Ithrafikhi ebuyayo ye-Azure P2S VPN isebenza ohlangothini olulodwa kuphela

Isithonjwana sethunu siluhlaza, i-NSG ibonakala ivuma, imizila esebenzayo ibonakala ilungile, kodwa i-VM ayikwazi ukuvula uxhumano olubuyela kumklami oxhunyiwe. Umcabango ojwayelekile ukuthi ithunu le-point-to-site elisebenzayo liyalingana: uma umklami efinyelela i-VM, ne-VM ifinyelela umklami. Lowo mcabango yiwo iphutha ekucabangeni, hhayi ekuhlelweni. Ithunu lingathwala uhlangothi olulodwa lomfula ongaceliwe futhi lilahle olunye, futhi ukulungisa kuncike ekutheni yiluphi ungqimba oluyilahlayo.

Inganekwane: ithunu elixhunyiwe liyithunu elinhlangothi ezimbili

Ithunu le-VPN liyindlela yenqubomgomo, hhayi intambo. Uhlangothi ngalunye luqhathaniswa nezikhethi, imizila nezihlungi, futhi noma yikuphi kuzo kungavumela uhlangothi olulodwa kuyilapho luvimbela olunye.

Empeleni ukungalingani kuvamile ngokwanele ukuthi uhlangothi kufanele lube kuhlelo lokuhlola lokuqala, hhayi lokugcina. Umklami uyaqala, isango lilandelela umfula, futhi impendulo ilandela isimo esidalwayo. I-VM eqala umfula omusha ayinaso leso simo, ngakho incike ekutheni indlela yokubuyela icace futhi ivunyelwe. Uma leyo ndlela ingekho, umzamo woxhumano uyafa ngaphambi kokuba noma yiluphi uhlelo lukubone.

Hlola uhlangothi ngaphambi kokuhlola ukufinyeleleka

Khetha ikheli ellodwa lomklami, ikheli ellodwa le-VM kanye neprotocol eyodwa. Xhumana usuka kumklami futhi urekhode umphumela; bese uqala ukuhlolwa okufanayo usuka ku-VM futhi urekhode nalokho. Uma okokuqala kuphumelela futhi okwesibili kwehluleka, iphuli yamaklayenti, ukuxhumana kwesango kanye nendlela esuka kumklami iya ku-VNet konke kuyasebenza.

Isinyathelo esilandelayo ubufakazi, hhayi imithetho eyengeziwe. Hlola i-NSG kusubneti ye-VM nhlangothi zombili, funda imizila esebenzayo ku-NIC ye-VM, futhi ubambe amaphakethe ku-VM ngenkathi umklami ethumela ithrafikhi. Isicelo esifika ngaphandle kwempendulo siyinkinga yesihlungi noma yendlela yokubuyela; isicelo esingafiki neze siyinkinga yendlela. Ungathathi i-ping ehlulekile njengobufakazi bokuthi i-VM ayifinyeleleki, ngoba inqubomgomo ye-ICMP ingalahla impendulo ngenkathi i-TCP isebenza.

Indlela yokubuyela ye-IKEv2 point-to-site iyisoliswa esijwayelekile

Embangweni we-Azure engemuva kwalesi sihloko, umklami wayekwazi ukufinyelela ama-VM nge-IKEv2, kodwa i-ICMP engenayo esuka ku-VM iya kumklami yehluleka kwaze kwashintshwa uhlobo lwethunu lesango laya ku-OpenVPN. Umbikeli uthi i-Microsoft yaqinisekisa umkhawulo endleleni ye-IKEv2 point-to-site, lapho ithrafikhi ebuyayo esuka ku-VM iya kumklami ingahlelwa ngendlela elinganayo ngaphandle uma umklami eqale iseshini. I-IKEv2 incike kuzikhethi zethrafikhi, futhi isango alizange lihloniphe uhlangothi lokubuyela kuleso simo.

Lokho akwenzi i-OpenVPN ibe uhlobo lwethunu olungcono ngokujwayelekile. Kwenza uhlobo lwethunu lube ukuguquguqukayo kumatrix wokuhlola walo mthwalo womsebenzi.

Ukushintsha uhlobo lwethunu wushintsho lwesevisi, hhayi iswishi. Iklayenti ngalinye lidinga iphrofayili ehambisanayo, futhi isango lingase lidinge isitifiketi noma ukuhlelwa kokuqinisekisa okuhlukile. Phinda ukuziphatha kohlangothi olulodwa ngeklayenti lokuhlola ellodwa ne-VM yokuhlola eyodwa, shintsha uhlobo ngokuhlela okuvunyiwe, bese uphinda ukuhlolwa kohlangothi okufanayo. Uma ukuziphatha kusinda ngemuva koshintsho, uhlobo lwethunu kwakuyisizathu hhayi lona futhi unciphise inkinga ngaphandle kokuthinta ukukhiqiza.

Inganekwane: ukutholwa nge-broadcast kweqa umngcele we-VNet

Umcabango wesibili wehluleka ngesizathu esingahlobene. Inethiwekhi ebonakalayo ye-Azure ayithwali ithrafikhi ye-broadcast, ngakho i-VM ayikwazi ukuthola amafreyimu e-broadcast avela kunethiwekhi yasendaweni ngoxhumano lwe-site-to-site noma point-to-site. Izinhlelo ezithola ontanga nge-broadcast, njengokuphenya amafayela amadala noma amanye amaphrothokholi okuthola idivayisi, aziyi kuyibona neze uhlangothi olukude, kungakhathaliseki ukuthi imizila ibhalwe kanjani.

Faka esikhundleni sokutholwa nge-broadcast amagama e-DNS, isevisi yohlu lwamabhuku noma uhlu olucacile lontanga. Uma uhlelo lungenayo enye indlela ye-unicast, umklamo udinga indlela ehlukile yokuthola, hhayi ithunu elibanzi.

Yini okufanele ishintshwe, futhi kufakazwa kanjani

Uma ukuhlolwa kohlangothi kwehluleka ku-IKEv2 kuphela, rekhoda uhlobo lwethunu lesango, iphuli yamakheli amaklayenti kanye nokuhlolwa okuqondile kwe-ICMP noma i-TCP, bese uhlola iphrofayili ye-OpenVPN evunyiwe yamaklayenti athintekile. Uma kwehluleka kulo lonke uhlobo lwethunu, sebenza ngendlela yokubuyela: ikheli leklayenti kufanele lihlelwe lisuka kusubneti ye-VM, noma yimuphi umzila ochazwe umsebenzisi kufanele ukhombe isinyathelo esilandelayo esivumelekile, futhi i-firewall yeklayenti kufanele yamukele umfula ongenayo. Namathisela ubufakazi be-NSG nemizila kuthikithi.

Qinisekisa ngohlelo, hhayi nge-ping. Ukushintshana kwe-ICMP okuphumelelayo ngemuva koshintsho akusho lutho ngephothi lesevisi, ukuqinisekisa kwayo noma ukuxazululwa kwamagama. Phinda ukuhlolwa ngemuva kokuxhumana kabusha, ngoba iklayenti elithola ikheli elihlukile epulini lingashintsha umphumela. Bese uphinda futhi ngemuva kokuba iklayenti lilele futhi livuke, ngoba kuseseshini eqalwe kabusha lapho ukuziphatha kohlangothi olulodwa kuvame ukuvela futhi.