AWS Client VPN noma i-VPN ku-EC2: incwadi yokusebenza

Izinyathelo ezinhlanu zokukhetha phakathi kwe-AWS Client VPN ne-VPN ozihosha ngokwakho ku-EC2, nokuhlolwa kwe-CLI, ukwabiwa kwemithwalo yomsebenzi, ukushintsha nokubuyisela emuva.

Zombili izinketho zinika ithimba lakho i-VPN yokufinyelela kude, ngakho umbuzo obalulekile akukhona ukuthi iyiphi ekhona, kodwa ukuthi iyiphi ongayiphatha. Umehluko ukuthi ubani ongumnikazi wendawo yokugcina ngo-3 ekuseni nokuthi yikuphi ukulawula okufinyelelayo lapho kukhona okonakele. Landela izinyathelo ezinhlanu ezingezansi ngokulandelana, ngoba ngayinye ingaqeda ukuqhathanisa kusenesikhathi. Ukweqa isinyathelo sokubala impahla yikho okwenza amathimba agcine efinya kabili.

Isinyathelo 1: bhala imfuneko ngaphambi kwebhili

Udinga amaqiniso amahlanu ekhasini elilodwa: ubani oqinisekisa futhi ngokuqhathaniswa nani, yiziphi izinkundla zamaklayenti okufanele zisebenze, yiziphi izindawo eziyimfihlo ezifinyelelekayo, yikuphi ukutholakala okuthembisile nokuthi ithrafikhi ibukeka kanjani ngempela. Ngaphandle kwalokho, konke ukuqhathanisa kwakamuva kuphenduka impikiswano ngoHlu lwezici.

Yiba nesibindi mayelana nezindawo. «Ukufinyelela ku-VPC» ngokuvamile kusho izinto ezintathu ezahlukene: i-CIDR ye-VPC, inethiwekhi ehlanganyelwe kanye nebanga lendawo elingemuva kwe-Transit Gateway. Indawo yokugcina ephethwe ingafinyelela kuzo zontathu, kodwa ngayinye idinga umzila kanye nomthetho wokugunyaza, futhi ngayinye iwumugqa ohlukile kumfuneko yakho.

Isinyathelo 2: bhala lokho osekuvele kusebenza

Ngaphambi kokuklama noma yini, bhala izindawo zokugcina ezikhona nanoma yiseva esingathwa ku-EC2 kanye namaqembu ayo okuphepha. Lezi zingcingo ziyafundwa kuphela futhi ziphephile ukuzisebenzisa kusukela ku-akhawunti enezimvume ze-describe.

aws ec2 describe-client-vpn-endpoints
aws ec2 describe-client-vpn-authorization-rules --client-vpn-endpoint-id cvpn-endpoint-xxxx
aws ec2 describe-client-vpn-routes --client-vpn-endpoint-id cvpn-endpoint-xxxx
aws ec2 describe-client-vpn-connections --client-vpn-endpoint-id cvpn-endpoint-xxxx
aws ec2 describe-instances --filters Name=tag:role,Values=vpn

Funda umphumela njengebalazwe walokho amaklayenti asekufinyelela. Umthetho wokugunyaza ongekho uchaza ukwehluleka okubonakala njengenkinga yomzila, futhi indawo yokugcina exhumene ne-subnet eyodwa ichaza ukuthi kungani ukwehluleka kwesifunda kuwisa yonke insizakalo.

Bhala futhi amaqembu okuphepha anamathiselwe kunoma yisiphi isenzakalo ozihosha ngokwakho. Lezo zimithetho ziyingxenye yemodeli yokufinyelela, futhi yizo into yokuqala ephuka ngokuthula lapho umuntu akha kabusha isenzakalo ngesifanekiso.

Isinyathelo 3: aba imithwalo yomsebenzi

Insizakalo ephethwe ingumnikazi weqembu lezindawo zokugcina, ukuxazululwa kwayo kanye nokutholakala kwayo esifundeni. Wena ungumnikazi wokubhaliswa kobunikazi, imithetho yokugunyaza, izindlela zenethiwekhi ezingemuva kwendawo yokugcina, ukulungiselelwa kwamalogi kanye nesinqumo sokuthi zingaki izigaba ezingaphansi ezizoxhumeka.

Ukuzihosha ngokwakho kuguqula lokhu. Wena ungumnikazi wesistimu yokusebenza yesivakashi, i-daemon ye-VPN nokulungiselelwa kwayo, izitifiketi nezinkinobho, izipele, ukuqapha nokubuyisela. Imodeli yokuphepha ye-EC2 ibeka ukuphepha kwesivakashi nohlelo kumklayenti, futhi iseva ye-VPN iyisivakashi njenganoma yisiphi esinye.

Bhala ukwabiwa njengothebula onamagama kukholomu kwesokudla. Uma kungekho gama lomuntu eduze kokuvuselelwa kwesitifiketi, yilokho okutholakele, futhi kubaluleke ukwedlula umehluko wezindleko ngehora.

Isinyathelo 4: qhathanisa nomthwalo womsebenzi ongawuchaza

Izindleko zilandela ukuma, hhayi ubukhulu. Kukhetho oluphethwe, bala amahora okuxhumanisa izindawo zokugcina, amahora okuxhumana kwamaklayenti, ukudluliswa kanye nezinsizakalo zobunikazi namalogi ozivulayo. Ekuzihosheni ngokwakho, bala ukubala, isitoreji, inethiwekhi, amalayisense kanye nesikhathi sonjiniyela esigcina iseva ixazululwe. Faka womabili amaqoqo ezinombolo kushidi elilodwa elinesikhathi esifanayo. Ukuqhathanisa kweminyaka emithathu okushaya indiva amahora okuxazulula kuyothanda iseva osuvele unayo.

Ukuqhathanisa kokusebenza kudinga isiyalo esifanayo. Isikhathi esisodwa sedeskithophu esisebenzisanayo, ukudluliswa okukodwa okukhulu kanye nezicelo ezincane ezingamashumi amahlanu ngesikhathi esisodwa kucindezela izingxenye ezahlukene zomzila: i-CPU yokubethela, amandla enethiwekhi esenzakalo, isitaki sekilayenti uqobo kanye nendawo. Hlola ngamaklayenti amelela kanye nomsebenzi ofanayo kukho kokubili ukuklama.

Isenzakalo esikhulu akusona ubufakazi bokuthi ukudluliswa kuyoshesha, futhi isikhathi esisodwa esiphumelelayo akusona isu lamandla. Thatha noma yiziphi izindaba ezizuzwe njengefa mayelana nemindeni yezenzakalo njengemqagqo okufanele ihlolwe, hhayi njengomthetho wokuthenga.

Isinyathelo 5: shintsha ngokubuyisela emuva osekwake wakwenza

Gijimisa zombili izindawo zokugcina ngokuhambisana isikhathi esinqunyiwe, sabalalisa iphrofayela yekilayenti entsha eqenjini elincane kuqala, futhi ungathinti imithetho yokugunyaza yendawo yokugcina endala kuze kube yilapho iqembu lisebenzise entsha emsebenzini wangempela. Ukubuyisela emuva ukushintsha kwephrofayela, hhayi ukwakha kabusha, ngakho nquma manje ukuthi iphrofayela endala ihlala kuphi.

Qinisekisa ngalokhu kulandelana: ukuqinisekisa kuyaphumelela, ikilayenti lithola imizila elindelekile, indawo egunyaziwe iyaphendula futhi indawo engagunyaziwe iyehluleka, futhi amalogi akhombisa zombili izehlakalo. Uma noma yisiphi isinyathelo sehluleka, yima futhi ulungise leso sinyathelo esikhundleni sokuya eqenjini elilandelayo lamaklayenti. Bhala umphumela wakho konke ukuhlola, ngoba ukushintsha okukhunjulwa kuphela ngokuthi «kwasebenza» akukwazi ukulungiswa inyanga kamuva.

Ngemuva kokushintsha, hlela ukuhlola okuyisicefe: ukuphela kwesitifiketi, inani lokuxhumana, imithetho yokugunyaza engasahambisani neqembu kanye nenani lokuxhumana uma kuqhathaniswa nokulindile. Umhlahlandlela wokuphatha i-Client VPN uyireferensi yezingxenye zendawo yokugcina, ukuqinisekisa kanye nomzila ozilungiselele.

Izihloko ezihlobene