Kungani i-VM yakho ye-GCP ingakwazi ukuphendula kwiphuli ye-IPv6 ye-OpenVPN

Iklayenti lakho le-IPv6 VPN lifinyelela umsebenzi, umsebenzi uphendula ungene ethaneleni, futhi impendulo ayifiki neze. Umcabango wokuqala ukusola i-firewall noma ithaneli, futhi ngokuvamile akukho kokubili okunephutha. Ikheli elinikezwa yi-OpenVPN iyinethiwekhi yangaphakathi ekhona kuphela ngaphakathi kwethaneli; i-Google Cloud ayazi ukuthi i-fd42:90::/64 kufanele ibe ngemuva kwe-VM ethile kuze kube yilapho uyitshela.

Amasistimu amabili ahlukene kufanele afunde leli qiniso, futhi yinye kuphela yawo eyi-OpenVPN. I-VPC idinga umzila ngaphambi kokuba ikwazi ukubuyisela noma yini, futhi i-VM kufanele ivunyelwe ukudlulisa lokho okufikayo. Yenza iphutha kunoma yiluphi uhhafu futhi uphawu luzobonakala lufana.

Iphuli iyinethiwekhi yangaphakathi, hhayi isubneti

I-OpenVPN inganikeza amakheli e-IPv6 avela kububanzi okukhethayo, futhi lobo bubanzi buwumbono nje okuvunyelwene ngawo yizinhlangothi ezimbili zethaneli. Akulona isubneti ye-Google Cloud, alibonakali ohlwini lwamasubneti e-VPC, futhi isixhumi senethiwekhi se-VM asiwatholi lawo makheli. Ngakho umsebenzi ophendula iklayenti uthumela iphakethe ekhelini inethiwekhi elibheka njengelingenakuhamba.

Gcina iphuli ngaphandle kwayo yonke imibandela esetshenziswa yi-VPC kakade. Yigcine futhi ngaphandle kwemibandela engemuva kwamanye amathaneli akho. Ukuhlangana kushintsha ukwehluleka komzila okucacile kube okwenzeka ngezikhathi ezithile okubonakala kuphela ngaphansi komthwalo.

Ikheli lendawo eliyingqayizivele njenge-fd42:90::/64 liyisinqumo esifanele sale nethiwekhi yangaphakathi. Isiqalo sikhumbuza futhi ukuthi umklamo uyimfihlo ngokwemvelo. Akukho lutho kuphuli ye-ULA okwenza ibe umthombo osemthethweni ku-inthanethi yomphakathi.

Nikeza i-VPC indawo nokugxuma okulandelayo

Impendulo idinga umzila we-VPC okuliphiwa kwawo iphuli nokugxuma okulandelayo okuyi-VM ye-VPN. Imibhalo yamanje yemizila emile ihlanganisa ububanzi bendawo ye-IPv6 futhi ibala ukuthi yiziphi izinhlobo zokugxuma okulandelayo ezifanelekile, ngakho qinisekisa indlela esekwayo yetopoloji yakho esikhundleni sokukopisha isibonelo sakudala se-IPv4.

Ikheli lokugxuma okulandelayo kufanele kube elabelwe ngempela isixhumi samafu we-instance. Ikheli lethanele langaphakathi le-VM akulona lelo kheli. Ukulisebenzisa noma kunjalo kukhiqiza umzila ofaka ngokucacile futhi ongahlangani nakhiphakethe. Funda uhlu lwezixhumi ngaphambi kokubhala umzila.

Ukubaluleka komzila kukhulu njengokufakwa ngokwako. Imizila yamasubneti icacile kunemizila yangokwezifiso oyengezayo, ngakho iphuli elisikwe kububanzi besubneti esikhona lizohlulwa umzila wesubneti, kungakhathaliseki ukuthi umzila wangokwezifiso ubhalwe kanjani. Khetha iphuli ehlukile, bese uqinisekisa ukuthi umzila ukhombisa i-instance njengokugxuma okulandelayo nesiqalo sendawo esifanele:

gcloud compute routes create vpn6-return \
  --network=vpn-vpc \
  --destination-range=fd42:90::/64 \
  --next-hop-instance=openvpn-vm \
  --next-hop-instance-zone=europe-west1-b

Ukudlulisa kufanele kunikwe amandla kabili

Umzila uletha iphakethe ku-instance. Awukwenzi i-instance ikulungele ukudlulisa into engayalelwe yona, futhi leyo mvume ikhona ezigabeni ezimbili.

Uhlangothi lwamafu ludinga amandla okudlulisa e-instance anikwe amandla; lesi yisilungiselelo esivumela i-VM ukuthi yamukele ukuhamba kwamakheli engeyona eyayo futhi ikudlulise. Uhlangothi lwesivakashi ludinga ukudlulisa kwayo kwe-IPv6, ngoba i-kernel yenza isinqumo esihlukile ngemuva kokufika kwephakethe. Kokubili kufanele kube kuvuliwe ngaphambi kokuba impendulo eyodwa iwele ithaneli.

sysctl -w net.ipv6.conf.all.forwarding=1

Ngemuva kwalokho imithetho ye-firewall kufanele ivumele ububanzi bomthombo bangaphakathi kuzo zombili izinhlangothi. I-Google Cloud ihlola iphakethe elikhishwe ikhabethe, ngakho umthetho ohlanganisa kuphela isubneti ye-VPC ulahla ukuhamba kwephuli ngemuva kokuba ithaneli seliphumelele. Engeza iphuli njengobubanzi bomthombo kumthetho wokungena, futhi uhlole ukuthi ayikho inqubomgomo yokuphuma yangokwezifiso evimba impendulo. Umthetho wemvume ocashile uhlanganisa icala elizenzakalelayo, umthetho wokuphuma obhalwe ngesandla awuwuhlanganisi.

Tshela i-OpenVPN ukuthi ubani ungumnikazi wani

I-OpenVPN idlulisela kuklayenti lapho yazi ukuthi lelo klayenti lingumnikazi wendawo. Amakheli amaklayenti avela kuphuli asetshenziswa isiqondiso seseva esichaza iphuli, kodwa isubneti engemuva kweklayenti iwukuhlelwa okuhlukile futhi idinga ukufakwa kobunikazi okucacile kwalelo klayenti.

Ukuhlanganisa kokubili kukhiqiza ithaneli lapho i-ping eya kuseva isebenza khona futhi akukho lutho ngemuva kwayo olusebenzayo. Nquma ukuthi yikuphi icala olakha, bese ubhala ukufakwa okuhambisanayo esikhundleni sokwengeza umugqa wesibili we-push nokuthemba.

Gcina ukuphuma kwe-inthanethi ngaphandle kwalo mklamo

Ukufinyelela okuyimfihlo nokufinyelela ku-inthanethi kuyizinhlelo ezihlukene. Iphuli ye-ULA ingafinyelela imisebenzi ye-VPC ngethaneli uma umzila nokudlulisa kuvumelana, futhi leyo phuli ayinayo indlela eya ku-inthanethi yomphakathi ngokusebenzisa i-VPC, ngoba isango lamafu ngeke lamukele umthombo wethaneli ongenasizathu njengokwayo.

Uma amaklayenti edinga nokuphuma ku-inthanethi, hlela umklamo wamakheli nomzila osekelwe walokho, uwugcine uzimele kuphela kwephuli eyimfihlo, futhi uhlole izindlela ezimbili ngokwahlukana. Indlela eyodwa esebenzayo ayisho lutho ngenye, futhi umklamo ohlanganisa zombili uyahluleka ngendlela ebukeka njengethaneli eliphukile.