EC2 Windows: iklayenti le-VPN, iseva ye-VPN noma isango le-AWS?
I-EC2 instance ye-Windows ingasebenzisa isofthiwe ye-VPN, kodwa iklayenti, iseva ezilawulwa ngokwakho kanye nesango le-AWS yizindima ezahlukene ezinabanikazi abahlukene.
Ithimba lidinga ukuxhumana kwe-VPN kuhlelo lokusebenza olugijima ku-EC2 instance ye-Windows, lithola isofthiwe yeklayenti ehambisanayo, liyifaka, bese libuza ukuthi kungani ingxenye esele ye-VPC ingakwazi ukuyisebenzisa. Ukufaka kusebenzile; indima ayikaze inqunywe. Isofthiwe egijima ngaphakathi kwisivakashi ingaba iklayenti elijoyina inethiwekhi yomunye umuntu, iseva eyamukela amanye amaklayenti, noma engekho kuyo yomibili imikhiqizo ye-VPN ephethwe yi-AWS, futhi indima ngayinye ishiya umsebenzi ohlukile kuwe.
Uphawu ngokuvamile yindima engalungile
Uphawu oluvamile iwumhubhe osebenza kodwa oxazulula inkinga engalungile. Iklayenti elingaphakathi kwe-VM linikeza leyo VM indlela yokuphuma; alinikezi ikhompyutha yakho ephathekayo, ihhovisi lakho noma enye isubnet indlela yokungena. Iseva engaphakathi kwe-VM inikeza abanye indlela yokungena, kodwa manje ungumnikazi wesilaleli, ukuqinisekisa kanye nokudlulisela.
Izinsizakalo eziphethwe zihambisa ukusebenza kwensizakalo ku-AWS futhi zishiya umklamo kuwe. I-Site-to-Site VPN ixhumanisa amanethiwekhi ngesango lekhasimende nesango le-AWS, futhi i-Client VPN inikeza amadivayisi akude indawo yokugcina ephethwe. Kuzo zombili izimo imizila, imithetho yokugunyaza kanye nomthombo wobunikazi kuwukulungiselela kwakho, futhi awekho umkhiqizo ofaka iklayenti elijwayelekile ngaphakathi kwisivakashi se-Windows.
Izimo ezine zingenzeka, futhi ithebula liyahlukanisa ngokuthi yini ixhumana nani nokuthi ngubani ophethe umthwalo wokusebenza.
| Role | What connects | Who owns the VPN software |
|---|---|---|
| Client in the Windows VM | This VM dials out into someone else's network | You, plus the software vendor |
| Server in the Windows VM | Inbound clients and sites attach to this VM | You, end to end |
| AWS Site-to-Site VPN | Two networks meet through a customer gateway and an AWS gateway | AWS operates the tunnels; you own the peer and route design |
| AWS Client VPN | User devices attach to an endpoint AWS operates | AWS operates it; you own the access rules |
Funda umugqa, hhayi igama lomkhiqizo: i-instance efanayo ye-Windows ingaba emigqeni emibili ehlukene kuye ngesofthiwe egijima kuyo.
Iklayenti ngaphakathi kwe-VM: i-VM ijoyina inethiwekhi
Iklayenti eliphumayo kufanele lihlolwe ukwakheka kwe-Windows, isakhiwo kanye nezimfuno zedrayiva ngaphambi kokufakwa kwanoma yini. Iklayenti lizoshintsha imizila ne-DNS ku-instance, okungase kuthinte izinsizakalo ezivele zigijima lapho, kuhlanganise nendlela oyisebenzisayo ekuphathweni kude. Bhala igama le-adaptha kanye nenkomba yesikhombimsebenzisi ebekwe yiklayenti, ngoba isikhombimsebenzisi esisha singase sithole ukubaluleka ngaphezu kwesikhona. Uma i-instance iphethwe ngumphathi wesikhathi esikhundleni se-SSH noma i-RDP, qinisekisa ukuthi leyo ndlela isasebenza ngemva kokuxhumanisa kweklayenti.
Nquma ukuthi iyiphi ithrafikhi okufanele iklayenti liyithwale ngaphambi kokulivula. Umhubhe ogcwele ungase ubambe isikhathi sokuphatha futhi kukhiye ngaphandle, kanti umhubhe ohlukanisiwe ungase uvumele i-instance ukufinyelela inethiwekhi yangasese ngenkathi enye ithrafikhi yayo ithatha enye indlela yokuphuma. Hlola ngokuthi ikhona enye indlela yokuphatha, futhi bhala imizila efakwa yiklayenti ukuze ushintsho lwakamuva luchazeke.
Iseva ngaphakathi kwe-VM: amanye amaklayenti ajoyina kuyo
Kuseva ezilawulwa ngokwakho ungumnikazi wesilaleli, isitifiketi noma into yokhiye, isizindalwazi sabasebenzisi kanye nemithetho yokudlulisela. Uma iseva idlulisela ithrafikhi kumanye amaklayenti, i-instance iba yirutha, futhi lokho kudinga ukudlulisela ezingeni lesivakashi kanye nezinguquko zomzila neqembu lokuphepha ezingeni le-AWS.
Hlola isilaleli kusukela esivakashini futhi futhi kusukela kwenye isubnet, bese uhlola umsingathi i-instance edlulisela kuwo. Insizakalo yasendaweni ephilile ayifakazeli lutho ngomzila odlulisiwe, ngakho bhala zombili iziphumo encwadini yoshintsho.
Amasango aphethwe agcina insizakalo, hhayi umklamo wakho wokufinyelela
AWS Site-to-Site VPN ibhala izindima zomhubhe zesango lekhasimende nesango le-AWS, futhi ukuthenga lokho kuxhumana akuthathi indawo yawo wonke umklamo wokufinyelela kude. I-Client VPN ibhala indawo yokugcina ephethwe enamaphrofayili eklayenti, kuyilapho imithetho yokugunyaza nemizila eqondiwe kuseyakho. I-AWS igcina indawo yokugcina kanye nezitifiketi zayo kusebenza; ukuthi ubani angafinyelela kuphi uhlelo lokusebenza kusewumthetho wokugunyaza oyibhalayo futhi oyigcinayo.
Khetha phakathi kwemikhiqizo emigqeni emihlanu: iyiphi indima edlalwa yilowo nalowo, yikuphi ukuphothula okuyemukelayo, yimuphi umthombo wobunikazi awulindele, ithrafikhi idluliselwa kanjani futhi ukutholakala kunikezwa kanjani. Ziba phansi noma iyiphi inombolo eyodwa yokugeleza kwenziwe kuyo isihloko senkundla, ngoba umthamo oshicilelwe uhamba nensizakalo. Futhi ungacabangi ukuthi ipheya yomhubhe ephethwe ishintsha ukuziphatha kweklayenti lesivakashi elithandile.
Khetha indima ngaphambi komkhiqizo
Bhala umusho owodwa osho isiqondiso: le VM ijoyina inethiwekhi, le VM yamukela amaklayenti, noma isango le-AWS ixhumanisa amanethiwekhi achaziwe.
Lowo musho unquma uhlu olufushane lwemikhiqizo, umnikazi wesofthiwe kanye nezimo zokuhluleka ozozilungisa. Uma imfuneko iwukuthi abasebenzisi bakude bafinyelele uhlelo lokusebenza, iklayenti efakwe ku-VM yohlelo lokusebenza iyisimo esingalungile. Uma imfuneko iwukuthi i-VM eyodwa ifinyelele inethiwekhi kazakwethu, isango lendawo-kuya-ndawo eliphethwe lingumshini omningi kunalokho okudingwa umsebenzi. Zombili izimpendulo zisemthethweni; eyodwa kuphela ehambisana nomusho oyibhalile.