Gcina noma sebenzisa i-SNAT kuma-IP wamaklayenti e-VPN emngceleni wefu

Ukugcina ikheli leklayenti le-VPN kuze kufike ku-app kwenza yonke imigqa yelogi nayo yonke ingeno ohlwini oluvunyelwe isho into efanayo. Ukulibhala kabusha emngceleni wefu kwenza ithebula lomzila libe lula futhi amalogi angabi lusizo kangako. Akukho kulezi zinqumo ezimbili okungalungile ngokwako, futhi impikiswano eyinqumayo ayivamisile ukuba mayelana nokusebenza. Izimo ezintathu zinquma: ingabe i-app kufanele yazi ukuthi yimuphi umuntu oxhumile, ingabe indwangu yefu izokwamukela umthombo ohlose ukuwuthumela, nokuthi ngubani ozothatha umthwalo womzila wokubuya ngemuva kwalokho.

Izimo ezintathu zinquma

Qala ngesidingo se-app, hhayi ngomdwebo wenethiwekhi. Uma ukugunyazwa noma ukucwaninga kuncike ekhelini leklayenti ngamunye, khona-ke ukuligcina kuyisidingo sokusebenza futhi ukuhumusha kuwukuhlehla. Uma i-app idinga kuphela ukwazi ukuthi ithrafikhi ifike ngomzila wokufinyelela kude, ikheli elihumushiwe lanele futhi lishibhe kakhulu ukuphatha.

Isimo sesibili singesomshini. Inethiwekhi ebonakalayo ayithembi ngokuzenzakalela iphakethe elithi ikheli elinganikezwanga isixhumi esithumelayo. Iningi lezindwangu zefu liyakuphoqelela lokho, ngezindlela namagama ahlukene, futhi umklamo ongakunaki uzobonakala ulungile emdwebeni bese uwa buthule ekukhiqizeni.

Okwesithathu kungokwenhlangano. Ukugcina imithombo kusho ukuthi ithebula lomzila lesixhumanisi se-app kufanele likhombe emuva esangweni ngenxa yesiqalo seklayenti, futhi iqembu ngalinye elengeza isixhumanisi ngemuva kwalokho kufanele ligcine lowo mzila uhambisana. Leyo yindleko encane kanye, kanye nendleko ephindaphindayo kumakhulu amabhuku. Nquma ukuthi ngubani oyikhokhayo ngaphambi kokuthembisa ukuziphatha.

Umzila awusona isivumelwano sokukhohlisa

Ukungeza umzila wokubuya kutshela isixhumanisi sakho ukuthi izimpendulo kufanele ziye kuphi. Akutsheli indwangu ukuthi i-instance edlulisa lawa maphakethe ivunyelwe ukuwakhhipha ngomthombo wangaphandle. Ku-AWS isilawuli esifanele ukuhlolwa komthombo nendawo, futhi kubonakala nge-instance ngayinye:

aws ec2 describe-instances --instance-ids i-0a1b2c3d4e5f60718 \
  --query "Reservations[].Instances[].SourceDestCheck"
aws ec2 modify-instance-attribute --instance-id i-0a1b2c3d4e5f60718 \
  --no-source-dest-check

Kucime kuphela ku-instance umsebenzi wayo obhaliwe wukudlulisa, hhayi kwanoma yini enye. Yonke i-VM ye-app egcina ukuhlolwa kuvuliwe iyimishini eyodwa encane engasetshenziswa ukukhhipha ithrafikhi ngomthombo obolekiwe. Uma ipulatifomu yakho kungeyona i-AWS, funa isilungiselelo esilinganayo sokulwa nomkhohlisi noma amakheli avunyelwe esikhundleni sokucabanga ukuthi ukuziphatha kuzodlulela.

Ukubamba iphakethe ngokushesha kuqeda umbuzo ngokushesha kunokufunda ikhonsoli. Uma izimpendulo ziphuma futhi iklayenti lingaziboni neze, yindwangu elahla umthombo mbumbulu, hhayi i-app ehlulekayo.

Ukuhumusha kuthenga ini, futhi kubiza ini

Ukubhala kabusha umthombo esangweni kuqeda inkinga yomzila wokubuya. I-app ibona ikheli elilodwa eyazi ukuthi ingalifinyelela kanjani, futhi isiqalo seklayenti akudingeki sivele kuthebula lomzila wefu. Ku-Linux umthetho uwumugqa owodwa, futhi kufanele ukubhala inguqulo emincane kakhulu ongayenza:

sysctl -w net.ipv4.ip_forward=1
iptables -t nat -A POSTROUTING -s 172.20.8.0/24 -o ens5 -j SNAT --to-source 10.40.3.10

Qaphela lokho i-app manje ekubhalayo: 10.40.3.10 kumsebenzisi ngamunye, kukho konke ukuxhumana, unomphela. Noma yiluphi uhlu lwamakheli avunyelwe olwakhiwe kulelo nani manje lunikeza ukufinyelela kuso sonke isibalo sabantu abafinyelela kude, futhi noma yikuphi ukubuyekezwa kwesigameko kufanele kubuyele esangweni ukuze kuphendulwe ukuthi lo kwakungubani.

Isixazululo akusikho ukushiya ukuhumusha, ukuyeka ukuzenzisa ukuthi ikheli ubunikazi. Thwala ubunikazi beklayenti endaweni eqinisekisiwe, kubhale esangweni kanye ne-tuple ehumushiwe, futhi uvumele i-app ukuthi ihlangane nakho. Ngaphandle kokhiye wokuhlangana, ukuhumusha kuguqula inkinga yenethiwekhi ibe inkinga yophenyo yaphakade.

I-relay iyisixhumi esihlukile

I-proxy ephambene phambi kwe-app yeqa ngokuphelele umbuzo womzila ohleliwe. I-proxy ivula ukuxhumana kwayo kwangemuva, ngakho isiqalo seklayenti akudingeki sibe nomzila ongasetshenziswa ngaphakathi kwenethiwekhi ebonakalayo, futhi i-app ingathola ubunikazi kunhloko ebekwe yi-proxy.

Leho nhloko ithembakele kuphela lapho ingemuva liyikwamukela ivela ku-proxy hhayi kwenye indawo. Ngamagama e-nginx lokho kusho ukuqamba ngokucacile uzakwethu othembekile esikhundleni sokukholwa yikho konke okufikayo:

set_real_ip_from 10.40.3.10;
real_ip_header X-Forwarded-For;
real_ip_recursive on;

Noma yiliphi iklayenti elingafinyelela ingemuva ngokuqondile lingakwazi ukwenza leyo nhloko mbumbulu, ngakho ingemuva kufanele lingafinyeleleki ngaphandle kwe-proxy. Leli iqiniso le-firewall, hhayi umbono wokuhlelwa, futhi yilowo mqondo abantu abawugxumayo lapho bekopisha isiqephu.

I-relay ishintsha futhi lokho okuthengayo. Uthola ubunikazi bezinga le-app nendawo yemvelo yokububhala; udela ukujwayelekile, ngoba yonke iphrothokholi entsha idinga ukusekelwa kwayo kwe-proxy. Ezinsizeni ze-HTTP lokho kushintshana kuvame ukuba kuhle, futhi kunoma yini engeyona i-HTTP kuvame ukungatholakali nhlobo.

Bhala phansi lokho umngcele ngamunye okubonayo

Noma yini oyikhethayo, ukubuyekezwa komklamo kufanele kuphele ngethebula elilodwa eliqamba ikheli lomthombo kanye nobunikazi obungafakazelwa kukho konke ukugxuma. Ngaphandle kwalo, isigameko sokuqala sikhiqiza amaqembu amathathu, ngalinye lichaza iklayenti elihlukile.

Bese ukhetha. Gcina umthombo lapho ukugunyazwa kwe-app kuncike ngempela ekhelini leklayenti futhi ungakwazi ukuthwala umzila. Humusha lapho kungenjalo futhi ungakwazi ukuthwala ubunikazi ngaphandle kwebhendi, futhi sebenzisa isiqondiso se-AWS sezinto zokudlulisa ezilungiselelweni zokudlulisa eziqondene nepulatifomu. Phendukela ku-relay lapho insiza ikhuluma i-HTTP futhi ufuna ubunikazi buyeke ukuba yikheli.