Ukufinyelela okungaqhubeki ku-AWS Client VPN: hlola yonke i-subnet exhunyiwe
Amanye amaseshini e-AWS Client VPN afinyelela i-VPC yohlelo kanti amanye aphelelwa isikhathi. Qala ngokuqhathanisa imizila ye-endpoint netafula lemizila le-VPC yokuxhumana ngakunye.
Umsebenzisi uyaxhumanisa, avule uhlelo lwangaphakathi futhi athole impendulo; uzakwabo ekwepointi efanayo uthola ukuphela kwesikhathi kusuka kukhompyutha ephathekayo efanayo kwi-Wi-Fi efanayo. Lelo phethini wuphawu lwe-endpoint ye-client VPN ene-subnet engaphezu kweyodwa exhunyiwe, lapho imizila ingalingani. Ngilandelisa lokhu kusuka kukhonsole ngaphandle, ngoba amathebhu amabili anquma ukuthi uphenyo olusele lufanelekile yini. Akukho lutho ekuhlelweni kwekliyente okuchaza lokho.
Qala e-endpoint bese ubala ukuxhumana
Kukhonsole ye-VPC, vula i-Client VPN endpoints, khetha i-endpoint bese ufunda ithebhu ye-Associations. Ukuxhumana ngakunye i-subnet esesifundeni sokutholakala, futhi ikliyente lihlala kuleyo esetshenziswa yisevisi lapho kwakhiwa uxhumano. Bhala amanani e-ID e-subnet kanye netafula lemizila elisetshenziswa ngayinye ngempela, ngoba lezo zinhlu ezimbili wukughathanisa osuzokwenza.
Uma i-endpoint ibonisa ukuxhumana okukodwa kuphela, lo mbono awulungile futhi ikliyente iyisola esingcono.
Qhathanisa itafula lemizila le-endpoint nokuxhumana ngakunye
Vula ithebhu ye-Route table kuleyo endpoint efanayo. Yonke i-CIDR yendawo ekhona inenhloso, futhi ku-client VPN inhloso wukuxhumana hhayi isango. I-AWS idinga ukufakwa kwendawo kuyo yonke i-subnet exhunyiwe, ngakho umzila okhomba kweyodwa yazo wenza ukufinyelela kuncike ekutheni iseshini yahlala kuphi. Hlola indawo oyikhathalele ngempela, bese uhlola umthetho wayo wokugunyaza, ngoba umzila unikeza indlela kanti umthetho unquma ukuthi ubani angawusebenzisa.
Uma usukwazile ukubeka zombili izingqimba etafuleni, kunzima ukweqa iphutha.
| Associated subnet | Endpoint route to 10.200.0.0/16 | VPC route in that subnet |
|---|---|---|
| subnet-aaa | Targets the association | 10.200.0.0/16 to pcx-example |
| subnet-bbb | Targets the association | No matching entry |
Umugqa wesibili uyiphutha lonke emathikithini amaningi. Umzila we-endpoint ukhona, ngakho akekho obheka phambili, futhi iphakethe liyafa ngemuva kokugxuma okukodwa ngaphakathi kwe-VPC.
Landela i-subnet ngayinye kuya etafuleni layo lemizila elisebenza
I-subnet engenakho ukuxhumana okucacile netafula lemizila izuza itafula eliyinhloko le-VPC. Funda itafula elisebenza ngempela, hhayi lelo igama lalo elibonakala lilungile, futhi uqhathanise indawo nenhloso esikhundleni selebula emugqeni.
Umhlahlandlela we-AWS wokufinyelela okungaqhubeki uchaza lokhu njengokukhushulwa kwemizila kuyo yonke imixhumano, okuyimodeli efanele. I-endpoint iletha iphakethe ku-subnet, futhi itafula laleyo subnet kusafanele lazi ukuthi inethiwekhi yohlelo ikuphi.
Lungisa umugqa ongekho etafuleni eliwuphethe. Ukukopisha itafula lemizila lonke lisuka ku-subnet esebenzayo kukopisha futhi izinqumo ze-inthanethi, zedivayisi nokwehlukanisa ezingakaze zihloselwe lena, futhi lokho kushintshana kuvame ukuba kubi kunokuphazamiseka okuqale ngakho.
Hlola imithetho yokugunyaza, bese ubheka indlela yokubuya
Imithetho yokugunyaza yeyendawo ngayinye neyeqembu ngalinye, futhi ihlolwa ngokwehlukile emizileni. Indawo enemizila yonke indawo kodwa engenawo umthetho weqembu lomsebenzisi iziphatha njengomgodi omnyama onetafula lemizila elibonakala liphilile.
Indlela yokubuya nayo ifanele ukunakwa okufanayo. Uxhumano lwe-peering ludinga umzila ku-VPC yohlelo obuyela emuva ku-CIDR yekliyente, imithetho yeqembu lokuvikela evumela ithrafikhi kuzo zombili iziphetho, nama-ACL enethiwekhi angayiphonsi. Ukufinyeleleka ngohlangothi olulodwa, lapho i-ping isebenza khona kanti ukuxhawana kwe-TCP akusebenzi, ngokuvamile kukhomba ku-ACL noma iqembu lokuvikela hhayi ku-VPN.
Amaqembu okuvikela e-endpoint ngokwalo ahlala kuma-interface enethiwekhi anwebekayo okuxhumana, ngakho umthetho ovumela imbobo yohlelo kusuka ku-CIDR yekliyente kufanele unanyathiselwe ekuxhumaneni, hhayi kumfanekiso kuphela.
Qinisekisa ngokuxhuma kabusha, hhayi ngesicelo esisodwa senhlanhla
Nge-split tunnel, imizila ye-endpoint iyathunyelwa lapho kusungulwa uxhumano, ngakho isethi yemizila eshintshiwe ayisoze ifinyelele kukliyente ehlala ixhunyiwe. Nqamula bese uxhuma kabusha ngekliyente esekelwayo, bese uqinisekisa ukuthi imizila emisha ikhona kumshini.
Ekugcineni, hlanganisa ilogi yokuxhumana nekheli elatholwa yikliyente, futhi uphinde uhlole ngokwanele ukuze uhlangane nokuxhumana okungaphezu kokukodwa. Isicelo esisodwa esiphumelelayo ngemuva kokulungiswa sibonisa ukuthi umzila owodwa uyasebenza, kanti ithikithi lalimayelana nomunye.