Ukufinyelela isiteshi somsebenzi esingemuva kwe-NAT ngaphandle kokudlulisa imbobo
Isiteshi somsebenzi esingenayo imbobo yokungena sisafinyeleleka nge-hub, i-relay noma i-broker yezinhlelo. Qhathanisa lokho umklamo ngamunye okuqinisekisayo ngaphambi kokukhetha owodwa.
Amaphoyinti amabili okugcina angemuva kwe-NAT yenkampani nezihambisi zendlela zasehhovisi ezikhiyiwe azishiyi mbobo yokungena okumele idluliswe, futhi ukusabela kuwukucela eyodwa noma kunjalo. Umbuzo ongcono ukuthi yiluphi uhlangothi olungashaya ngaphandle nokuthi iyiphi insizakalo efinyelelekayo evunyelwe ukuthwala ukuhamba. Imiklamo emine iphendula lowo mbuzo ngendlela ehlukile, futhi yehluleka ngezindlela ezingafani lapho umzila uvaliwe. Ukukhetha phakathi kwabo ukuqhathanisa iziqinisekiso, hhayi amagama ezinqubo.
Imiklamo emine, izethembiso ezine ezihlukile
Ithebula elingezansi inguqulo emfushane. Funda ikholamu emaphakathi njengesethembiso ongayihlola, nekholamu kwesokudla njengesethembiso okungekho owasenza.
| Design | Who initiates | Promise you get | Promise you do not get |
|---|---|---|---|
| Routed VPN hub | Both ends, outbound to the hub | A routed path to permitted prefixes | Access to services no policy allows |
| Peer traversal with ICE | Both peers to a rendezvous service | A path tested between the two peers | A direct path through every NAT |
| TURN relay | Client outbound to a relay | Transport that survives symmetric NAT | Peer discovery or a usable directory |
| Application broker | Workstation outbound to a broker | One audited application session | Subnet-wide reachability |
Ukuthi iyiphi umugqa esebenzayo kuncike emsebenzini hhayi ekuthandeni. Isikhathi esisodwa sedeskithophu ekude, igobongo lokulawula elilodwa kanye nokufinyelela kuyo yonke inethiwekhi encane eyimfihlo — lezi izimfuno ezintathu ezingadingi iphoyinti lokungena elifanayo, ngisho noma zihlangana ngengozi emshinini owodwa.
I-hub ishintsha ukuthi ubani oshaya ngaphandle, hhayi ukuthi yini evunyelwe
Kumklamo we-hub onomzila, ikhompyutha ephathekayo ekude kanye nesiteshi somsebenzi, noma isango lesayithi elingaphambi kwakho, ngakunye kuvula umhubhe ophumayo oya ensizakalweni okungafinyelelwa yibo bobabili. Akukho okwamukela ukuxhumana okungaceliwe kusihambisi sendlela sesiteshi somsebenzi, futhi yikho kanye okwenza lo mklamo udlule i-NAT futhi usebenze ngisho noma isayithi lingenalo ikheli eliqinile. Bese i-hub ihambisa ukuhamba phakathi kwamakheli amabili angaphakathi ngokwenqubomgomo yayo.
Inani ukuthi i-hub kumele ibe khona, ifinyeleleke kusuka kuzinhlangothi zombili futhi kube nomuntu oyisebenzisayo. Ukuhlunga okuphumayo kumele kuvumele ukuthutha, futhi inethiwekhi eyivimbayo izokwehlula umklamo noma ngabe kwakungadingeki ukudluliswa kwembobo.
Ingxenye ebucayi ukuthi ukufinyeleleka nokugunyazwa yizinqumo ezihlukene ezithathwa ezindaweni ezihlukene. Umzila oya kuqalo akusho lutho mayelana nokuthi iyiphi insizakalo esiteshini somsebenzi umazisi ongayisebenzisa, futhi umthetho wodonga lomlilo ovumela umhubhe akusho lutho mayelana nokuthi ingabe i-akhawunti ingangena. Lungiselela kokubili, hlola kokubili, futhi gcina isinqumo sokugunyazwa kuhlelo olungumnikazi wensiza hhayi kuthebula lomzila.
Ukunqamula kusebenza kuphela lapho iziteki zombili zikwenza
Ukunqamula phakathi kontanga abalinganayo yikhono lohlelo oluthile, hhayi isilungiselelo esithuthukisa i-VPN. I-Interactive Connectivity Establishment iqoqa amakheli amaningi angabangeneleli futhi ihlola izingqikithi kuze kusebenze eyodwa: abangeneleli bomsingathi kuma-interface endawo, abangeneleli bokubonakala kwesiphakeli abakhiwe kulokho okuvezwa i-NAT, nabangeneleli abadluliswayo ababiwa ku-relay. Ikheli langasese lodwa aliwona umzila, ngoba uhlangothi olunye alukwazi ukuhambisa kuwo.
Icala le-relay kufanele liqondwe ngaphambi kokulilahla. RFC 8656 ichaza i-TURN njengenqubo lapho iklayenti licela isiphakeli ikheli lokuthutha elidlulisiwe futhi isiphakeli sidlulisa ukuhamba phakathi kwalelo klayenti nontanga bakhe. Ngakho-ke i-relay ithwala idatha, lokhu kuhluke kakhulu kuhlu olusiza kuphela amaphoyinti okugcina ukuba bahlangane. Ukushintshanisa ikheli le-relay nohlangothi olunye kuyisinyathelo sokuxhumanisa okumele isicelo sikwenze.
Ongakwazi ukukuthembisa umzila oqondile. I-NAT elinganayo kanye nezinye izihlangu zomlilo zebhizinisi ziyakwehlula ukubhoboza izimbobo, futhi lapho kwenzeka lokho uhlelo luye lubuyele ku-relay noma lwehluleke. Futhi awukwazi ukuphetha ngokuthi amaphoyinti amabili okugcina ahunyushiwe awasoze akhulume; isiteki esisekelwayo esinokubuyisela ku-relay sikhona kanye ngenxa yokuthi zivame ukukwazi. Nquma ukuthi ukutholakala noma ukuqonda ngqo kubaluleke kakhulu, bese uqinisekisa ukuthi ukusatshalaliswa kukhethe muphi umzila ngempela esikhundleni sokucabanga icala elihle.
I-broker incane kunenethiwekhi
Lapho isidingo siyisicelo esisodwa, i-broker yezicelo noma ukuxhumana okubuyayo okuqalwa isiteshi somsebenzi kungaba impendulo encane kakhulu. Isiteshi somsebenzi sishaya ngaphandle siya ku-broker, i-broker iqinisekisa umsebenzisi okude, futhi kuthwalwa kuphela leso sikhathi sesicelo. Akukho mzila oya kunethiwekhi encane yesiteshi somsebenzi owakhiwe, ngakho ukuhlaselwa kwesikhathi esikude akuzuzi njengefa umzila oya kuzo zonke izinto ezeduze kwaso.
Lokho kuncipha kunenani: isicelo ngasinye esengeziwe sidinga ukuhlanganiswa kwaso, futhi noma yini isicelo esiyicabangelayo mayelana nenethiwekhi yendawo, njengokwabelana kwengxenyamali eyivula kusiphakeli esiseduze, kungase kungafinyeleleki. Ama-broker futhi ahlanganisa inqubomgomo nokuloga endaweni eyodwa, okuluncedo kuze kube yilapho leyo ndawo isiba ukuphazamiseka.
Qhathanisa imingcele yethemba, bese uhlola umzila
I-hub ephethela imihubhe kuhlelo ingafunda ukuhamba okuyihambisayo. I-relay ingathwala ukushintshana okukhiyiwe ngokuzimela lapho isicelo sibethela ukusuka ekupheleni kuya ekupheleni, futhi i-broker ivamise ukuqeda isikhathi esisivezayo. Thola ukuthi ukuvikelwa kuphela ngempela kuphi ngaphambi kokunquma ukuthi imiklamo emibili iyalingana ngoba yomibili ibethelwe.
Bese uhlola ukuthi isiteshi somsebenzi sifinyelela ngempela kuphi ngaphandle, ngoba wonke umklamo ongenhla uncike kulokho. Sebenzisa lokhu esiteshini somsebenzi, ushintsha igama lomsingathi ohlose ukulisebenzisa.
ss -lntup
nc -vz hub.example.com 443
curl -sS -o /dev/null -w "%{http_code}\n" https://hub.example.comYamukela umklamo kuphela ngemva kokuba umsebenzi okude ohlosiwe uphumelele ngaphansi kobunikazi obuvunyelwe, ubunikazi obungagunyaziwe bunqatshiwe, futhi ukuziphatha lapho umzila oqondile noma we-relay ungatholakali kwaziwe futhi kubhaliwe. Faka ukuxhumana kabusha nesimo sokuqala esivamile sesiteshi somsebenzi, ngoba isikhathi esiqale ehhovisi nge-LAN asihloli lutho ukufinyelela kude okuncike kukho.