Ama-IP amabili omphakathi ku-Azure VPN VM eyodwa: yiphi eyenza ini

Ama-IP amabili omphakathi ku-Azure VPN VM eyodwa akha ithemba elingavamile ukugcwaliseka: ikheli amakhasimende axhuma kulo liyoba yikheli futhi amasayithi ewebhu alibonayo. Izinqumo ezintathu ezizimele zikhiqiza lowo mphumela, futhi eyokuqala kuphela ephathelene nesilaleli sethumbu. Eyesibili ingumthombo wesivakashi osetshenziselwa ithrafikhi yekhasimende edluliswayo, futhi eyesithathu indlela yokuphuma ye-Azure esebenza kulo mthombo. Shintsha eyodwa kanti ezinye ezimbili zihlala lapho zazikhona, ngakho nquma ngayinye ngokucacile.

Isinqumo 1: ithumbu liphelela kuphi

I-IP yomphakathi ye-Azure ihlotshaniswa nokuhlelwa kwe-IP yangasese ku-NIC; akuyona ikheli oyengeza ngaphakathi kwesistimu yokusebenza yesivakashi. Funda ukumephu esikhundleni sokucabanga: az network nic show --ids /subscriptions/.../networkInterfaces/vpn-nic --query 'ipConfigurations[].{private:privateIPAddress,public:publicIPAddress.id}'. Noma yiliphi ikheli langasese elibuyiswa yilowo mbuzo yilona okufanele isivakashi sibe nalo ngempela.

I-NIC eyodwa ingathwala ukuhlelwa kwe-IP okuningi, ngakho amakheli amabili omphakathi awadingi ama-NIC amabili. Uma umklamo usebenzisa ngempela ama-NIC amabili, ngayinye iletha imizila yayo yesivakashi kanye namagxuma alandelayo, futhi wengeze isinqumo somzila esikhundleni sokwenza lula esisodwa.

Kumsebenzi onokubopheka kwendawo okucacile, bopheka ekhelini langempela langasese lesivakashi, hleze ubopheke esikhundleni somphakathi. Isilaleli esamukela wonke amakheli sithola ithrafikhi ngakho konke ukuhlelwa kwe-IP okusifinyelelayo, ngakho khawulela ukungena ngeqembu lokuphepha lenethiwekhi kanye nomthombo womlilo womsingathi esikhundleni sokuthemba ukuthi ukulandelana kokubopheka kuzonquma.

Isinqumo 2: imuphi umthombo osetshenziswa yikhasimende elidluliswayo

Ngemva kokuba isango lixazulule isicelo sekhasimende, iphakethe elilidlulisayo lihlukile kulelo elifike kusilaleli se-VPN. Isivakashi sidinga ukudluliswa okuvunyelwe, inqubomgomo yomthombo womlilo evumela ukugeleza, kanye nekheli lomthombo elivunywa umklamo wamafu. Uma uhumusha ikheli langaphakathi lekhasimende, umthombo ohumushiwe yiwona i-Azure ezowuhlola, hhayi ikheli langaphakathi lekhasimende.

Umthetho omncane we-SNAT ungakhetha umthombo oyimfihlo wesivakashi, kodwa awukwazi ukweqa ukuhumusha kwe-Azure okulandela. Khetha i-SNAT uma udinga ukuphendula ngekhasimende ngakunye ngaphakathi kwe-VM; kuyeke uma umklamo wokuphuma wesubneti usunikeza umthombo womphakathi ozinzile futhi ukuhumusha kwesibili kungangeza isimo kuphela.

Isinqumo 3: iyiphi indlela yokuphuma ye-Azure enqobayo

I-Microsoft ibhalaukulandelana kokubaluleka kokuphuma: umzila osebenzayo oya kudivayisi noma esangweni unokubaluleka, futhi ukuxhumana kwesubneti nge-NAT Gateway kunokubaluleka ngaphezu kwe-IP yomphakathi yezinga lesenzakalo emzileni ofanele. Yilokho kulandelana okuyisizathu sokuthi ukuhumusha ku-10.20.0.5 akufakazi ukuthi isayithi lewebhu lizobona i-198.51.100.20. Funda ithebula lemizila elisebenzayo, ukuxhumana kwe-NAT Gateway kanye ne-IP yomphakathi ye-NIC ndawonye ngaphambi kokwamukela umklamo wokuphuma.

Gcinaisethingi yokudlulisa ye-Azure NICihlukile ekudluliseni kwe-Linux. Ifulegi lamafu livumela amaphakethe umthombo noma indawo yawo engabelwanga i-NIC; alivuli net.ipv4.ip_forward, futhi isethingi yesivakashi ayinikezi imvume yamafu.

Isokhethi yethumbu inesinqumo sayo somthombo

Address ye-WireGuard ngaphansi kwe-wg-quick yabela ikheli kusixhumi se-WireGuard; akuwona umyalelo wokubopheka kwe-UDP wangaphandle. Umthombo wesokhethi ebethelwe ulandela ithebula lemizila, ngakho umzila wenqubomgomo noma umzila wokuqala wesibili ungayisusa ngaphandle kokuthinta ikheli lesixhumi.OpenVPN: inketho ye-local kanye ne-UDP multihome ziziphatha ngendlela efanayo: ziphathelene nesilaleli nezimpendulo zaso, hhayi nomthombo we-inthanethi wekhasimende ngalinye elidluliswayo.

Gcina umzila wengqimba engezansi othwala ithumbu, futhi qinisekisa ukuthi ikhasimende lisathola izimpendulo eziqinisekisiwe ezivela ekuhlelweni kokungena okulindelekile. Ungathembeli ekulandelaneni kohlu lwamakheli njengenqubomgomo yaphakade yokukhetha umthombo, ngoba ikheli elilandelayo elengezwa ku-NIC lingashintsha ukuthi yiliphi elinqobayo.

Yini okufanele yamukelwe, futhi ngakuliphi ukulandelana

Yamukela imiphumela emithathu ngokwehlukile. Okokuqala, ikhasimende langaphandle lifinyelela ukungena kwe-VPN okuhlosiwe. Okwesibili, isicelo esisha esivunyelwe esivela kulelo khasimende le-VPN siphuma ngokuphuma kwe-inthanethi okubhaliwe. Okwesithathu, imizila yesilaleli nokudlulisa engahlosiwe ihlala inqatshiwe. Bhala ukumephu kusuka komphakathi kuya kowangasese kanye nabanikazi besivakashi namafu besinqumo ngasinye endaweni eyodwa.

Ithumbu eliphumelelayo lifakazela ingxenye yokuqala kuphela. Hlola ukuphuma ngokugeleza okusha, ngoba ukuxhumana okugcinwe kunqolobane kungaqhubeka kusebenzisa umthombo omdala isikhathi eside ngemva kokushintsha komzila.