I-OpenVPN ku-GCE: engeza i-alias IP ngaphambi kokupusha amaroute

Iklayenti ixhumana neserver ye-OpenVPN ku-VM ye-Compute Engine, iwindi lesimo lithi ixhunyiwe, kodwa i-ping eya kumhambi ngaphakathi kwe-VPC ayifiki ndawo. Umzwelo uthi engeza omunye umugqa we-push, futhi lokho akukulungisi neze. I-Compute Engine inquma ukuthi amaphakethe aya kuphi ngokusebenzisa ithebula layo lamaroute kanye namakheli i-interface ye-VM ewabamba ngempela, ngakho i-pool yetunnel i-VM engayiphethe iyipool okungekho oziletha kuyo.

Landela iphakethe elihlulekayo esikhundleni sefayela lokuhlela, futhi izingxenye ezingekho ziyavela ngokulandelana.

Qala ngephakethe elifayo

I-SYN ishiya iklayenti, ingena kutunnel futhi ifinyelela ku-VM njengephakethe elisongelwe eliya endaweni ngaphakathi kwe-VPC. I-OpenVPN iyalivula bese izama ukulidlulisela nge-eth0, lapho i-fabric ibuza umbuzo owodwa ngaphambi kwakho konke: ingabe le instance iphethe ikheli lendawo. I-pool yetunnel esikwe kusubnet yomunye yehluleka kulo mbuzo, futhi iphakethe liyalahlwa ngaphambi kokuba kubhekwe noma yiliphi iroute noma umthetho we-firewall.

Ngakho indlela esuka kuklayenti iya ku-VPC inezidingo ezimbili ezihlukene, futhi akukho nesisodwa esiwumyalo we-push. I-VM idinga ibanga le-alias elihlanganisa i-pool yetunnel, futhi yikho okulenza libe umnikazi osemthethweni walawo makheli. I-VPC idinga iroute ebiza i-VM njenge-next hop kuwo wonke ama-prefix avikelwe. Uma kugejwa eyodwa, iphakethe lifela kwenye indawo, kuyilapho iklayenti libona ukuthula okufanayo.

Funda ukwehluleka ngalolo kulandelana, ngoba ohlangothini lweklayenti izimo zombili zibukeka zifana. Itunnel ebika ukuthi ixhunyiwe kuyilapho kungekho okuphendulayo iyisiginesha senkinga yetopology, hhayi ye-cipher embi.

Ingabe i-instance iphethe i-pool yetunnel

Nika i-VM ibanga lesibili ngaphakathi kwe-subnet yayo, bese wenza i-OpenVPN yabela amakheli asuka kanye kulelo banga. Ku-instance ekheli layo eliyinhloko elingu-10.156.0.10/20, i-alias ye-/28 ihlukanisa i-pool namakheli ezinye izinto ezi-instance sezivele ziwaphethe:

gcloud compute instances network-interfaces update openvpn-vm \
  --zone=europe-west1-b \
  --aliases=eth0:10.156.1.0/28

Umyalo we-server bese kufanele uchaze ibhlokhi efanayo. Ikheli layo lokuqala liba i-gateway yetunnel, futhi amakheli asele abelwa amaklayenti. Lapha izinombolo ezimbili zichaza ibhlokhi elilodwa, inethiwekhi ne-netmask, futhi leso isintaksi se-pool i-OpenVPN isayilindele.

server 10.156.1.0 255.255.255.240

Qinisekisa ukuthi ikheli lafika ngempela ku-interface hhayi kuphela kukho ukuhlelwa kwe-OpenVPN. I-fabric idlulisa lokho okubikwa yi-NIC, hhayi lokho okukholelwa yi-daemon. Umyalo owodwa uyakunquma lokho:

ip -4 addr show dev eth0

Ikheli lesibili elingafiki neze ku-eth0, noma i-pool edlula kusubnet enye, kubonakala kamuva njengokulahleka kwezikhathi hhayi njengephutha lokuqala. I-daemon iyaqala, amaklayenti ayaxhuma, futhi yizindawo ezithile kuphela ezingaziphathi kahle. Gcina ibanga le-alias lincane ukuze i-pool ibonakale kalula kuthebula lamaroute. Ungalokothi uyisike kusubnet esetshenziswa yi-instance enye.

Nika ithrafikhi ebuyayo i-next hop

Impendulo evela kumhambi ku-VPC iqondiswa ekhelini leklayenti ku-pool yetunnel, elingekho kunoma yisiphi isubnet esaziwa yi-VPC. Ngaphandle kweroute yaleyo pool, impendulo ima ku-hop yokuqala engenakho ukufanisa, futhi isicelo kungenzeka siphumelele ngakolunye uhlangothi.

gcloud compute routes create openvpn-return \
  --network=prod-vpc \
  --destination-range=192.168.127.0/24 \
  --next-hop-instance=openvpn-vm \
  --next-hop-instance-zone=europe-west1-b \
  --priority=800

Iroute efanayo iyadingeka kunoma yiliphi i-prefix elingemuva kweklayenti hhayi ngaphakathi kwe-VPC. Lawo ma-prefix adinga futhi ingxenye ye-iroute kufayela le-ccd lalelo klayenti. Leyo ngxenye iwukubalwa ohlangothini lweseva: itshela iseva ukuthi iyiphi iklayenti ephethe i-prefix, futhi ayifaki lutho kuklayenti ngokwalo.

Gcina uhlu lwe-push ohlangothini lweklayenti lwengxoxo, ngoba lwengeza amaroute kumshini oxhumayo kuphela. Umugqa we-push wesubnet ye-VPC neroute ye-VPC ebuyela ku-pool ziyingxenye ezimbili zomzila owodwa, futhi ingxenye ngayinye iyodwa ikhiqiza itunnel ethwala izicelo kodwa hhayi izimpendulo.

Ama-firewall, ukudlulisela nama-hop aphakathi

I-firewall ye-VPC ihlola iphakethe elivuliwe, ngakho umthetho we-ingress kufanele uvumele i-pool yetunnel nanoma yiliphi i-prefix lesayithi elifinyelela ku-VM ngaleyo ndlela. Isimo sokwenqaba ngokuzenzakalela sehluleka buthule lapha: iphakethe liyalahlwa ngemuva kokuvulwa, futhi ilogi ye-OpenVPN ibonisa isikhathi esinempilo.

Kunoma yimuphi umhambi we-Linux odluliselayo hhayi oqedayo, hlola ukuthi i-net.ipv4.ip_forward ivuliwe. Umthetho wobunikazi uyasebenza nalapho: umshini odlulisela isubnet engayiphethe ulahla iphakethe njengoba i-VM ingenza. Funda inani ngaphambi kokusola itunnel.

Lapho kwehluleka khona i-prefix eyodwa ngqo

Ukwehluleka okuyingxenye yicala elilula ukulifunda, ngoba konke okunye emzileni sekuvele kufakazelwe. Qala ngohlu lwamaroute bese ufunda ibanga lendawo ne-next hop yengxenye okufanele ihlanganise i-prefix, bese ufunda incazelo ye-instance futhi uqhathanise ibanga layo le-alias ne-pool ebelwa yiseva.

gcloud compute routes list --filter=destination-range~10.164.0.0
 gcloud compute instances describe openvpn-vm --format=get(networkInterfaces[0].aliasIpRanges)

Iroute engekho ibonakala njengokungabi khona kwe-next hop kwi-prefix, kuyilapho i-alias engekho ibonakala njengephakethe elilahliwe ku-interface; kusukela kuklayenti zombili zibukeka zifana futhi kuleyomininingwane emibili zihluke ngokuphelele. Uma zombili zikhona, umsolwa osele i-iroute ye-ccd yeklayenti elifuna i-prefix.

Bhala amanani amane eceleni kwetunnel: ibanga le-alias, i-pool yeseva, ama-prefix apushiwe, amaroute e-VPC. I-alias endala yephula wonke amakheli e-pool, iroute endala yephula indlela eyodwa, i-push engekho ifihla i-prefix kuklayenti, futhi i-iroute engalungile ithumela i-prefix ku-peer engalungile. Umuntu olandelayo ozofaka isubnet udinga wonke amane endaweni eyodwa, futhi inothi lishibhe kunezinsuku.