazululayo lifakazela kuphela ukuthi irekhodi liyaphendula; ukuthutha nokuqinisekisa kuhlukile, futhi isiphetho akudingekile ukuthi siphendule i-ping. I-log yeklayenti ngokwayo iwumthombo kuphela wento ephakathi, ngakho yithwebule ngesikhathi sokuzama hhayi ngemva.
| What you see | Usual cause | Next check |
|---|---|---|
| One machine fails, others connect | Pinned address or stale hosts entry on that machine | Diff its profile and hosts file against a working copy |
| Everyone fails at once, no config change | The endpoint address rotated | Confirm the current endpoint configuration with the account owner |
| Tunnel up, internal names fail | Client DNS policy, not endpoint resolution | Inspect the resolver pushed after connection |
Ikheli eliphendula namuhla lingubufakazi ngalamuhla; igama yilona insizakalo eligcina livumelekile. Bhala umbono, thumela kumnikazi wesiphetho, futhi ushiye iphrofayela ikhomba egameni.
Imikhuba emibili okufanele iyekwe: ukucisha ukuhlola kwesitifiketi ukuze kudlulwe i-handshake emile, nokunqwabelanisa amalebula phambi kwegama lesiphetho ngethemba lokuthi elilodwa lizonamathela. Ilebulu lixazululeka ngerekhodi le-wildcard noma inkinga ikwenye indawo. Uma iphrofayela elungiswe kahle isehluleka, thumela umbuzo oqondile kanye nomcimbi wokuxhuma, hhayi igama lomsingathi elide.
Ngaphambi kokuvala: iphrofayela isagqoke igama lesiphetho elathunyelwa ngaphandle, awekho amafayela e-hosts agxilisa ikheli, i-remote ku-log yeklayenti ihambisana nokuxazululwa kwamanje, futhi umthetho we-firewall usho isiphetho hhayi ikheli. Leso futhi yisimo okufanele sinikezwe umuntu olandelayo.