I-CIDR yasendaweni neyedlulekile ku-AWS VPN: yiluphi uhlangothi oluluphi?

Uvula izinketho ze-Site-to-Site VPN, ubona amabhokisi amabili e-CIDR abhalwe ukuthi asendaweni nasedlulekile, bese welula isandla sakho ebukhosini ocabanga ukuthi busendaweni: i-VPC. Lokho kuphambene nalokho okushiwo i-API. Kuzinketho zokuxhumana, i-LocalIpv4NetworkCidr isho uhlangothi lwesango lekhasimende kanti i-RemoteIpv4NetworkCidr isho uhlangothi lwe-AWS, ngoba ukuxhumana kwakhiwa kusukela esangweni lekhasimende. Ikhonsoli ayikusho lokhu ngokuzwakalayo, futhi akukho okwenqabayo ukushintshwa okubonakala kukholakala.

Qala ocingweni lwe-API, hhayi ilebula lekhonsoli

Funda ireferensi yezinketho zokuxhumana kanye ngokuphelele bese ubona ukuthi yonke inketho ibhalwe ngokombono wesango lekhasimende. Lokho akusona isigameko sokuthiwa. Ithaneli lichazwa ngendlela elibonakala ngayo kudivayisi eliphetha ngakho ohlangothini lwakho, ngakho okusendaweni kusho inethiwekhi engemuva kwesango lakho kanti okwedlulekile kusho inethiwekhi engemuva kwesango le-AWS. Zombili izinkambu ze-IPv4 ne-IPv6 zilandela umthetho ofanayo.

Bhala amalebula amabili ephepheni elinamathelayo ngaphambi kokuthayipha noma yini: uhlangothi lwekhasimende, uhlangothi lwe-AWS. Bese uhlobanisa amakheli akho nawo.

Isibonelo esetshenziwe esinezindima

Ake sithi isiqalo sasendaweni singu-10.20.0.0/16 kanti isiqalo se-VPC singu-10.60.0.0/16. Izinketho zifundwa ngqo njengoba izindima zisikisela, nebanga lasendaweni likunkambu yasendaweni:

{
  "LocalIpv4NetworkCidr": "10.20.0.0/16",
  "RemoteIpv4NetworkCidr": "10.60.0.0/16"
}

Manje nikeza labo abahlela idivayisi enguzakwabo lelo bhangqa elifanayo bese ubuka ukuthi ugibe lusebenza kanjani. Kuma-firewall amaningi, okusendaweni kusho isixhumi esibonakalayo lapho ithaneli liphela khona kanti okwedlulekile kusho umkhawulo okude, okuwukuhlelwa okuphambene ohlangothini lwe-AWS. Bobabili bangase babe neqiniso futhi bakhiqize ithaneli elingaqedi, ngoba amagama amabili achaza imikhawulo ehlukene.

Phinda umsebenzi ephepheni ngamagama ozakwabo, nawo womabili ama-CIDR nawo womabili amalebula, ngaphambi kokuthinta noma iyiphi idivayisi.

Amanani okuzenzakalelayo awuwona umklamo

Ireferensi efanayo ibala u-0.0.0.0/0 njengokuzenzakalelayo kuzo zombili izinkambu ze-IPv4, namanye amanani afanayo e-IPv6. Ukubona lawo manani kuxhumano olukhona kukutshela ukuthi inkambu ayikaze incishiswe, hhayi ukuthi indlela yokuphuma ku-inthanethi ihleliwe. Ukusatshalaliswa kwemizila, ithebula lemizila yenethiwekhi encane kanye nezilawuli zokuphepha kusengikho okunquma ukuthi iyiphi ithrafikhi engadlula ngempela; amanani e-CIDR achaza kuphela ukuthi yimaphi amabanga ithaneli elikulungele ukuwakhetha.

Ngakho ukushintsha inani elincane ngenani lokuzenzakalelayo akuwona iqhinga lokuhambisana ongalisebenzisa lapho ithaneli liziphatha kabi. Landisa isikhethi futhi lishiya yonke enye ingqimba njengoba yayinjalo.

Idivayisi enguzakwabo isebenzisa omunye umbono

Lapho uhlangothi lwe-AWS selucacile, ukuhlelwa kukazakwabo yikhona okugcina ingxenye enkulu yokudideka okusele. Idivayisi ecela inethiwekhi yasendaweni nenethiwekhi eyedlulekile ichaza isixhumi sayo siqu njengesasendaweni, ngakho ibanga lakho le-VPC lingena enkambini yayo eyedlulekile kanti ibanga lakho lasendaweni lingena enkambini yayo yasendaweni. Uma kunjalo icela izikhethi zethrafikhi ngamabhangqa, ubhala zombili izinhlangothi ngokusobala futhi amalebula awabalulekile njengokubhangqa.

Funda usizo lwezinkambu zedivayisi, hhayi amagama ezinkambu zayo. Abakhiqizi basebenzisa amagama amabili afanayo emiqondweni emithathu ehlukene.

Bese uhlola isimo sethaneli kuzo zombili izigaba, ngoba isikhethi esingahambisani sivame ukuvela njengokuhluleka kwesigaba sesibili kuyilapho isigaba sokuqala simile ngokuthula sizinzile.

Shintsha izinketho njengoshintsho, hhayi njengemibhalo

Ukuhlela izinketho zokuxhumana ku-VPN esebenzayo kungaphazamisa insizakalo, ngakho kuthatha njengomsebenzi wokunakekela onesikhathi esimisiwe, inani lokubuyisela kanye nenothi lokuthi ubani uthintekile. Qala uqophe izinketho zamanje, kufaka zombili izinkambu ze-CIDR nezinketho zethaneli, ukuze ukubuyisela kube ukunamathisela hhayi ukwakha kabusha.

Ngemva koshintsho, qinisekisa ohlangothini lwe-AWS nasezakwabo: umthombo kubanga ngalinye ufinyelela indawo ekuyunywe kwenye, kuzo zombili izinhlangothi. I-ping eyodwa ohlangothini olulodwa ifakaza isikhethi esisodwa kuphela.

Bese ubuyekeza imibhalo yoxhumano nezindima zibhaliwe, ukuze umuntu olandelayo angadingi ukuphinda athole ukuthi okusendaweni kusho uhlangothi lwakho.