I-GCP Classic VPN ku-Terraform: yenza umhubhe usekelwe emizileni

Ku-Classic VPN ilebula alinqumi ukuziphatha. Okusekelwe emizileni kusho isikhethi sasendaweni esingu-0.0.0.0/0, izikhethi ezikude ezihambisanayo nomzila ocacile.

Uhlelo lusebenza ngokuhlanzekile, umhubhe uyaphakama, futhi ikhonsoli iwubiza ngokuthi usekelwe enkambisweni. Ithrafikhi ayidluli namanje, futhi ukufuna iswishi esekelwe emizileni kumthombo we-Terraform akudluleki ndawo ngoba ayikho leyondawo. Ku-Classic VPN, ukuziphatha okusekelwe emizileni akusona isimo osikhethayo. Yikho okutholayo lapho isikhethi sethrafikhi sasendaweni singu- 0.0.0.0/0, izikhethi ezikude zibala amanethiwekhi owafunayo ngempela, futhi umzila ukhomba emhubheni. Izinto ezintathu, futhi ilebula iyalandela.

Inganekwane: indawo yesimo somhubhe

Ilebula lekhonsoli likhombisa lokho i-API ekubonayo kuzikhethi. Akukho lutho kumthombo okusho okusekelwe emizileni, ngakho akukho okungasetwa kube yiqiniso.

Ukufuna leyondawo kudla ihora lokuqala lenkinga, kanti ukufunda amanani ezikhethi kuthatha imizuzu emihlanu yokugcina.

Kusho ukuthini okusekelwe emizileni lapha

I-Google ibhala imihubhe esekelwe emizileni ye-Classic VPN njengemihubhe esekelwe enkambisweni okuyisikhethi sayo sasendaweni esingu- 0.0.0.0/0. Izintaba ezikude kuphela eziqanjwayo, futhi uhlangothi lwasendaweni luthathwa njenganoma yiliphi ikheli. Yingakho uphawu olusekonfigurashini yakho luyinani hhayi isimo. Bhala zombili izikhethi ngokucacile futhi uzifunde kokuphumayo kohlelo:

local_traffic_selector  = ["0.0.0.0/0"]
remote_traffic_selector = ["10.20.0.0/16"]

Isiqalo somlingani kuleso siqeshana siyisibonelo; ukuma yikho okubalulekile.

Umzila uyinto ehlukile

Into yomhubhe ayifaki umzila. Amaphakethe angahambisana nenkambiso yomhubhe futhi angabi nandawo yokuya, ngoba ukugxuma okulandelayo kunqunywa yithebula yokuhamba yase-VPC. Umzila udinga ibanga lomkhombandlela, inethiwekhi, umhubhe njengokugxuma okulandelayo kanye nokubaluleka okunqoba noma yini ebanzi kakhulu. Uma ukhohlwa lokho, uthola umhubhe obika ukuthi uxhumene kanye nohlolo olungaphumi ku-VPC.

resource "google_compute_route" "office" {
  name                = "office-via-vpn"
  dest_range          = "10.20.0.0/16"
  network             = google_compute_network.vpc.name
  next_hop_vpn_tunnel = google_compute_vpn_tunnel.to_office.id
  priority            = 1000
}

Dala umzila kumojuli ofanayo nomhubhe, ukuze bobabili bangahlukani ekubuyekezweni.

Bonisa izikhethi kumlingani

Idivayisi esekude kufanele ihlelwe ngesithombe sesibuko: ibanga layo lasendaweni yisikhethi sakho esikude, futhi ibanga layo elikude kufanele limboze ama-subnet e-GCP ohloselayo ukuwasebenzisa. Uma noma yiluphi uhlangothi luncipha, isigaba 2 sehluleka nakuba isigaba 1 siphumelela. Lolu wukuma okuvame kakhulu kokwakheka okubonakala kulungile kukhonsoli futhi okungathwali thrafikhi.

Printa izikhethi zezinhlangothi zombili zihambisane ngesikhathi sokubuyekezwa koshintsho.

Hlukanisa ikheli elingashintshi emisebenzini emibili

Ukwakha ikheli eligciniwe kanye nomhubhe okubhekisela kuwo emsebenzini owodwa kuwumthombo owaziwayo wokungazinzi, ngoba ikheli kufanele libekhona ngaphambi kokuba umthetho wokudlulisa uwusebenzise. Qala ngokufaka kuphela umthombo wekheli, bese wengeza isango, imithetho yokudlulisa nomhubhe bese ufaka futhi. I-Terraform ifunda ikheli elikhona esimweni ekugijimeni kwesibili futhi ilisebenzise kabusha. Uma ukweda lokho, umhubhe ungathola ikheli lomphakathi elisha ekufakeni ngakunye, okwephula ukwakheka komlingani njalo.

Ukufaka kabili manje kushibhe kakhulu kunokushintsha umlingani kukho konke ukukhishwa.

Qinisekisa izingxoxo, hhayi ilebula

Ngemva kokufaka, hlola amaqiniso amathathu ahlukene: umhubhe ubika ukuthi uxhumene, umzila ukhona ngokugxuma okulandelayo okuhlosiwe, futhi umlingani ubika ukuthi isigaba 1 nesigaba 2 zombili ziphezulu.

Umhubhe uphezulu kanti isigaba 2 siphansi kusho ukuthi izinhlangothi zombili azivumelani ngezikhethi:

  • Uhlangothi olulodwa lubala i-subnet okungabaliyo olunye.
  • Uhlangothi olulodwa lusebenzisa iqoqo elincishiswe olunye.
  • Umzila ukhona kodwa ukhomba komunye umhubhe.

I-Classic VPN ingumhubhe owodwa one-SLA ephansi kune-HA VPN, futhi i-HA VPN isebenzisa izixhumi ezimbili, imihubhe emibili kanye ne-BGP enezinhlobo zomthombo ezihlukile. Ukukopisha isibonelo sakudala kukwakheka kwe-HA nokulindela ukuthi izinkambu zezikhethi zizoziphatha ngendlela efanayo kuyiphutha elihlukile okufanele ligwenywe. Izinkambu zomhubhe ngokwazo zibhalwe ku- incwadi yokubhekisela ye-google_compute_vpn_tunnel.

Izihloko ezihlobene