GCP Cloud VPN: hlola i-gateway, ithuneli ne-firewall ngokulandelana

Ithuneli elibika ukuthi selisungulwe kuyilapho zonke izivivinyo ziphelelwa isikhathi ngokuvamile alinawo umthetho we-firewall we-VPC. Hlola i-gateway, izikhethi kanye nohlobo lokuhamba ngokulandelana kwalokho.

Ikhostoli yakho ikhombisa ithuneli eliluhlaza, ukuqapha endaweni akukakwazi ukufinyelela ngisho isenzakalo esisodwa, futhi ukwakha kabusha ithuneli kubonakala kuyisixazululo esisobala. Akuvamisile ukuba njalo. Ithuneli elisungulwe lifakazela kuphela ukuthi ama-gateway amabili aqede ukushintshana kwe-IKE. Alisho lutho mayelana nokuthi iphakethe lavunyelwa yini ukungena ku-VPC yakho.

Izinqumo ezine ziphakathi kwalelo khono eliluhlaza nempendulo, futhi zehluleka ngokulandelana okungalindelekile. Qala ngokushibhile kakhulu.

Izinto ezintathu, futhi kunye kuphela kuzo ezibhala ngemfihlo

I-gateway ye-VPN iphethe ikheli langaphandle ozakwenu abhala ngemfihlo kulo. Kukhostoli awukaze uyidale ngesandla: khetha noma gcina ikheli ngaphakathi kwefomu lokuxhumana futhi i-gateway ivela nalo. I-gateway ye-HA ithatha amakheli amabili ezinkundleni ezimbili, okubalulekile ekuhlolweni kwesabelo kamuva.

Ithuneli ukubhangqa phakathi kwaleyo gateway nozakwenu. Lithwala imfihlo eyabiwe kanye nezikhethi zethrafikhi elithembisa ukuzivikela. Kulezo zikhethi kuqala iningi lokuhluleka okuthule. Ithuneli elisikhethi saso sendawo elicweba u-10.0.0.0/24 ngeke lilethe u-10.0.1.0/24, noma isimo sibonakala siphilile kangakanani.

Uhlangothi olukude lugcina uhlu lwalo, ngokuvamile olubizwa ngokuthi isizinda sokubhala ngemfihlo, futhi ihadiwe yokuqeda iqhathanisa nolwakho. Alukho uhlangothi oluxoxisana ngesikhethi esingazange sinikezwe.

Uhlobo lokuhamba lunquma ukuthi yini efinyelela ithebula lemizila

I-Cloud VPN inikeza izimo ezintathu zokuhamba futhi azihlangani ngokuhlanzekile. Ukuhamba okusekelwe kumgomo kugcina izingqikithi zezikhethi ezingashintshi, ukuhamba okusekelwe emizileni kulindele ukuthi wengeze imizila engashintshi ngokwakho, futhi ukuhamba okuguquguqukayo kumemezela iziqalo ngokusebenzisa i-Cloud Router ku-BGP. Khetha eyodwa ngenhloso.

Ithuneli eliguquguqukayo elinemizila engashintshi ebhalwe ngesandla eceleni kwalo likhiqiza ithebula lemizila elingenalutho njalo lapho iseshini ye-BGP inyakaza.

Okuguquguqukayo ukuphela kwesimo esivumela iziqalo ezivikelwe ukuthi zishintshe ngaphandle kokwakha kabusha ithuneli, futhi kudonsa i-Cloud Router esethiwe sezinto okufanele uziqinisekise. Izikhethi ezingashintshi zihlala zisebenza lapho ozakwenu beyi-firewall yehadiwe engakwazi ukukhuluma i-BGP. Ngaleso sikhathi iziphetho zombili zidinga amazinga afanayo, futhi okufakiwe okuqondile kakhulu kufanele kunqobe kuzo zombili. Umabhangqa ongavumelani ngesub-nethi eyodwa uyasungulwa bese uthwala ingxenye yethrafikhi yakho.

Ukwenqaba okusobala kuhlezi ngemuva kwethuneli

Ithrafikhi engenayo ihlolwa ngokumelene nokwenqaba okusobala ezingeni eliphansi kakhulu, futhi lowo mthetho awunandaba nokuthi iphakethe lafika libhalwe ngemfihlo. Kuze kube yilapho umthetho we-firewall usho ibanga lasendaweni kanye nechweba elisetshenziswayo, iphakethe liyahlukaniswa, lihlolwe bese lilahliwe. Ilogi ye-VPN ihlala ihlanzekile isikhathi sonke, ngoba ithuneli lenze ngqo lokho elalithembise kona.

Esikhundleni salokho funda ilogi yokwenqaba ye-firewall lapho ithuneli lisebenza futhi isivivinyo siphelelwa isikhathi, bese ukhawulela umthetho ebangeni lomthombo kanye namachweba owadingayo:

gcloud compute firewall-rules create allow-from-dc \
  --network=vpn-vpc \
  --direction=INGRESS \
  --source-ranges=192.168.10.0/24 \
  --allow=tcp:22,tcp:5432,icmp

Uhlangothi olulodwa olusebenzayo wuphawu lwe-firewall

Ithrafikhi ephumayo iziphatha ngendlela ehlukile, ngoba umthetho wokuvumela osobala uvumela izenzakalo ukuthi zithumele noma kuphi. Isikhungo sedatha esingakwazi ukufinyelela i-VM ngokuvamile sihlezi ngemuva komzila ophumayo osebenza ngokuphelele kolunye uhlangothi. Lokho kungalingani kuhlukanisa ukushiywa kwe-firewall ekuhlulekeni kokuhamba, ngoba ukuhluleka kokuhamba kuphula izinhlangothi zombili ngasikhathi sinye. Hlola uhlangothi oluphambene ngaphambi kokuhlela omunye umthetho.

Ukwakha amakheli nakho kuwumsebenzi wesabelo. Iphrojekthi eseduze nomkhawulo wayo wamakheli angaphandle asetshenziswayo inqaba ukuxhumana ngephutha elifundeka njengokuhluleka kwemvume.

Izikhethi, izabelo, bese kuba izivivinyo ezine

Amathuneli akhiwe kukhostoli kwesinye isikhathi abuyisela isikhethi sethrafikhi esikude esingenalutho ku-gcloud compute vpn-tunnels describe kuyilapho imizila ekhiqiziwe ithwala ithrafikhi ngendlela efanele. Qhathanisa lokho okurekhodwa yi-API namabanga owavikelayo ngempela ngaphambi kokunquma ukuthi ithuneli alilungile. Ukulakha nge-API noma i-SDK kugcina isikhethi sicacile.

Izabelo kungenye into elula ukushiywa. Cela ukwenyuka ngaphambi kwewindi lokulungisa, hhayi phakathi kwalo, futhi hlola inani lamakheli kuphrojekthi efanayo ne-gateway.

Sebenza kusukela ngaphandle kuye ngaphakathi: isimo sikazakwenu, izinhlu zombili zezikhethi, umzila wohlangothi ngalunye, umthetho wokungena webanga lomthombo nechweba, bese kuba ukubanjwa kwamaphakethe. Bhala ikheli le-gateway, izinhlu zombili zezikhethi kanye nohlobo lokuhamba kuthikithi yoshintsho ngenkathi ithuneli lisha, ngoba unjiniyela olandelayo ozokwengeza isub-nethi uzodinga zontathu.

Izihloko ezihlobene