Ukuvinjwa kwendawo kwe-CloudFront ngemuva kwe-VPN: hlola indlela yokuphuma

Umkhawulo wendawo uyisinqumo mayelana nekheli le-IP, futhi i-VPN ishintsha ukuthi yiliphi ikheli isevisi elibonayo. Lowo musho owodwa uchaza iningi lemibiko edidayo efika emgqeni wosekelo: «isayithi iyasebenza ekhaya futhi yehluleka emhubheni» kanye «isayithi iyasebenza emhubheni kodwa akekho omunye ehhovisi ongayilayisha» kuyindlela eyodwa ekhiqiza imiphumela ephambene. Le ncwadi yokuqondisa ihamba ngokuxilonga ngokulandelana okususa izimbangela, iqala ngokushiwo i-edge kuwe ngempela. Ikheli lokuphuma elifanayo lingadlula ukulawula okukodwa bese lehluleka kwelilandelayo, ngoba ukulawula ngakunye kuhlola isici esihlukile salelo kheli.

Funda i-403 ngaphambi kokushintsha noma yini

Ukuvinjwa kwendawo nokuvinjwa kwe-WAF kufika kokubili njenge-403, futhi kulungiswa ezindaweni ezihlukene. Thwebula izihloko zempendulo nomugqa wokuqala womzimba, ngoba i-CloudFront yengeza isihloko se-cache kanye nomucu wesizathu okutshela ukuthi yiluphi ungqimba oluphendulile:

curl -sS -o /tmp/body.txt -D /tmp/headers.txt https://d111111abcdef8.cloudfront.net/
grep -i "x-cache\|via" /tmp/headers.txt
head -c 300 /tmp/body.txt

Lapho ukusabalalisa ngokwako kuvimba isicelo ngenxa yendawo, umzimba uthwala umyalezo osho umkhawulo wezwe. Lapho umthetho we-WAF ukuvimba, umzimba ngokuvamile uyikhasi elijwayelekile elivinjiwe futhi i-ID yesicelo sokusabalalisa ezihlokweni yiyo oyiyisa kumarekhodi e-WAF. Iphutha lapha likuthumela ohlwini lwamazwe avunyelwe ngenkinga yomthetho osuselwa ezingeni, okuwusuku lomsebenzi olungeke luphumelele.

Isinyathelo 1: qinisekisa ukuthi ukusabalalisa kubona liphi ikheli

Buza inethiwekhi ukuthi umhlaba wangaphandle ubona ini, kusuka emshinini ofanayo nasendleleni efanayo esetshenziswa isiphequluli esihlulekayo. I-curl -s https://checkip.amazonaws.com ibuyisela ikheli lomphakathi lomshayeli, okuthi kuklayenti ye-VPN kube indlela yokuphuma hhayi uxhumano lwasekhaya lomlangizi:

curl -s https://checkip.amazonaws.com
nslookup d111111abcdef8.cloudfront.net

Uma lelo kheli lingelokuphuma komhlinzeki wakho kwelinye izwe, isinqumo sendawo sesithathiwe futhi akukho lutho kuklayenti okuzokushintsha. Bhala ikheli kuthikithi ngaphambi kokuthinta isethingi, ngoba iyona kuphela iqiniso embikweni enivumelana ngalo wena nesevisi.

Isinyathelo 2: hlukanisa izwe nedumela

I-CloudFront inquma indawo yombukeli kusuka kusizindalwazi se-GeoIP senhlangano yesithathu esisekelwe ekhelini lomthombo lesicelo, futhi ukumephwa kuyalinganiselwa futhi kuyisifunda, hhayi ukunquma okunembile. Lapho indawo ingakwazi ukunqunywa, okuyilungiselelo elibhaliwe ukuthi isiqikili silethwe noma kunjalo. Ngakho kunezimo ezintathu ezingaba khona: indlela yokuphuma imephwa ezweni elivinjiwe, ezweni elivunyelwe, noma isizindalwazi asinawo umbono futhi isicelo siyaqhubeka.

Umsebenzisi ezweni elivinjiwe angabonakala sengathi uses ezweni elivunyelwe uma umhlinzeki enendlela yokuphuma lapho, futhi umsebenzisi ezweni elivunyelwe angavinjwa ngoba indlela yokuphuma ibhaliswe kwenye indawo. Akukho mphumela ofakazela ukuthi umkhawulo uphukile. Kokubili umkhawulo usebenza ekhelini elinikeziwe, njengoba idokhumenti yemikhawulo yendawo ye-CloudFront ichaza.

Idumela iyunithi yesibili futhi liyasinda emhubheni. Iqembu lemithetho elilawulwayo le-AWS WAF lamakheli e-IP angaziwa lakhelwe ukuvimba izicelo ezivela kuma-VPN, ama-proxy, ama-node e-Tor nabahlinzeki bokuphakelisa, ngakho isicelo esidlula ukuhlolwa kwezwe singasenqatshwa ngenxa yokuthi ikheli liyini, hhayi ukuthi likuphi. Uma ukuvinjwa kwaqala lapho uthutha umhubhe waya kumsingathi wefu, lokhu cishe yilona ungqimba.

Isinyathelo 3: hlola indlela yokuziphatha kwesabelo

Izindlela zokuphuma ezabiwe zehluleka ngendlela yesithathu. Imikhawulo yejubane nge-IP ngayinye kanye nokubalwa kwemihlangano kuthatha ikheli elilodwa njengeklayenti elilodwa, futhi indlela yokuphuma yomthengi ithwala ababhalisi abaningi ngesikhathi esisodwa, ngakho iphethini yezicelo engaqhathaniseki kusuka kuxhumano lwasekhaya ibonakala njengokuzenzakalela kusuka endleleni yokuphuma. Uphawu ukuvinjwa noma ukuvimba kwesikhashana okuzisusa ngokwako, hhayi umyalezo wephutha lendawo.

Ukusabalalisa kungabala amahlandla ngekheli ngamunye ngamabomu, isibonelo ngomsebenzi we-Lambda@Edge obhala ku-DynamoDB. Lokho akukhombanisi umuntu ongemuva kwendlela yokuphuma, kodwa kwenza ikheli elilodwa liziphathe njengeklayenti elilodwa, okuvamise ukuba yinhloso yangempela. Rekhoda amakheli ahlukene angemuva kwesikhalazo ngaphambi kokulungisa noma yimuphi umkhawulo, ngoba i-NAT yenkampani phambi kwamadeski angamakhulu amabili ibonakala ngaphandle kufana ncamashi nendlela yokuphuma ematasa. Lindela okuhle okungelona iqiniso okuvela ku-NAT yenkampani, inethiwekhi yenyuvesi noma umndeni omkhulu wonke owethula ikheli elilodwa.

Bheka izicelo eziyisampula ze-WAF kanye nezilinganiso zemithetho esuselwa ezingeni ngaphambi kokusola indawo. Umthetho ovutha ngobuningi bezicelo zendlela yokuphuma ushiya isiginesha ecacile, futhi ukutshela nokuthi ukulungiswa ukulungisa umkhawulo noma enye indlela yokuphuma.

Yini okufanele ishintshwe, futhi ngaluphi uhlelo

Qala ngokunquma ukuthi ukulawula kungenzani. Ukugcina ikhathalogi yesifunda, ukunciphisa ukusetshenziswa kabi nokuphoqelela inkontileka kuyimigomo emithathu ehlukene, futhi eyokuqala kuphela ebhekwa nguhlu lwamazwe. Uma umgomo ukulawula ukusetshenziswa kabi, indlela yokuphuma iyiyunithi engalungile yobuqobo, futhi noma yiliphi inani lamahlu avunyelwe ngeke lenze ikheli elabiwe lithembeke.

Uma ikheli elizinzile ngempela lidingeka ohlwini oluvunyelwe, indlela yokuphuma ezinikezelwe noma emile iyasiza ngoba ikheli lingabhaliswa futhi alijike. Ayilenzi ikheli libe yindawo yokuhlala, futhi ayishintshi izwe elinikezwa isizindalwazi se-GeoIP. Ukujika kwezindlela zokuphuma kuze kusebenze eyodwa ukushintsha kwedumela kwesikhashana, hhayi ukulungiswa kwenqubomgomo.

Bese ubhala umphumela ngamagama asetshenziswe umfakisicelo: leli kheli livinjiwe ngezwe, ngedumela noma ngezinga, futhi lokhu ukulawula okuzoshintsha. Noma yini engacacile kunalokhu imema ithikithi elifanayo ngesonto elizayo ngendlela ehlukile yokuphuma.