I-Nginx phambi, i-backend eyimfihlo ngemuva kwe-VPN

Landela isicelo esisodwa sisuka ocingweni olusemotweni siya ku-backend ekhona kuphela ngaphakathi kwenethiwekhi eyimfihlo. Ucingo lixazulula igama lomphakathi, luxhumana nekheli lomphakathi kupothi 443 futhi luqedela i-TLS handshake evamile. I-Nginx yamukela lolo xhumano bese ivula olwesibili, oluhluke ngokuphelele, oluya ekhelini elingafinyelelwa kuphela ngesixhumi esibonakalayo se-VPN. Akukho okushintshayo ocingweni, futhi ucingo alwazi neze ukuthi umhubhe wawuhilelekile.

Ukulandela isicelo esisodwa ngezixhumano ezimbili

Ingxenye engenayo iwukuthengiselana kwe-HTTP yomphakathi. Inegama lomphakathi, isitifiketi somphakathi kanye nendlela yempendulo okufanele isebenze kunoma yiliphi ikheli isivakashi esinalo ngaleso sikhathi. Noma yiluphi ushintsho oluphazamisa leyo ndlela ludiliza zonke izivakashi ngesikhathi esisodwa. Yingakho ingxenye yomphakathi iyona ongafuni ukuzama kuyo kakhulu.

Ingxenye ephumayo iyimfihlo. I-Nginx iba iklayenti, ixazulula igama langaphakathi noma isebenzisa ikheli elingaguquki, futhi ifinyelela isevisi ebingayenqaba uxhumano oluvela ku-inthanethi.

Public client  -> frontend public address:443   (TLS, public name)
Frontend       -> VPN private backend 10.40.0.20:8443  (TLS, private name)

Zihlukanise ekhanda lakho futhi ukumiswa kuzoba sobala. Uma uzihlanganisa, uzogcina uzama ukwenza iklayenti lomphakathi libambe iqhaza emhubheni, futhi lapho kuvela khona iningi lokudideka kulo mklamo. Ingxenye eyimfihlo ingase ibe buthakathaka. Eyesidlangala akufanele.

Ngaphambi kokwakha noma yini yalokhu, qinisekisa ukuthi ukushicilelwa kohlelo kuyinhloso. I-proxy esebenzayo iwukuchayeka okusebenzayo futhi, futhi imodeli yokuqinisekisa kufanele ibe yisinqumo, hhayi umphumela oseceleni.

Igama lesango kufanele lisinde emhubheni

Kunogibe olucashile ekuxazululeni amagama. Uma i-DNS eyimfihlo ishitsha igama elifanayo elisetshenziswa iphrofayili ye-VPN esangweni layo, ukuxhumana kabusha kungagcina kuzama ukufinyelela leso sango ngomhubhe okufanele ukwakhe wona. Iklayenti lidinga lelo gama lixazululwe ngaphambi kokuba umhubhe ube khona. Uma selixazululwe ngaphakathi komhubhe, uxhumano alunakwakhiwa nakancane.

Sebenzisa amagama ahlukene agunyaziwe esangweni naku-backend, futhi unciphise inqubomgomo yesixazululi ukuze igama ngalinye lixazululeke ekhelini elidingwa umsebenzisi walo. Ukushintsha isihloko se-Host sohlelo akusizi lapha, ngoba ukusesha kwenza iklayenti le-VPN.

Bese ucabanga ngobubanzi. I-frontend idinga umzila oya ekhelini le-backend, futhi kufanele iqhubeke iphendula amaklayenti omphakathi. Umhubhe ogcwele kuleyo host ungasutha isidingo sokuqala futhi wephule esesibili.

Lapho inqubomgomo ivumela khona, umhubhe oya endaweni ethile uwumklamo ohlanzekile. Lapho inqubomgomo iphoqa umhubhe ogcwele, i-frontend ingeyendawo ehlukile yenethiwekhi esikhundleni sokuxazululwa ngemizila yesikhashana yezivakashi ezaziwayo.

Bhala ibhlokhi leseva ukuze zombili izingxenye ziqinisekise

Ake sithi i-backend ethula isitifiketi saleli gama: backend.corp.example futhi iphendula ekhelini eliyimfihlo. Ukuxhumana nekheli ngenkathi kuqinisekiswa igama yilokho kanye okwenzelwe izinketho ze-SNI negama zemojuli ye-proxy.

upstream private_app {
    server 10.40.0.20:8443;
}

server {
    listen 443 ssl;
    server_name app.example.com;

    ssl_certificate     /etc/nginx/tls/app-fullchain.pem;
    ssl_certificate_key /etc/nginx/tls/app-key.pem;

    location / {
        proxy_pass https://private_app;
        proxy_ssl_server_name on;
        proxy_ssl_name backend.corp.example;
        proxy_ssl_trusted_certificate /etc/nginx/trust/backend-ca.pem;
        proxy_ssl_verify on;
        proxy_ssl_verify_depth 3;

        proxy_set_header Host app.example.com;
        proxy_set_header X-Forwarded-Proto https;
        proxy_set_header X-Forwarded-For $remote_addr;
    }
}

Yonke indlela nekheli elingenhla kuyisibambi sikhala. Okubalulekile yizingxenye ezigcina ukuqinisekisa kuvuliwe: igama elizohlolwa, inqwaba yokuthemba yokuhlola ngayo, kanye nokujula okuhambisana nochungechunge olugunyaziwe.

proxy_set_header Host app.example.com kuyenziwe ngamabomu. I-backend kufanele imiswe ukuze yamukele lowo msuka womphakathi, futhi kufanele ithembe izihloko ezidluliselwe kuphela kusuka kule frontend. Ukubhala phezu kwe- X-Forwarded-For ngekheli leklayenti kulungile ku-proxy eyodwa futhi akulungile ochungechungeni, ngakho ukusatshalaliswa okunama-proxy amaningi kudinga inqubo yalo yamakheli athembekile.

Yenza umsuka womphakathi uziphathe njengomsuka womphakathi

Uhlelo kufanele lukhiphe ama-URL aphelele, ukudluliselwa kanye namakhukhi omsuka womphakathi. Uma idlulisela isivakashi kulo: backend.corp.example, leso sivakashi sithunyelwa egameni elingakwazi ukulixazulula.

Lungisa lokho ngesilungiselelo se-URL sangaphandle esisekelwa uhlelo kanye nenqubomgomo yokudlulisela ebuyekeziwe, hhayi ngokubhala kabusha amagama ezihambeli emizimbeni yempendulo. Ukushintsha kwezinhlamvu kokuqukethwe okungahleliwe kwephula imithwalo esayiniwe futhi kudala amaphutha okunzima ukuwalandelela.

Amakhukhi nawo afanelwe ukunakekelwa okufanayo. Ikhukhi elinganiselwe egameni eliyimfihlo ngeke lilethwe isiphequluli esazi kuphela elesidlangala.

Qinisekisa futhi ukuthi i-Nginx ingaba ngumnikazi wensika yesidlangala ngempela. Isevisi yewebhu ekhona kupothi 443 kufanele isuke noma i-frontend kufanele ihlale kwenye indawo, ngoba izinqubo ezimbili azikwazi ukubopha ikheli nepothi elifanayo.

Hlola ingxenye ngayinye lapho isebenza khona ngempela

Qinisekisa ukumiswa ngesihlukanisi esifakiwe ngaphambi kokulayisha kabusha, ukuze iphutha lokuthayipha lingawisi isilaleli esisebenza manje.

Bese uhlola ingxenye ye-backend kusuka ku-host ye-frontend uqobo, endaweni efanayo yenethiwekhi esetshenziswa i-Nginx. I-ping ngomhubhe ifakazela ukufinyeleleka futhi akukho lutho nge-TLS, ukugunyazwa noma uhlelo.

Ekugcineni thumela isicelo esisha somphakathi egameni langempela le-host ngokuqinisekisa isitifiketi okujwayelekile, futhi ubheke indlela yempendulo hhayi umzimba wempendulo kuphela.

Gcina kokubili ukubona kanye nokumiswa okusatshalalisiwe, futhi urekhode okwenzekayo uma umhubhe ungatholakali. I-frontend kufanele ibuyise iphutha le-upstream elilawulwayo, hhayi ukuwela buthule ku-backend enye okungekho muntu oyibhalile. I-502 enomugqa wokuloga ocacile iwumphumela omuhle. Ikhasi eligcinwe kunqolobane lisuka kumsuka ongahlosiwe akusiwona umphumela omuhle.