Ukuphatha i-NAS nge-VPN: gcina igama, shiya imbobo yomphakathi
Finyelela ikhasi lokuphatha nge-tunnel, hhayi ngembobo yomphakathi entsha. Xazulula igama langempela, hlanganisa isitifiketi nalo, futhi vumela isevisi eyodwa isuka emthonjeni owodwa.
Ikhasi lokuphatha le-NAS lisebenza ekhaya futhi liyeka ukusebenza ngesikhathi umphathi ehamba, ngakho othile uvula imbobo futhi inkinga inyamalala kanye nobumfihlo. Kukhona indlela engcono yalokhu. Shiya ikhasi lapho likhona, vumela i-tunnel inikeze ukufinyeleleka, futhi wenze lokho okubhalayo kube i-URL ephelele enomzila wemvume onegama, hhayi ikheli ledivayisi eliphendula ngengozi. Zonke izinqumo ezingezansi, kusukela egameni kuya kusitifiketi kanye nembobo eyodwa evunyelwe, zivela ekubhaleni ngale ndlela.
Iyunithi yokuklama yi-URL, hhayi ikheli
Bhala indawo yokungena njenge-URL ephelele nembobo yayo nohlelo lwayo, bese unamathisela imibandela: ubani ongayisebenzisa, kusuka kunethiwekhi iphi nangomuphi umzila. Isibonelo kungaba https://nas.corp.example:8443 eshicilelwa kuphela kumakhasimende angasese agunyaziwe, lapho igama nembobo kumelela lokho idivayisi elalela kukho ngempela.
Lolo hlaka luphoqa izinqumo kusenesikhathi. I-URL isho igama, igama lisho isitifiketi, futhi isitifiketi sisho ukuhlelwa kokuthembana. Ikheli alisho lutho kulokho, futhi yikho kanye okwenza inguqulo yekheli kuphela ihlale kuze kufike isexwayiso sokuqala sesiphequluli bese iphenduka umkhuba wokuchofoza unqobe.
| Entry point | What it costs | When it fits |
|---|---|---|
| Private name over the tunnel | A private DNS zone and a certificate for that name | Administrators who already hold VPN access |
| Public reverse proxy | An exposed front end to patch and monitor | A documented, reviewed need for public reach |
| Vendor relay service | Trust in a third party path | A supported product design, not a workaround |
Gcina igama isitifiketi esakhishwa ngayo
Iklayenti lidinga umzila ovunyelwe oya ekhelini langasese le-NAS, futhi ukuhlelwa kwe-DNS yangasese kungaxazulula igama lomsingathi elihlosiwe liye kulelo kheli kuyilapho kugcinwa igama isevisi ye-HTTPS elilindele. Zombili izingxenye zibalulekile: umzila uletha amaphakethe lapho, igama litshela iklayenti ukuthi iyiphi ubunikazi okufanele iqinisekise.
Ukuthayipha ikheli lezinombolo esikhundleni salokho kushintsha imfuneko yobunikazi. I-RFC 9525 ihlukanisa igama iklayenti elihlose ukuxhumana nalo nobunikazi isevisi esivezayo, ngakho isitifiketi esakhishwa se-nas.corp.example singasehluleka ngokusemthethweni lapho isiphequluli sikhombe ku-10.20.0.15. Isexwayiso silungile, futhi isixazululo yigama, hhayi ukukhetha.
dig +short nas.corp.example
openssl s_client -connect nas.corp.example:8443 -servername nas.corp.exampleGijima zombili ngaphambi kokusola i-tunnel. Eyokuqala ibonisa ukuthi igama langasese liyaxazululeka yini lapho ucabanga khona, futhi eyesibili ibonisa ukuthi iyiphi isitifiketi nemaphi amagama endikimba ayelandayo isevisi evezayo ngempela. I-CA yangasese ingaba ukukhetha okuphathwe kahle ngokuphelele; okungafane kube umkhuba ukufundisa abantu ukunganaki izexwayiso zobunikazi.
Khawulela umzila wokuphatha
Vumela ngqo isevisi yokuphatha isuka emthonjeni ohlosiwe, kukho kokubili i-gateway ne-NAS. Lowo musho ufihla imininingwane elumayo: iphuli yamaklayenti ehambiswayo kanye ne-gateway enokuhumusha komthombo kufika ku-NAS ngamakheli omthombo ahlukene, ngakho umthetho wemvume obhalwe owodwa wehluleka buthule kowesibili.
I-NAS idinga futhi umzila wokubuya, futhi isiphequluli kufanele sisebenzise imbobo nohlelo olulungisiwe hhayi okuzenzakalelayo komsunguli okuvela kokuphoswa kwinkundla. Ukufinyelela idivayisi akusona imvume yokufinyelela yonke imbobo yayo. Igebe phakathi kwedivayisi ephendula i-ping nekhasi lokuphatha elilayishayo yigebe phakathi kwemithertho emibili ehlukene. Zibhale njengemithertho emibili enezichasiselo ezimbili, ukuze umuntu olandelayo abone ukuthi kungani zombili zikhona.
Hlukanisa ukwamukelwa kwe-VPN negunya le-NAS
Ukuvunyelwa ukudlula nge-tunnel akufani nokuvunyelwa ukuphatha idivayisi. Umsebenzisi odinga ngokusemthethweni isitoreji samafayela akufanele azuze njengefa ukuphathwa kwedivayisi ngenxa nje yokuthi zombili zihlala ngemuva kwe-gateway eyodwa, futhi imodeli yama-akhawunti ye-NAS iyindawo okufanele ukuvumelana khona kulokho.
Ikheli lokuphuma elabiwe noma elihunyushiwe nalo ngeke likwazi ukukhomba umphathi oyedwa. Uma umkhondo wokucwaninga kufanele ubalule umuntu, ubunikazi kufanele buvele ku-akhawunti eqinisekisiwe hhayi ekhelini lomthombo we-tunnel esetshenziswa abantu abaningi.
Okuphathelene nokungafane kushicilelwe ngengozi
I-proxy ephambene yomphakathi kanye ne-relay yomsunguli zombili ziyizakhiwo zangempela, futhi ngayinye ithwala izinqumo zayo zokuthembana nokuchayeka. Akukho kuzo okuba yisidingo ngenxa yokuthi umphathi ukude nasekhaya, futhi akukho kuzo okufanele kuvele njengomphumela oseceleni wokuchaya iseva yemidiya noma ukwabelana ngamafayela.
Bhala izinto ezine bese uyama: igama langasese, umlaleli elihlanganiswa nalo, iqembu elivunyelwe ukulisebenzisa, kanye nomzila wokubuyisela uma i-tunnel ingekho. Lezo zine ziphendula nemibuzo ezobuzwa ukubuyekezwa kwesigameko, okuyinto engelona iqiniso ngesithombe sesikrini sekhasi lokudlulisa imbobo. Okugcina ngakho yindawo eyodwa yokungena yokuphatha eqinile, hhayi idivayisi ezonke izici zayo zibheke ku-inthanethi.