EC2 ezindaweni zokutholakala: hlola umzila ngaphambi kwe-VPN

Ngaphambi kokufaka isofthiwe ye-VPN phakathi kwezingxenyekazi ezimbili ze-EC2, phendula umbuzo owodwa: zingaphakathi kwe-VPC eyodwa? Uma zikuyo eyodwa, indlela yangasese isivele ikhona futhi ukubekwa ezindaweni ezihlukene akukushintshi lokho. Iningi lomsebenzi kulesi simo ukuqinisekisa ukuthi iyiphi ithebula yomzila esetshenziswa ngempela yi-subnet ngayinye, bese kutholakala ukuthi ukwehluleka kwakuyinkinga yomzila ngempela. Umhubhe ngokuvamile uyimpendulo engalungile kulo mbuzo othile.

Ukuhlola 1: i-VPC efanayo noma ama-VPC ahlukene

I-VPC ingeyesifunda futhi ihlanganisa izindawo zokutholakala, kuyilapho i-subnet ngayinye ingeyendawo eyodwa ncamashi. Izingxenyekazi ezimbili ezindaweni ezihlukene ze-VPC eyodwa zisengaphakathi kwesizinda somzila wangasese esifanayo.

Ama-VPC ahlukene awatholi umzila wangasese ngenxa nje yokuthi abelana ngesifunda noma ngelebula yendawo. Leyo ketile idinga ukuxhumana okusekelwayo kanye nomsebenzi wayo wemizila nezimvume, okuyisinqumo esihlukile.

Ukuhlola 2: amathebula omzila we-subnet athini

Bhala isakhiwo ngamanani angempela. I-VPC eku- 10.60.0.0/16 enama-subnet 10.60.1.0/24 kanye 10.60.2.0/24 inikeza izingxenyekazi 10.60.1.10 kanye 10.60.2.20 indlela edlula emzileni wendawo ye-VPC.

Bese uhlola amathebula ahlobene nawo womabili ama-subnet, hhayi lawo owathola kuqala kuphela. Umzila othile wokuhlola noma wedivayisi ungadlula umzila oyisisekelo, futhi umgomo womzila wendawo ngokwawo ungashintshwa ekucushweni okusha. Umzila wendawo obonakala endaweni ethile kukhonsoli awufakazi ukuthi yomibili imithwalo yomsebenzi iwusebenzisa.

Sebenzisa amakheli namagama angasese i-VPC ewabela ngempela. Ikheli langasese akudingeki liqale ngo-10, futhi ukuqamba elinye ngokukhumbula yindlela imvelo esebenzayo ehlolwa ngayo ngokungalungile.

Ukuhlola 3: umzila noma ugunyazo

Umzila uletha iphakethe engxenyeni yenethiwekhi yomgomo kuphela. Iqembu lokuphepha lomgomo lisadinga ukwamukela umthombo kanye nensizakalo, imithetho yokuphuma yomthombo kufanele ivumele isicelo, futhi noma iyiphi i-ACL yenethiwekhi kufanele ivumele izinhlangothi zombili ngoba ama-ACL awagcini isimo.

Ngale kwalokho kukhona i-firewall yesivakashi, ukubopha kwesilaleli kanye nobuwena besicelo uqobo. Noma yikuphi kwalokhu kungalahla isicelo umzila owuletha ngokuphelele.

Ukwamukela kufanele kube umsebenzi wangempela wesicelo. I-ping ephumelelayo ayiniki ukufinyelela kwesicelo futhi ayifakazi ukuthi igama le-TLS nezifakaziso zilungile, futhi i-ping evinjiwe ayifakazi ukuthi zonke izinsizakalo zangasese zimile.

Ukuhlola 4: ingabe ukuxhumana okuhlukile kudingeka ngempela

I-VPN isengaba yingxenye yomklamo, kodwa ngesizathu esishiwo: ukuxhuma le-VPC nehhovisi, ukwamukela amakhompiyutha aphathekayo noma ukuhlangabezana nemfuneko yongqimba olungaphezulu. Leso sizathu sihlukile ekuxhumaneni okuvamile ngaphakathi kwe-VPC eyodwa.

Khumbula futhi ukuthi i-VPC iyini hhayi ini. Akuyona isandiso segxenye ye-Ethernet yekhaya. Isicelo esincike ekutholeni ngokusakaza sinemfuneko ehlukile okufanele ihlolwe. Leso yisikhala somklamo hhayi iphutha lomzila.

Ukuhlola 5: umbuzo wokubethela

Ikheli langasese nomthetho wokuvumela awusho lutho mayelana nokuvikelwa kwe-cryptographic engxenyeni yesicelo. Uma idatha idinga ukuvikelwa kusukela ekupheleni kuya ekupheleni, lokho kuvela kuphrotokholi kanye nemodeli yobuwena esekelwa ngempela yinsizakalo.

Gcina izitatimende eziphathelene nongqimba lwenethiwekhi nongqimba lwesicelo zihlukene kuncwadi yomklamo, ngoba ukuzihlanganisa yindlela ukubuyekezwa okugcina ngayo kuqinisekisa ukuvikelwa okungekho muntu okwenzile.

Okufanele kurekhodwe

Rekhoda zombili izinhlamvu zama-subnet, ithebula lomzila elihlobene nelinye nelinye, izikhombo zeqembu lokuphepha kanye nomsebenzi wesicelo owuhlolile. Lawa amaqiniso amane, futhi axazulula iningi lezingxabano zesikhathi esizayo mayelana nalo mzila.

Ukubekwa endaweni kukodwa akukutsheli ungeze i-VPN, futhi akukuchazi ukuthi kungani isicelo sangasese sehlulekile.