AWS Site-to-Site VPN kuya ku-NAT Gateway: i-VGW ngokumelene ne-Transit Gateway

Wonke umuntu udweba umdwebo ofanayo okokuqala: i-VPN ingene ku-VPC, i-NAT gateway iphume iye ku-inthanethi, kuqediwe. Kodwa i-AWS ayiyisekeli leyo ndlela lapho i-VPN iphelela ku-virtual private gateway, futhi ukwehluleka kuthule kakhulu kangangokuthi amaqembu ayakha kabusha izikhathi ezingaphezu kokukodwa. Idizayini esebenzayo idinga i-transit gateway, okushintsha i-gateway namathebula emizila nhlangothi zombili. Qhathanisa lezi zinhlobo ezimbili ngaphambi kokudweba noma yini.

I-topology ebukeka icacile futhi engasekelwe

Idokhumenti ye-AWS ye-NAT gateway idweba umugqa omangaza noma ubani owakha kuphela amadizayini e-VPC eyodwa: ithrafikhi evela kuxhumano lwe-Site-to-Site VPN ayikwazi ukuhamba iye ku-NAT gateway nge-virtual private gateway. Uhlobo lwe-gateway lapho i-VPN iphelela khona yilo olunquma ukuthi ngabe ikhona yini indlela yokuhumusha. Iphutha liyaphila ngoba isimo se-tunnel singu-UP futhi i-EC2 instance ekuleso subnet iyafinyelela i-inthanethi ngaphandle kwenkinga. Akukho kulokhu kubili okuhlola uhlangothi olugobile.

Empeleni iphakethe lifika nekheli lomthombo elivela kunethiwekhi yasendaweni futhi alitholi hop elilandelayo elisekelwayo elingalihumusha. Kuye ngamathebula, liyalahlwa emngceleni wokuphuma, futhi njengoba i-tunnel ihlala ingu-UP ngenkathi i-instance ekuleso subnet ifinyelela i-inthanethi, ukwehluleka kubikwa njengenkinga ye-firewall yasendaweni.

I-virtual private gateway ngokumelene ne-transit gateway

I-virtual private gateway ingeyakwa-VPC eyodwa. Iqeda i-VPN, ifaka imizila kumathebula emizila aleyo VPC, bese ima lapho. Ayinayo imodeli ye-attachment, ngakho ayikwazi ukudlulisela ithrafikhi kwenye i-VPC noma engxenyeni yokuphuma eyabiwe. Lona umkhawulo we-VPC eyodwa uyiwonke umkhawulo, futhi awukho umzila owengezayo ngaphakathi kwe-VPC ongakushintsha lokho.

I-transit gateway iyisikhungo sesifunda lapho i-VPN, yonke i-spoke VPC kanye ne-VPC yezinsizakalo ezabiwe konke kuvela njengama-attachment. Inamathebula ayo emizila akhetha ukuthi iyiphi i-attachment ethola i-prefix ethile.

Yileso sikhungo esenza ukuphuma okumaphakathi kube nokwenzeka: i-VPN yehla njenge-attachment eyodwa, i-VPC yokuphuma njengenye, futhi ithebula lemizila le-transit gateway lithumela ama-prefix abheke e-inthanethi isuka kwelokuqala liye kwelesibili. Nge-virtual private gateway awekho ama-attachment esibili okuthumela okuthile kuwo, yingakho idizayini ayikwazi ukulungiswa kamuva.

Indlela yokuphuma esekelwayo, hop nge-hop

Idizayini eyisethenjwa inama-hop amahlanu futhi wonke umcibisholo uyisinqumo sokuhambisa umzila okufanele usimise. Ithrafikhi iphuma kunethiwekhi yasendaweni ingene ku-attachment ye-Site-to-Site VPN, ithebula le-transit gateway lidlulisela kuyo iye ku-attachment ye-VPC yokuphuma, lapho ithebula le-subnet lithumela khona ku-NAT gateway yomphakathi. I-NAT gateway ihumusha umthombo futhi i-internet gateway ikhipha iphakethe.

On-premises network
  -> Site-to-Site VPN attachment on the transit gateway
  -> transit gateway route table
  -> egress VPC attachment
  -> public NAT gateway in that VPC
  -> internet gateway

Imininingwane emibili inquma ukuthi ama-hop okugcina ayasebenza yini. I-NAT gateway kufanele ibe ngumphakathi, ine-elastic IP kanye nomzila oya ku-internet gateway, ngoba i-NAT gateway eyimfihlo ihumusha phakathi kwezinethiwekhi futhi ayisoze ibe yindawo yokuphuma ye-inthanethi.

Hlela i-NAT gateway eyodwa ku-Availability Zone ngayinye ohlose ukuyisebenzela, futhi ithebula ngalinye le-subnet likhombe kwelasekhaya. Gcina ithebula le-transit gateway namathebula e-VPC njengezinto ezihlukene kumanothi akho, ngoba elinye likhetha i-attachment kanti elinye likhetha insiza engaphakathi kwe-VPC. Umzila ozenzakalelayo kokunye kuphela ushiya ingxenye yendlela ingachazwanga futhi ukhiqiza ukwehluleka okuyingxenye okunzima kakhulu ukukuhambisa.

Lezi zidizayini zehluleka endleleni yokubuya

I-NAT gateway igcina isimo semifudlana eseyike yayibona, ngakho izimpendulo zoxhumano oluphumayo zibuya ngaphandle komthetho omusha wokungena. Leyo mpawu ayishicileli insizakalo yasendaweni ku-inthanethi, futhi ukuyiphatha ngokungathi iyashicilela kwenza iqembu lichithe usuku lilonke lilungisa uxhumano olwalungeke lusungulwe. Kuthrafikhi eqalwa yiklayenti, imizila emine kufanele ivumelane: inqubomgomo yasendaweni, ithebula le-transit gateway, ithebula le-subnet yokuphuma kanye nethebula le-subnet ye-NAT. Uma wephula owokugcina, isicelo siyaphuma esakhiweni kuyilapho impendulo ifela ngaphakathi kwe-AWS.

Qinisekisa ngeklayenti langempela elingemva kwe-VPN bese ubheka ukuthi likhombisa liphi ikheli lomthombo lomphakathi. Uma kuyi-elastic IP ye-NAT gateway, ukuhumusha kuyenzeka; uma kungolunye uhlobo, ulinganisa enye indlela yokuphuma.

Inguqulo engalingani yalokhu kwehluleka ifanele yaziwe kusenesikhathi. Lapho ithebula le-subnet ye-NAT lesifunda esithile se-Availability Zone linomzila wokubuya oya ku-prefix yeklayenti kanti elinye lingenawo, ukuxhumana okusha kuyaphumelela noma kwehluleke kuye ngokuthi umfudlana uwela kusiphi isifunda, futhi lelo phethini lifundwa ngokungeyikho njenge-inthanethi engazinzile. Qhathanisa amathebula e-subnet azo zonke izifunda ozisebenzelayo esikhundleni sokulungisa leso okwavulwa kuso ithikithi, ngoba umzila ongekho uyiyo yonke inkinga futhi kolunye uhlangothi akukho okudinga ukushintshwa.

Nini i-proxy esobala iyidizayini engcono

I-HTTP proxy kuyi-instance engaphakathi kwe-VPC yokuphuma iyindlela esemthethweni futhi evamise ukushibha. Amaklayenti amiswa ukuyisebenzisa, i-proxy ivula uxhumano lwayo ukuphuma, futhi indlela yokubuya iba inkinga yayo esikhundleni sokuba yindida yokuhambisa umzila ngokulingana. Ezinhlelweni ezimbalwa lokhu kususa ingxenye enkulu yomsebenzi we-transit gateway. Kunikeza futhi ukuloga ngomsebenzisi ngamunye i-NAT gateway engakwazi ukukukhiqiza.

Nokho ayicaci. Noma yini eyehlisa isithunzi sezilungiselelo ze-proxy, kanye nayo yonke iphrothokholi engeyona i-HTTP, ngeke ilandele leyo ndlela.

Ukukhetha kuncike kulokho izinhlelo zakho ezikhuluma ngempela kanye nokuthi ungakanani ukwaziswa okudingayo kumalogo. Lapho zikhuluma i-HTTP, i-proxy ithola indawo yayo; lapho udinga ukuphuma okuvamile kumaphrothokholi angahleliwe, idizayini ye-transit gateway iyona esekelwa yi-AWS. Ukunquma lokho kusenesikhathi kushibhile kunokukuthola ngemva kokwakhiwa kwamathebula emizila.