I-LAN ngemuva kweseshini eyodwa ye-AWS Client VPN: yini edluliswayo

I-laptop ixhuma ku-endpoint ye-AWS Client VPN, ifinyelela kusubneti yangasese, futhi konke kubonakala kuphilile. I-desktop ekulolu LAN olufanayo ayifinyeleli lutho, nakuba isihambeli se-Linux naso sinokuxhumana kwebhuloho futhi izingxenye zombili zisocingweni olulodwa. Akukho okumiswe ngokungalungile emhubheni; ingxenye engekho ukuhamba kwezindledla, futhi ibhuloho liwumkhondo ongamanga.

Ukunweba iseshini ye-Client VPN iye ku-LAN kuyi-ndima yesango. Akusona isigaba se-Ethernet esidonswe ngaphakathi kwensizakalo ephethwe.

Isihambeli siyasebenza, i-LAN ayisebenzi

Ukuxhumana komhubhe kumshini we-Linux kunekheli elingaphakathi kwe-CIDR yekliyenti ye-Client VPN, futhi i-endpoint iphushe izindlela zezikhala ze-VPC. Isicelo esenziwe kulo mshini siwuthrafikhi odalwe endaweni: sikhetha indlela, siphuma ngomhubhe bese sithola impendulo. Leyo ndlela ayikaze ithinte ikhodi yokudlulisa, ukuxhumana kwe-LAN noma umthetho wothango lomlilo olawula ukudlula.

Uthrafikhi ovela kwenye idivayisi ye-LAN uwukugeleza okunye. Ufika ekuxhumaneni kwe-LAN, udinga indlela ekhomba emhubheni, udinga ukudluliswa okuvuliwe, udinga uthango lomlilo oluvumelayo, futhi udinga impendulo ukuba ibuye ngokusebenzisa isihambeli esifanayo. Imibandela emine, futhi ukuhlolwa kwe-laptop okusebenzayo akubonisi neyodwa yayo. Kusukela ku-desktop ukwehluleka kubonakala kuyisimanga: umhubhe uphezulu, ubufakazi buvumelekile, futhi indawo eya kuyo ayiphenduli nakanye. Isiphambeko sisekhaya endleleni yokudlulisa yesango, hhayi kusizakalo.

Akulona lonke ikliyenti elingaba yisango

I-AWS ithi uhlelo lwayo lwedesktop lwe-Client VPN alusekeli ukudluliswa kwe-IP, futhi amanye amakliyenti angakusekela. Lowo mkhawulo unquma ukwakheka ngaphambi kokuthi kuthayiphe noma yimuphi umyalo. Uma ikliyenti okuwukuphela kwayo etholakalayo uhlelo lwedesktop olusemthethweni, isango le-Linux elidlulisela i-LAN akusona isilungiselelo ongasiqedayo, futhi akukho nani le-masquerading elingakushintsha lokho.

Ikliyenti elingena esikhundleni kufanele futhi lihambisane nendlela yokuqinisekisa ye-endpoint kanye nenqubomgomo ohlose ukuyiphoqa. Ama-endpoint asekelwe kuzitifiketi, kuhlu lwamafayela naku-SAML awamukeli isilungiselelo sekliyenti esifanayo, futhi ikliyenti lenkampani yesithathu eliqinisekisa kodwa lingazinaki izindlela eziphushwe akulona ukuthuthuka.

Thatha ukukhethwa kwekliyenti njengengxenye yokubuyekezwa komklamo. Kunquma ukuthi iphethini yokudlulisa ye-LAN iyatholakala noma cha, futhi kunquma ukuthi i-endpoint ibona buphi ubunikazi kudivayisi ngayinye ngemuva kwesango. Rekhoda ikliyenti kanye nesilungiselelo se-endpoint okwahlolwa ngaso. Ukushintshwa kwekliyenti ezinyangeni eziyisithupha kamuva kungasusa buthule ikhono umklamo owawukucabangela.

Qondisa i-LAN emhubheni bese uyihumusha

Uma ikliyenti esekelwayo likhona, okusele umsebenzi ojwayelekile wesango. Amadivayisi e-LAN adinga indlela yesikhala se-VPC ekhomba kwisihambeli se-Linux, futhi isihambeli sidinga ukudluliswa okuvuliwe. Uma ufuna i-VPC ibone uthrafikhi njengekliyenti elixhunyiwe hhayi njengetheleji le-LAN elingahleliwe, humusha umthombo lapho kuphuma.

LAN: 10.24.11.0/24
Linux LAN gateway: 10.24.11.15
VPN interface: tun0
Target VPC range: 10.2.0.0/16

iptables -t nat -A POSTROUTING -s 10.24.11.0/24 -d 10.2.0.0/16 -o tun0 -j MASQUERADE

Khakha umthetho kubha yomhubhe kanye nesikhala se-VPC, njengoba kungenhla, esikhundleni sokwenza i-masquerading yakho konke okudluliswa yisihambeli. Umthetho omncane kulula ukuwucabanga, futhi awushintshi buthule uthrafikhi obekufanele ugcine ikheli lomthombo lwangempela.

Vumela indlela ye-LAN ifike ngokuzenzakalela uma ukwazi: inketho ye-DHCP, isimemezelo somhambisi noma indlela emile ephushwa yilokho okulawula i-LAN. Indlela ekhona kumshini wokuhlola owodwa kuphela izokwenza umklamo ubonakale uphukile ngaso leso sikhathi lapho omunye umuntu ewuzama.

Impendulo nayo idinga indlela

Lapho isicelo sifinyelela ku-VPC, impendulo kufanele ibuye ngezimo zokuhumusha ezifanayo futhi ithole indlela ye-LAN esangweni. Leyo ngxenye ivamise ukusebenza lapho umthetho we-masquerade ukhona, ngoba ukumaka kuhlala kusihambeli esikwenzile. Kuyaphuka lapho ohlangothini lwe-VPC kunendlela ethumela impendulo kwenye indawo, futhi yingakho kokubili indlela ye-CIDR yekliyenti kanye nokuxhunyaniswa kwesubneti ku-endpoint kubalulekile.

Bheka izibali, hhayi i-ping kuphela. Umthetho we-masquerade onamaphakethe angu-zero ukutshela ukuthi isicelo asikaze sifinyelele kubha yomhubhe, lokhu okukhomba emuva endleleni ye-LAN noma kuthebula lokuhamba lekliyenti uqobo. Umthetho onamaphakethe kodwa ongenazo izimpendulo ukhomba ohlangothini lwe-VPC, emithethweni yegunya noma eqenjini lokuphepha elingawamukeli umthombo ohunushiwe. Funda izinhlangothi zombili ngaphambi kokushintsha noma yini, ngoba inani elikhula ohlangothini olulodwa kuphela liyindlela yohlangothi olulodwa, hhayi eyehla ngokushesha.

Khumbula ukuthi i-endpoint iyinsizakalo ephethwe. Awekho amafayela okulungiselela eseva angahlelwa futhi asikho isiqondiso se-client-config esingangezwa, ngakho imiyalo ebhalelwe iseva ye-OpenVPN ezilawulayo enezindlela zangokwezifiso zesubneti yekliyenti ayidluli. Ku-AWS izinsimbi ziwukuxhunyaniswa kwesubneti, imithetho yegunya namathebula okuhamba e-VPC.

Ubunikazi obabiwe yingxenye okufanele inqubomgomo iyiphendule

Yonke idivayisi engemuva kwesango isebenzisa iseshini ye-VPN yesango. Imithetho yegunya ye-endpoint inika umsebenzisi noma iqembu ukufinyelela, futhi ngokombono wensizakalo kunomsebenzisi oyedwa ncamashi kuleyo seshini. Ukudluliswa kwasekhaya akukuphindiseli lokho kubunikazi kube ukuqinisekiswa kwedivayisi ngayinye, futhi akunwebi ukuhlolwa kwesimo sedivayisi kuze kufike kuprinta esekhoneni.

Lokho kungamukeleka, noma kungaba yisizathu sokuthi umklamo wenqatshwe. Kuncike kulokho izinsiza ze-VPC ezikucabangelayo mayelana nokuthi ubani oshayayo. Ubunikazi obabiwe obuhambisana nemodeli yegunya kulungile; obuguqula buthule iseshini eyodwa eqinisekisiwe kube ukufinyelela kuyo yonke i-LAN kuwukutholakala okulindele ukubhalwa.

Uma imfuneko ngempela iwukuxhumanisa isayithi lonke ne-VPC, qhathanisa umklamo wesayithi-kuya-sayithi osekelwayo ngaphambi kokunweba ikliyenti yokufinyelela kude. Incazelo iyahluka, futhi iseshini yekliyenti ene-NAT iyisikhundla esibi sokuxhumanisa isayithi lapho i-VPC idinga ukuqala ukuxhumana ingene ku-LAN.

Nquma ikliyenti, indlela, ukuhumusha kanye nendaba yobunikazi ngalolo hlobo. Ngakunye kukhawulela okulandelayo, futhi ukulandelana kuchaza ukuthi kungani isihambeli sisebenza kuyilapho i-LAN ingasebenzi.