I-AWS Client VPN ene-tunnel ehlukanisiwe: yiziphi izindlela okufanele uzishicilele

Ikhonsoli inikeza isishintshi se-tunnel ehlukanisiwe, ngakho isinqumo sibonakala njengebhokisi lokumaka. Akunjalo. Okufinyelela kuklayenti ngempela yisethi yezindlela ezishicilelwe yesiphetho, futhi lolo hlu lunquma ukuthi yimaphi amaprefikhi ayimfihlo asebenzisa i-tunnel, ukuthi ithrafikhi evamile ye-internet ihlala yasendaweni noma iphuma nge-AWS, nokuthi iyiphi i-resolver iklayenti esengakhuluma nayo. Imibuzo emithathu inquma ukwakheka, futhi ngayinye ingaphendulwa kabi ngenkathi uxhumano lusaphumelela.

Ifulegi le-tunnel ehlukanisiwe aliwuhlu lwezindawo okuyiwa kuzo

I-AWS ichaza i-tunnel ehlukanisiwe njengokwengeza izindlela zesiphetho etafuleni lezindlela likaklayenti lapho kusungulwa uxhumano. Indlela eya ku-VPC eyimfihlo ikhawulela i-tunnel kuleyo ndawo; konke okunye kulandela indlela evamile kaklayenti. Indlela ezenzakalelayo iyimiyalo ehlukile enomphumela ohlukile, yingakho imibhalo ye-tunnel ehlukanisiwe ixwayisa ngokushicilela i-0.0.0.0/0 esiphethweni esilungiselelwe le ndlela: ngokuvamile iphula uxhumano esikhundleni sokulusabalalisa. Itafula lezindlela lesiphetho liyinqubomgomo, futhi itafula lezindlela likaklayenti liwumphumela ongawuhlola.

Funda itafula lezindlela lesiphetho kanye nezindlela ezifakiwe kuklayenti ndawonye. Ilebula ichaza inhloso; izindlela zichaza okwenzekayo.

Isinqumo sokuqala: ingabe ithrafikhi evamile ye-internet kufanele ihlale yasendaweni?

Uma ukuphequlula kufanele kusebenzise uxhumano lomsebenzisi uqobo, shicilela kuphela izindawo eziyimfihlo ezidingwa umsebenzi bese uma lapho. Ungangezi indlela ye-internet ngoba isifundo se-tunnel egcwele sasihlanganisa eyodwa, futhi ungacabangi ukuthi indlela eyengeziwe ithuthukisa ukuvikeleka. Ishintsha indlela, ayengezi inqubomgomo, futhi ngokuvamile ibiza ukubambezeleka obekungabekwanga esabelomali.

Uma ithrafikhi ye-internet kufanele iphume nge-AWS, yakha isakhiwo sokufinyelela kwi-internet esibhaliwe: indlela yesiphetho, imithetho yokugunyaza, indlela yesubneti ehlobene, inqubomgomo yokuphepha kanye nokuphuma okuphezulu okusebenzayo. Indlela ezenzakalelayo iyodwa ayinikezi lutho kwalokhu.

Isinqumo sesibili: yimaphi amaprefikhi ayimfihlo, futhi kugunyazwe ubani?

Shicilela isethi encane yezindawo esiza umthwalo wangempela womsebenzi, futhi hlola ukuthi yonke isubneti ehlobene ingakwazi ukuhambisa indlela kuzo. Umgomo wendlela wesiphetho kanye nokuhamba kwe-VPC kwesubneti kungamazinga ahlukene, futhi indlela ekhona kwelinye ayibona ubufakazi ngelinye. Ukugunyaza kuhlukile futhi: indawo ingafinyeleleka futhi inqatshwe noma kanjalo ngoba iqembu likaklayenti alinawo umthetho oyivumelayo.

Ukuhlola isikhathi esisodwa esiphumelelayo kufakazela indlela eyodwa. Hlola yonke isubneti ehlobene, ngoba ukuxhumana kwesubneti okwengezwe kamuva yikho kanye lapho indlela elahlekile ivamise ukuba khona.

Lapho indawo kufanele ifinyeleleke ngegama, qaphela ukuthi umbuzo olandelayo ukuxazululwa kwamagama, hhayi indlela.

Isinqumo sesithathu: iyiphi i-resolver elandela i-tunnel?

Iklayenti lingathola iseva ye-DNS efinyeleleka kuphela nge-VPN, futhi leyo resolver isebenza kuphela uma ikheli layo ngokwalo lingaphakathi kwendlela egunyaziwe. Qinisekisa izingxenye zombili: ikheli le-resolver lilandela indlela eshicilelwe, futhi iseva iphendula amagama akhuluma ngawo uhlelo lokusebenza. Isicelo esiphumelela ngekheli kodwa sehluleke ngegama lomsingathi sikhomba ekubizeni amagama, hhayi ekuhambiseni indlela, futhi ukulungisa i-tunnel kuleso simo kuchitha intambama.

Amagama omphakathi kufanele axazululwe njengangaphambi koxhumano, okuyisinye isizathu sokunemba mayelana nalokho okushicilelayo.

Shintsha isethi yezindlela, bese uqinisekisa izwe zombili

I-AWS ibhala ukuthi ukushintsha izindlela esiphethweni se-tunnel ehlukanisiwe kusetha kabusha ukuxhumana kwaklayenti. Hlela ushintsho ngakho engqondweni: lusebenzise, xhuma kabusha ngeklayenti elisekelwayo, futhi ufunde izindlela ezifakiwe kabusha esikhundleni sokwethemba isimo esasetshenziswa ngaphambi kokuhlela. Isimo esidala esasetshenziswa yisona sizathu esivame kakhulu sokuthi ushintsho olulungile lubonakale luphukile.

Yamukela ukwakheka kuphela lapho insiza eyodwa eyimfihlo nendawo eyodwa yomphakathi kokubili kuziphatha ngendlela okuhlosiwe, ngegama nangekheli, emindenini yamakheli oyisekelayo ngempela. I-tunnel eqinisekisa ubunikazi ayifani ne-tunnel ehlukanisa kahle.

Bhala uhlu lwezindlela ku-runbook eceleni kwesizathu, ukuze umuntu olandelayo ahlukanise ukukhishwa okwenziwe ngamabomu nalokho okukhohliwe.