Cloud VPN eya ku-VM ku-GCP: sebenzisa i-IP yangaphakathi, hhayi i-IP ye-NAT

Iphethelo lesango, ikheli langaphakathi le-VM kanye nekheli le-NAT langaphandle elilodwa-ku-elilodwa kunemisebenzi emithathu ehlukene. Hlola ukuthi umzila wakho usebenzisa yiphi.

Lapho inethiwekhi yasendaweni ifinyelela i-VPC nge-Cloud VPN, indawo okuya kuyo yesevisi ye-Compute Engine ngokuvamile iyikheli langaphakathi le-VM. Ikheli le-IPv4 langaphandle akulona ikheli lesibili ongalifaka emzileni ofanayo wangasese. Iningi lokudideka kulesi sigaba livela ekuthatheni amakheli amathathu anemisebenzi emithathu njengento eshintshanayo, ngakho qala ngokuqamba ukuthi yiliphi iphakethe elithile elilisebenzisayo.

Amakheli amathathu, imisebenzi emithathu

Qamba womathathu ngaphambi kokuxazulula noma yiliphi kubo, ngoba impendulo ishintsha into ozoyihlola ngokulandelayo.

AddressJob
Cloud VPN endpointwhere the IPsec peers meet
Internal IPthe address your route and firewall must name
External IPv4the platform's inbound mapping, not a guest address

Elokuqala lingelomhubhe. Elesibili lingelomzila wakho nomklamo womlilo. Elesithathu lingelokufinyelela kwe-inthanethi okungena futhi liyabalwa, alinanyathiselwa. Umklamo osebenza kwelinye kubo awusho lutho ngamanye amabili.

Kungani ikheli langaphandle lingelona uxhumano lwesibili

Umhlahlandlela wamakheli unegunya lokuthi ukufinyeleleka kwangaphakathi nokwangaphandle kuhluke kanjani ku-Compute Engine. I-IPv4 yangaphandle ye-Compute Engine iwukubalwa okulodwa-ku-elilodwa ku-NIC yangaphakathi eyodwa yesimo, ngakho isivakashi asikaze sibone uxhumano lwesibili noma ikheli lesibili kuleyo NIC. Lokho i-VM ekubikayo ngaphakathi kuseyikheli elilodwa eliyisisekelo langaphakathi.

Yingakho iklayenti langasese eliqondisa ngomhubhe kuya 10.24.1.7 kanye neklayenti eliqondise ekhelini langaphandle le-VM kusemizileni ehlukene. Ukuvula umthetho womlilo wekheli lomphakathi akushintshi lutho emzileni we-VPC okufanele uthwale ithrafikhi yomhubhe, futhi ukuhlela umzila kusivakashi akusisusi ukubalwa kwepulatifomu. Khetha ikheli eliqanjwe umzila wakho, bese uhlola kuphela izinto ezilawula lona. Lesi sikhathi sokusetshenziswa sisusa ukulinganisa okuningi kulo mzila wokuxazulula izinkinga.

Hamba umzila nge-gcloud

Qala esimweni futhi ufunde womabili amakheli entweni eyodwa, ukuze wazi ukuthi yiliphi idokhumenti yakho ekhuluma ngalo:

gcloud compute instances describe app-1 --zone=europe-west1-b \
  --format="value(networkInterfaces[0].networkIP,networkInterfaces[0].accessConfigs[0].natIP)"

Bese uqinisekisa umzila kanye nemvume umzila okuncike ngempela kuyo:

gcloud compute routes list --filter="destRange:10.24.1.0/24"
gcloud compute firewall-rules list --filter="sourceRanges:10.99.0.0/24"
gcloud compute vpn-tunnels describe TUNNEL_NAME --region=europe-west1

Funda izigaba ezimemezelwe nezifundiwe zomhubhe, umzila we-VPC wesixhumanisi somsebenzi, kanye nomthetho womlilo ovumela umthombo wasendaweni. Lezi zintathu kufanele zivumelane ngaphambi kokuba isilaleli kusivakashi sibe nokuhlangenwe nakho.

Bese uhlola isivakashi: ingabe isevisi ilalela ekhelini langaphakathi, futhi ingabe umzila wayo wokubuya ubuyela nge-VPC? Isilaleli esiboshelwe ekhelini lomphakathi kuphela sizohluleka kulesi sivivinyo ngisho noma yonke into ohlangothini lwefu ifanele.

Isiqalo somphakathi siwumbuzo ohlukile

Akukho kulokhu okungenhla okusho ukuthi wonke amakheli athwelwa ngaphakathi kwe-VPN kufanele abe yi-RFC1918. Inethiwekhi ekude inganikwa izinombolo ngokusemthethweni isuka esikhaleni somphakathi, inqobo nje uma ipulatifomu isekela umzila futhi umsebenzi unegunya lekheli. Lokho kuwukukhetha komklamo okuvamile.

Lokhu akufani nokuphatha ikheli le-NAT langaphandle elivamile njengokungathi lingelinye ikheli lesixhumanisi sangaphakathi. Elinye isiqalo osihambayo; elinye ukubalwa ipulatifomu elikufaka ekufinyeleleni okungena.

I-IPv6 yangaphandle kanye namalungiselelo amakheli aklanywe ngokukhethekile kunencazelo yawo. Uma uhlelo lwakho luncike kwelinye lawo, funda idokhumenti yepulatifomu yaleyo mpawu esikhundleni sokwenza okujwayelekile kusuka esimweni se-IPv4. Ukubalwa kwe-IPv4 kuyisimo esivamile, hhayi ukuphela, futhi izingqinamba ngayinye inemithetho yayo.

Izigaba ezigqagqene ziyinkinga ehlukile

Izigaba zangasese ezigqagqene ziyisizathu sangempela sokuthi abantu bafinyelele ekhelini lomphakathi, futhi lokho kuyisikhwili esingalungile. Ukushintsha indawo okuya kuyo iye ekhelini le-NAT le-VM akuxazululi ukugqagqana; kushintsha ukuthi iphakethe lithi ingeliphi ikheli, ngaphandle kokuchaza ukuthi umzila wokubuya usebenza kanjani.

Xazulula ukugqagqana ngamabomu: phinda unikeze izinombolo, sebenzisa umklamo wokuhumusha osekelwayo, noma qondisa ngonethiwekhi lapho iziqalo zingashayisani khona. Ngakunye kwalokhu kuwumklamo onomnini. Ikheli le-NAT akulona umklamo.

Bhala imikhakha emibili ngokwahlukene

Rekhoda umlingani womhubhe kanye nendawo yomsebenzi njengemikhakha emibili ehlukene ye-runbook, ngamunye nomzila kanye nomthetho womlilo owusekelayo. Umhubhe we-IPsec ophumayo utshela kuphela ukuthi izinhlangothi zivumelene; awusho lutho mayelana nokuthi umsebenzi ufinyeleleka kukuphi ikheli, futhi awusho nokuthi umzila wawo wangasese ugcwele yini.

Qinisekisa ngeklayenti langempela ohlangothini olunye: xazulula igama, qinisekisa ukuthi libuyisela ikheli langaphakathi, xhuma, futhi uhlole ithrafikhi ebuyayo. Idokhumenti yamakheli e-IP ye-Compute Engine iyisithenjwa somehluko wangaphakathi nowangaphandle osetshenziswe ngenhla.

Izihloko ezihlobene