I-AWS Client VPN noma i-bastion ukufinyelela i-VPC ene-peering

I-endpoint eyodwa ye-Client VPN ingafinyelela i-VPC ene-peering ne-VPC yayo ehlobene, futhi awudingi i-bastion ukuze lokho kube semthethweni. Ukukhetha okufanele kwenziwe ukuthi ukuhamba kushintsha izandla kuphi: umzila we-endpoint ohlala ku-subnet yokuhlangana futhi unqamule uxhumano lwe-peering, noma i-host ekwi-VPC ene-peering eqeda iseshini. Zombili izindlela ziyasebenza futhi zihluleka ezindaweni ezihlukene, ngakho isinqumo simayelana nobunikazi nokucwaninga, hhayi mayelana nalokho i-AWS ekuvumelayo. Nakhu indlela engikhetha ngayo phakathi kwazo, kanye namarekhodi amane enza umzila ohleliwe usebenze.

Izindlela ezimbili, i-endpoint eyodwa, abanikazi abahlukene

Emzileni ohleliwe, ukuhamba kwekhasimende kufinyelela i-endpoint, kuhunyushwa ekhelini le-interface yenethiwekhi ye-Client VPN ku-subnet yokuhlangana, futhi kuphuma kuleyo subnet ngoxhumano lwe-peering olusuka ku-A luye ku-B. I-VPC B ayiqedi iseshini ye-VPN; ibona ukuhamba okuvamile okuvela ku-VPC A, yingakho umzila wayo wokubuya ukhomba ku-VPC A, hhayi eqenjini lamakhasimende.

Emzileni we-bastion ikhasimende lifinyelela i-host kuqala. I-bastion eku-A isavumela ukugxuma kokugcina ukuba kunqamule uxhumano lwe-peering, ngakho umsebenzi we-peering uhlala, futhi kungezwa iseshini. I-bastion eku-B nayo idinga umzila ovela kukhasimende, futhi uma lowo mzila uyiwona mzila we-endpoint, uthola umklamo ohleliwe kanye nokugxuma okwengeziwe. I-bastion isusa umsebenzi kuphela uma isivele ikhona, isivele igunyaziwe, futhi into engemuva kwayo idinga umngcele weshini hhayi umngcele wenethiwekhi.

Amarekhodi amane enza umzila ohleliwe usebenze

I-AWS ibhala lesi simo ekhasini le-Client VPN how-it-works, futhi empeleni kufinyelela kumarekhodi amane aphethwe amaqembu amabili noma amathathu. Izikhathi ziyizibonelo; ibanga le-peering kufanele lihluke, futhi ibanga lokubuya kufanele lihambisane nohlelo lwakho.

Umzila nemvume kuyizilawuli ezihlukene. Umzila we-endpoint olungile ngaphandle komthetho wokugunyaza ohambisanayo awuniki lutho ikhasimende; umthetho wokugunyaza wendawo i-endpoint engakwazi ukuyihlela uyinika umgodi omnyama. Kokubili kufanele kushiwo ibanga elifanayo.

Umzila we-endpoint ukhomba ku-subnet ekwi-VPC ye-endpoint uqobo, hhayi kuxhumano lwe-peering. Amathebula emizila e-VPC akhomba kuxhumano lwe-peering, hhayi kwi-instance noma i-interface. Ukukopisha inani phakathi kwakho kokubili kugcinwa ngaphandle kwesikhalazo futhi akuhleli lutho.

Ngenxa yokuthi i-subnet yokuhlangana ihunyusha umthombo wekhasimende, i-B kufanele ihlele ukubuya iye ku-VPC A, hhayi eqenjini lamakhasimende. Ukuthumela ibanga lamakhasimende ngaphesheya koxhumano lwe-peering kubonakala kulingana, kuyadlula ekubuyekezweni, futhi kuhluleka buthule ngoba i-B ayiboni iphakethe elinomthombo wekhasimende.

Amaqembu okuphepha kanye nemitha yokugcina yemvume

Ukuhlela kuletha amaphakethe ku-B; i-B isanquma. Kuxhumano lwe-peering olusebenzayo esifundeni esifanayo, iqembu lokuphepha ku-B lingabhekisela eqenjini elisetshenziswe ekuhlanganeni kwe-Client VPN, okugcina umthetho mncane futhi kumelane nezinguquko zamakheli. Lapho ukubhekisela eqenjini kungenzeki, vumela ibanga le-subnet yokuhlangana ngokusobala esikhundleni sokwandisa ku-0.0.0.0/0, okuguqula iphutha lokuhlela kube isikhathi sokulinda esingachazwanga.

Bese uhlola lokho ukuhlela okungakuthinti: ama-ACL enethiwekhi kuzo zombili iz-subnet, uhlu oluvunyelwe noma izilaleli zethokheni yohlelo, kanye ne-DNS. I-peering ayikopisheli izingxenye ezihostwe ngasese, ngakho ikhompyutha ephathwayo ingagcina umzila osebenzayo oya ekhelini engakwazi ukulixazulula, futhi uxhumano lwe-peering alwengezi ukuthembela esitifiketini. Khomba i-endpoint kusixazululi esiphendula i-B, bese uqinisekisa ukuthi igama langasese nesitifiketi ziyafana.

Lapho i-bastion iyimpendulo eqotho

Ngigcina izikhuthazi ezintathu zokukhetha i-bastion ngamabomu. I-VPC ene-peering ingeyeqembu elingeke lengeze umzila wokubuya webanga lakho noma lingeke lamukele ukubhekisela eqenjini. Ukufinyelela kufanele kugunyazwe noma kuqoshwe iseshini ngayinye futhi uhlelo alukwazi ukukuthwala ngokwalo. Noma ukugxuma kokugcina kufanele kuhlale ngaphakathi ku-B ngoba isevisi ixazululwa lapho kuphela futhi ubunikazi bayo be-TLS bunamathiselwe egameni langaphakathi.

Akukho kulokhu okuyisihlenga eqinisweni lokuthi i-peering ayidluli. Ukungadluli kukhawulela lokho izinsiza ku-B ezingakwenza: azikwazi ukusebenzisa i-A njengendlela yokudlula iye ku-VPC yesithathu i-A ene-peering nayo. Lokho akuzange kusho ukuthi umsebenzisi we-VPN akakwazi ukufinyelela ngqo i-VPC ene-peering, futhi i-bastion eyakhelwe ukweqa lokho kufunda okungalungile iyi-host elungiswa ngaphandle kwesizathu.

Iphutha eliphambene libiza kakhulu ngokuhamba kwesikhathi: phusha iqembu ngalinye nge-bastion eyodwa esivele ikhona, bese uthola ukuthi iqembu layo lokuphepha, ithebula lemizila kanye newindi lokulungisa kuyincike ekukhiqizeni. Bhala ukuthi iyiphi intshukumo i-host eyisebenzelayo, futhi uyiyeke isebenze lapho intshukumo inyamalala.

I-Transit Gateway nokuhlangana okuningi kushintsha izibalo

Uma i-endpoint ixhunywe ngqo ku-Transit Gateway esikhundleni se-subnet, imodeli iyashintsha: amakhasimende awasahunyushwa ekhelini le-interface ku-subnet yokuhlangana, futhi amathebula emizila e-Gateway kufanele athwale ibanga lamakhasimende kanye nokunamathisela okuholela ku-VPC ene-peering. Lokho kucwebe kakhulu esikalini, kodwa umsebenzi usuka kumarekhodi amane uya emathebuleni emizila e-Gateway.

Ukuhlangana okuningi kuphindaphinda izivivinyo. Umzila we-endpoint ungowendpoint, kodwa i-subnet yokuhlangana ngayinye idinga ithebula lemizila elinokugxuma okulandelayo kwe-peering kwangempela. Iseshini ingaphumelela ngokuhlangana okukodwa kuyilapho okunye kungenayo indlela yokubuya, ngakho hlola ngakunye.

Ukulandelana kokuqinisekisa okuthola ukuphuka ngokushesha

Gijimisa lokhu ngokulandelana; isinyathelo ngasinye singadlula kuyilapho esilandelayo sihluleka, futhi isikhathi sokulinda sekhasimende cishe asikusho ukuthi yikuphi okuphukile.

1. Xazulula igama lohlelo kusukela kukhasimende bese uhlola ukuthi ikheli lingaphakathi kwebanga le-peering.
2. Xhuma, bese ufunda ilogi yokuxhumana kwe-endpoint yokuhlangana okwaphela iseshini.
3. Kuleyo subnet yokuhlangana, qinisekisa ukuthi ithebula lemizila likhomba ibanga le-peering kuxhumano lwe-peering olusebenzayo.
4. Ku-subnet yezinsiza ku-B, qinisekisa irekhodi lokubuya lebanga le-interface kanye nemithetho yeqembu ehambisanayo.
5. Hlola umsebenzi owodwa ovunyelwe kanye nensiza eyodwa okufanele ihlale ingafinyeleleki; eyesibili ibamba izinsalela zokulungisa amaphutha.
6. Xhuma futhi ngemva kwanoma yiluphi ushintsho lomzila we-split-tunnel, ngoba ithunjana elisebenzayo ngeke lamukele isethi yemizila emisha.

Izimpawu ezimbili zifanele ukukhunjulwa. I-SYN efinyelela ku-B ngaphandle kwempendulo cishe ihlala ingumzila wokubuya ongekho. Uxhumano oluphelayo bese lusethwa kabusha ngokuvamile iqembu, i-ACL noma uhlelo. Akukho kokubili okuvela kulogi ye-endpoint njengesizathu, ngakho gcina amarekhodi amane anomnini eceleni kwelinye ngalinye.

Uma kungekho ntshukumo kwezintathu esebenzayo, qedela umzila ohleliwe futhi urekhode lawo marekhodi amane. Uma eyodwa isebenza, gcina i-bastion yalowo mngcele kuphela futhi ushiye umzila we-endpoint emisebenzini engadingi iseshini phambi kwayo.