Ukufinyelela kude komthuthukisi ku-VPC ye-Google Cloud: khetha indlela

Umthuthukisi udinga isikhathi esisodwa se-SSH, imbobo eyodwa yedatha noma ukufinyelela okubanzi ezinsizeni eziyimfihlo eziyishumi nambili, futhi isicelo ngasinye salokhu sibukeka njengombuzo ofanayo. Akunjalo. Iziqondiso, amaphrothokholi kanye nobunikazi okuhilekile kunquma ukuthi iyiphi indlela yokufinyelela ku-Google Cloud efanele, futhi ukukhetha enkulu kakhulu ngokuzenzakalela kudala umsebenzi omawungawutholi.

Bhala iziqondiso namaphrothokholi

Bhala amakheli ayimfihlo, izimbobo namaphrothokholi adingwa umsebenzi ngempela, bese umaka ukuthi yibuphi ubunikazi okufanele buqinisekiswe ngokwahlukile. Imbobo yedatha nendawo ye-DNS eyimfihlo yizimfuneko ezihlukene, futhi insiza ye-UDP isusa ngokuphelele enye yezinketho ezingezansi. Uhlu olubhaliwe lukhombisa futhi lokho ongakunikezi. Ingxenye yilokho abahloli ababuza ngakho.

Yenza lokhu ngaphambi kokuvula isilaleli. Uhlu luzoba ukuhlolwa kokwamukelwa kamuva, futhi iyona ndlela ethembekile yokuhlukanisa umhubhe omncane nomhubhe obanzi osebenza ngengozi.

IAP yezinsiza ezimbalwa ze-TCP

Ukudluliswa kwe-TCP ku-Identity-Aware Proxy kunikeza umhubhe oqinisekisiwe oya ezinsizeni ze-VM ezifanele ngaphandle kokuchaya insiza ku-inthanethi. Isimo sansuku zonke gcloud compute ssh instance-1 --tunnel-through-iap --zone=us-central1-a, futhi imbobo eyodwa ingadluliselwa endaweni ngokuthi gcloud compute start-iap-tunnel instance-1 5432 --local-host-port=localhost:15432 --zone=us-central1-a.

Izinto ezintathu kufanele zivumelane: umbuyi udinga indima yokufinyelela kumhubhe we-IAP, isivimbelo somlilo kufanele samukele ibanga lomthombo we-IAP, futhi indawo ekuziwa kuyo kufanele ifinyeleleke ku-instance. Igunya lokudala umhubhe akusilo ugqozi lwedatha, ukungena kwe-SSH noma isikhathi se-RDP, ngakho gcina ukuqinisekiswa kohlelo lapho kufanele khona.

Ukudluliswa kwe-TCP ku-IAP akusiyo i-VPN yezinga lesithathu. Ihambisa i-TCP iya endaweni ekhethiwe, hhayi ukuhamba kwe-IP okungafuneki noma i-UDP, futhi ayihambisani kahle lapho uhlelo ludinga i-DNS eyimfihlo ezinsizeni eziningi.

I-VPN yokufinyelela kude yokufinyeleleka okubanzi

Lapho kudingeka iziqondiso eziningi, amaphrothokholi noma izindawo ze-DNS eziyimfihlo, isimo esingcono i-VPN yokufinyelela kude elawulwa ngokusobala ku-VM noma kudivayisi esekelwayo. Lokho kusetshenziswa kuhlukile ku-Cloud VPN elawulwa yi-Google: ungumnikazi wokubhaliswa kobunikazi bekhasimende, izibuyekezo zesofthiwe, imizila yekhasimende kanye nemizila yokubuya ku-VPC.

Hlela uhlu lonke, hhayi isilaleli somphakathi kuphela. Fakelela iqoqo lemihubhe, umzila we-VPC obuyela kuwo, izilawuli zokudluliswa, ukuxazululwa kwe-DNS kanye nenqubomgomo yokufinyelela yensiza ngayinye. I-VPN exhuma kodwa engakwazi ukuxazulula amagama angaphakathi yehluleka ukuhamba komsebenzi womthuthukisi ngokuphelele njengaleyo engakaze ixhume.

I-Cloud VPN iyisango sendawo, akuyona iphrofayili yekhompyutha ephathwayo

I-Google Cloud VPN ixhuma amasango ozakwabo nge-IPsec, futhi imibuzo evamile yayo ihlukanisa leyo ndima yendawo-kuya-endawo nokufinyelela kwekhasimende-kuya-esangweni. Ukudala umhubhe akukhiqizi iphrofayili umsebenzi ayifaka kukhompyutha ephathwayo. Umehluko ubalulekile lapho othile ecela iphrofayili ye-Cloud VPN. Impendulo ingomunye umkhiqizo.

Okwenziwa kahle isango ukunikeza imishini engemuva kwenethiwekhi yehhovisi umzila ongena ku-VPC. Akuqinisekisi umsebenzi ngamunye futhi akunikezi izimvume zohlelo, ngakho leyo migomo ihlala ezingeni lenethiwekhi nolohlelo lapho ingasetshenziswa ngobunikazi.

Qinisekisa futhi urekhode

Hlola indawo encane kakhulu kuqala, bese kuba eyo eyodinga i-DNS, bese kuba indawo okumele ihlale inqatshiwe. Gijimisa ukuhlolwa ngakunye kusuka kukhasimende elilodwa elizosebenzisa indlela ekukhiqizeni, ngoba ukuhlolwa okuphumelelayo okusuka esiteshini somlawuli akufakazeli okuningi mayelana nekhompyutha ephathwayo yomthuthukisi enenethiwekhi ehlukile.

Rekhoda imodeli ekhethiwe, iziqondiso ezizifaka, ubunikazi obuqinisekisayo kanye nokuziphatha kokwehluleka lapho indlela ingatholakali. Lowo mbhalo uyiwona ovimbela isicelo esilandelayo ekwandiseni umhubhe buthule esikhundleni sokungeza indawo eyodwa kumklamo obhaliwe.