Imithetho ye-AWS Client VPN isendaweni yensiza, hhayi ku-subnet

Abasebenzi kudingeka bafinyelele uhlelo lokusebenza olulodwa ku-VPC futhi akumele bafinyelele isilaleli sesizindalwazi ku-instance efanayo, ngakho othile wengeza i-subnet yesibili yomphakathi ye-endpoint ye-VPN futhi uthi isidingo sifezekile. Indawo ye-subnet ishintsha ukuhamba kanye nokutholakala. Ayinikezi futhi ayincishi imbobo eyodwa. Imvume ekhombisa isidingo ihlala endaweni ekuyiwa kuyo, kuqembu lokuphepha lwensiza, futhi umngcele we-VPN unikeza isibambo umthetho lowo obhekisela kuso.

Indawo ye-subnet ukuhamba, hhayi ukugunyaza

Lapho ukuxhumana kwenethiwekhi kwe-endpoint kukhona kunquma ukuthi iyiphi ithebula lomzila elithwala ithrafikhi yeklayenti nokuthi iyiphi indawo yokutholakala esinda ekwehlulekeni. Akusho lutho mayelana nokuthi iyiphi imbobo kuyiphi i-instance leyo thrafikhi engayifinyelela. Amaklayenti amabili axhumene ne-subnet efanayo asafika ngobunikazi bomthombo obufanayo, futhi insiza ayikwazi ukubahlukanisa ngegama le-subnet.

Qala esidingweni: ubani oshayayo, iyiphi insiza, iyiphi imbobo yesevisi nakuphi uhlangothi. Bese ukhetha imodeli yomthetho ekwazi ukuveza lezo zinto ezine endaweni ekuyiwa kuyo. Le ndlela ivamise ukususa ngokuphelele i-subnet eyengeziwe kumklamo.

Iqembu lokuxhumana le-Client VPN yilo isibambo

Ku-endpoint ye-AWS Client VPN exhumene ne-subnet, ilungiselelo elibhaliwe licacile. Sebenzisa iqembu lokuphepha elihlosiwe ekuxhumaneni kwenethiwekhi okuhlosiwe kwe-endpoint, bese uvumela ithrafikhi edingekayo kuqembu lokuphepha lwensiza usebenzisa lelo qembu le-Client VPN njengomthombo.

Ngokucacile, iqembu le-instance yohlelo lokusebenza livumela imbobo yohlelo lokusebenza kusuka kuqembu lokuxhumana, futhi akukho okunye. Inqubo yokufinyelela insiza ye-AWS ichaza lobu budlelwano, futhi kufanelekile ukugcina inqubomgomo efanayo yeqembu kuwo wonke ama-subnet i-endpoint exhumana nawo, ngoba ukuxhumana kwakudala neqembu elihlukile kwandisa umngcele buthule.

Lowo mthetho awuqinisekisi muntu. Ukungena kuwukulawula okuhlukile, futhi indlela eya ensizeni ingeyesithathu. Zontathu kufanele zibe yiqiniso ngaphambi kokufika kwesicelo. Yikuphi okwehlulwayo okunqumayo ukuthi yikuphi ukulungiswa okulungile, futhi ukushintsha umthetho kuyimpendulo elungile yokuqala kuphela.

Okungeke kukwazi ukuhlukanisa iqembu elilodwa lokuxhumana

Iklayenti ngayinye engemuva kweqembu lokuxhumana elifanayo ifinyelela ensizeni njengomthombo ofanayo weqembu lokuphepha. Abasebenzisi ababili abanendima ezihlukile abakwazi ukuhlukaniswa kulelo zinga, kungakhathaliseki ukuthi iqembu liqanjwe kanjani noma lifakwe umaka kanjani. Ukugunyazwa kwamaqembu angaphandle e-Client VPN kukhawulela ukufinyelela ngokwesiqalo sendawo ekuyiwa kuyo eqenjini lesiqondisi noma le-SAML, okuyinto eqinile kunendima yensiza futhi kufanele ithathwe njengomngcele wenethiwekhi, hhayi uhlelo lobunikazi.

Umehluko ocwebile ungowohlelo lokusebenza. Isilaleli sesizindalwazi okufanele sihlale sivaliwe kubasebenzi abaningi sivikeleka kangcono ngokungafinyeleleki nhlobo kusiqalo esivunyelwe kunokuba silindele ukuthi ubulungu beqembu buhlale buhlelekile.

Ukuqamba kabusha iqembu akudali ubunikazi, futhi ukuliphinda ngeqembu ngalinye kumane kwandisa ukuxhumana okufanele kucwaningwe.

Ungakopishi lowo mthetho kuwo wonke umklamo we-VPN

Isango le-EC2 VPN elizilawulayo, ithuluzi lokuhlola elihambiswayo kanye ne-Client VPN elawulwayo kuyizindlela ezintathu ezihlukile zamaphakethe. Thola ukuthi iyiphi ikheli lomthombo elifinyelela insiza ngempela, ukuthi ukuhumusha kwenzeka yini phakathi, nokuthi yiziphi izindlela zokubhekisela isevisi ezisekelayo kuleyo ndlela.

Ukudlulisa ithrafikhi ngedivayisi ephakathi akugcini ukubhekisela kweqembu lokuphepha lomthombo njengoba kwenza ithrafikhi eqondile phakathi kwama-instance. I-AWS ibhala ukuthi imiklamo enjalo ingase idinge amakheli omthombo angasese noma ama-CIDR afanele esikhundleni sokubhekisela kweqembu. Inqubo ye-Client VPN elawulwayo ayibona ubufakazi bokuthi iqembu elinamathiselwe kuwo wonke amasango lisebenza njengophawu lobunikazi olusebenza jikelele kumaphakethe adlulisiwe.

Ukugxuma kwe-NAT okukodwa endleleni kwanele ukwephula umcabango, futhi ukwehluleka kubonakala njengomthetho okhona kodwa ongahlangani nakanye.

Buyekeza umngcele osebenzayo

Funda wonke amaqembu okuphepha anamathiselwe ensizeni, ngoba imithetho yokuvumela iyahlangana futhi umthetho omncane awukhanseleki owubanzi kwelinye iqembu. Bese uhlola i-ACL yenethiwekhi, isicishamlilo sokusebenza kanye nokugunyaza kohlelo lokusebenza uqobo, okuyizendlalelo ezihlukile ezinamaphutha ahlukile.

Qeda ngesicelo esisodwa esivunyelwe nesinye esikhishwe ngamabomu ngokumelene nensiza efanayo. Le mbhangqwana ifakazela umngcele, kuyilapho ukuxhumana okukodwa okuphumelelayo kufakazela kuphela ukuthi kukhona okuvulekile. Qinisekisa umzila, umthombo osebenzayo kanye nembobo yesevisi ehlosiwe, hhayi i-subnet equkethe i-endpoint.

Ukulandelana komsebenzi: bhala isidingo sezingxenye ezine, namathisela iqembu ekuxhumaneni, khawulela umthetho wensiza embotsheni, qinisekisa imvume eyodwa nokwenqaba okukodwa, bese ucabanga kuphela ukuhlukanisa ama-subnet ngezizathu zokuhamba.