Nika amandla ukudluliswa kwe-IP kusizinda se-GCE VPN esivele sikhona

I-VM yadalwa ngaphandle kokudluliswa kwe-IP, isivele isebenza isofthiwe ye-VPN, futhi umuzwa uwukuthi iphinde yakhiwe kusukela kusifanekiso nefulegi ivuliwe. Lokho kwakha kabusha akudingekile. I-Compute Engine iveza i-canIpForward njengepropethi engabuyekezwa, futhi indlela yokubuyekeza ebhaliwe iyisebenzisa nge-refresh esikhundleni sokuqala kabusha. Lokho ifulegi elikulawulayo ngempela kuncane: ngaphandle kwalo, inkundla ilahla amaphakethe afika ku-instance kodwa angathunyelwanga ekhelini le-instance ngokwalo. Isizinda esidlulisela ithrafikhi yeminye imishini senza khona lokho, ngakho ifulegi kufanele livuliwe. Konke okulandela lokho ukuhlelwa kwesivakashi nokuhamba kwendlela, ifulegi elingakuthinti.

Ifulegi likuvumela ini, futhi lingakuvumeli ini

Uma ukudluliswa kuvaliwe, inkundla ithatha i-instance njengendawo yokugcina. Amaphakethe okulandelwa kwawo ikheli le-instance ngokwalo ayathunyelwa; amaphakethe okufanele i-instance iwadlulisele kwabanye awathunyelwa.

Uma ukudluliswa kuvuliwe, i-instance ingasebenza njengegxuma elilandelayo lomzila we-VPC, futhi yilowo mdlalo odingwa idivayisi ye-VPN. Ifulegi alisho lutho ngezindonga zomlilo, ukuhamba kwesivakashi, ukuhlelwa komhubhe noma izindlela zokubuya, futhi inani le-true esizindeni esiphukile liseyisizinda esiphukile.

Funda ipropethi yamanje

Hlola isethingi ngaphambi kokushintsha noma yini, usebenzisa i-describe yokufunda kuphela mayelana ne-instance, iphrojekthi nendawo okuhlosiwe:

gcloud compute instances describe VM_NAME --project PROJECT_ID --zone ZONE --format='value(canIpForward)'

Inani le-false libalulekile kuphela uma le VM kufanele ibe igxuma elilandelayo. Uma kunjalo, ingxenye esele yomzila kusamele ihlolwe ngokwehlukana, ngoba ipropethi iwumugqa owodwa ochungechungeni olude.

Buyekeza i-instance ekhona

Inqubo ye-Google yokubuyekeza izakhiwo ze-instance ikhipha insiza yamanje, ishintsha ipropethi futhi ithumela umphumela. Lokho kuwumsebenzi ohlukile kunefulegi le---can-ip-forward ngesikhathi sokwakha, futhi yilokho okusebenza ku-VM esebenzayo.

Qala ngokukhipha incazelo efayeleni lendawo, futhi gcina ikhophi engashintshiwe yokuqhathanisa:

gcloud compute instances export VM_NAME --project PROJECT_ID --zone ZONE --destination=instance.yaml

Kulelo fayela elikhiwe, setha ipropethi futhi ungashintshi enye into:

canIpForward: true

Gcina yonke insiza, kuhlanganise nesigxivizo sayo seminwe. Ukufaka esikhundleni sefayela idokhumenti ye-YAML yomugqa owodwa, noma ukuhlanganisa izilungiso ezingahlobene zohlobo lomshini, idiski noma isixhumi ekuthumeleni okukodwa, yikhona okwenza ukushintshwa kwepropethi kube ukuphazamiseka.

Cela indlela yokubuyekeza ukuthi iqinisekise ifayela futhi ibike lokho eyokudinga, ngaphambi kokuvunyelwa noma yikuphi ukushintshwa okusebenzayo:

gcloud compute instances update-from-file VM_NAME --project PROJECT_ID --zone ZONE --source=instance.yaml --most-disruptive-allowed-action=NO_EFFECT

Lowo msebenzi wokuqinisekisa awuvuli ukudluliswa. Funda impendulo mayelana nezakhiwo ezingavumelekile kanye nesenzo okuthiwa siyadingeka. Kulolu shintsho olwahlukile, isenzo esibhaliwe yi-REFRESH. Uma umphumela ucela ukuqala kabusha, ifayela liqukethe okungaphezu kwepropethi obufuna ukuyishintsha, ngakho lihlole esikhundleni sokuvumela ukuqala kabusha.

Sebenzisa ifayela elibuyekezwe ngomkhawulo we-refresh:

gcloud compute instances update-from-file VM_NAME --project PROJECT_ID --zone ZONE --source=instance.yaml --most-disruptive-allowed-action=REFRESH

Qinisekisa ukuthi umsebenzi uqedile bese uphinda ugijime umyalo we-describe. Uma isigxivizo seminwe singasafani, othile ushintshe i-instance ngesikhathi uhlela, ngakho khipha ikhophi entsha futhi ubuyekeze ukushintshwa futhi esikhundleni sokuphoqa ifayela lakho elidala.

Isivakashi kusamele sihamise iphakethe

Imvume yamafu ayiyenzi idivayisi ibe isihambisi sendlela. Qinisekisa ukuthi umzila we-VPC ukhetha le VM njengegxuma elilandelayo lesiqalo sendawo ekuyiwa kuyo, nokuthi isivakashi sihamba phakathi komhubhe nesixhumi esifanele ngokuvula inqubomgomo yaso yokudlulisa.

Inqubomgomo yodonga lomlilo kufanele ivume ukugeleza kwangaphakathi kanye nesilaleli sangaphandle. Ukuvula kuphela imbobo ye-VPN kuchaza ukuthutha okubethelwe futhi akusho lutho mayelana nokushintshana kohlelo lokusebenza ngaphakathi kwayo.

Ekugcineni, indawo ekuyiwa kuyo idinga indlela yokubuya eya echibini lamaklayenti, noma umklamo kufanele uhumushe imithombo ngamabomu. Uma indawo ekuyiwa kuyo ibona ithrafikhi ehumushiwe, hlola umthombo ohumushiwe; uma umklamo ugcina ichibi, hlola lelo chibi emzileni wokubuya nasemitherweni yokufinyelela. Ukwengeza i-NAT ngaphambi kokunquma ukuthi yimuphi umklamo owufunayo kufihla umzila ongekho futhi kushintsha inqubomgomo ebona indawo ekuyiwa kuyo.

Esizindeni se-Linux, ukudluliswa kwe-kernel kuyingxenye yokuhlelwa kwesivakashi. Idivayisi ye-pfSense inokulingana kwayo, futhi ukukopisha umyalo we-sysctl we-Linux kuyo akusona isinyathelo esifanele.

Qinisekisa kusukela kuklayenti odinga ukufinyelela

Hlola kusukela kuklayenti ye-VPN uya enkonzweni eyodwa eqondiwe, hhayi kusukela esizindeni ngokwaso. Ukuxhumana okuqalwa esizindeni kusebenzisa umthombo ohlukile futhi akukaze kusebenzise imithetho yokudlulisa oyivule manje.

Rekhoda ipropethi kunoma yini ephatha idivayisi. I-VM elungiswe ngesandla iyasebenza kuze kube ukushintshwa kwayo okulandelayo kubuyisela ngokuthule isethingi yokuqala, futhi lokho kwehluleka kuyobonakala njengokuhlehla kusofthiwe ye-VPN.

Ukulandelana komsebenzi: funda ipropethi, khipha futhi uhlele umugqa owodwa, qinisekisa nge-NO_EFFECT, sebenzisa nge-REFRESH, qinisekisa ukuthi isivakashi siyadlulisa, bese uhlola kuklayenti.