Indawo yokuphatha ye-SaaS ngemuva kwe-VPN: iyiphi ikheli okufanele lithenjwe?

Umthombo ubona ikheli lokuphuma lesango lakho le-VPN, hhayi ikheli lomhubhe we-laptop. Thembela kuphela isihloko se-proxy esilungisiwe, bese uvimba yonke imisebenzi yokuphatha.

Amakhasi omphakathi e-SaaS angahlala evulekile kuwo wonke umuntu kuyilapho imisebenzi yokuphatha engemuva kwawo inqaba noma ubani ongaphandle kwe-VPN. Indlela eyenza lokhu kwenzeke akuyona imenyu efihliwe noma ikhasi lokungena elihlukile; ukuhlolwa komzila wenethiwekhi oletha isicelo. Uma ubufakazi bekheli bungalungile, ukuhlolwa kukhiya abaphathi bangempela noma kwamukele noma ubani ongathayipha isihloko. Qala ngalokho umthombo eqinisweni akutholayo.

Lokho umthombo eqinisweni akutholayo ngemva komhubhe

Lapho isiphequluli sifinyelela isayithi yomphakathi nge-VPN futhi ethwala ithrafikhi ye-inthanethi, isango lihumusha uxhumano ngaphambi kokuba liphume. I-SaaS ibona ikheli lokuphuma lomphakathi lesango, ngokuvamile ikheli elilodwa noma ibanga elincane, futhi ayilokothi ibone ikheli lomhubhe we-laptop. Yingakho ukwengeza i-10.90.0.42 ohlwini oluvunyelwe kwehluleka, futhi yingakho ukwengeza yonke i-RFC 1918 kwehluleka ngokuzwakala kakhulu: eyesibili yamukela yonke inethiwekhi yangasese engafinyelela kuwe. Ikheli elilodwa elifanele isimo yilelo inhlangano yakho eliphethe ngempela endaweni yokuphuma.

curl -s https://ifconfig.me
dig +short admin.example.com

Umhubhe ohlukanisiwe wephula lesi sibonelo buthule. Uma i-VPN ithwala kuphela imizila yasehhovisi yangasese, isicelo esiya egameni lomsingathi wokuphatha lomphakathi siphuma ngomhlinzeki wendawo futhi umthombo ubona ikheli lokuhlala. Isithonjana se-VPN esixhunyiwe asifakazi lutho mayelana nendawo eqondiwe ethile, ngakho hlola indawo eqondiwe hhayi umhubhe.

Yima futhi ulungise umzila ngaphambi kokubhala noma iyiphi inqubomgomo uma ikheli lokuphuma lihluka ngomsebenzisi. Isimo esihambisana nabaphathi abathile kuphela sihamba kabi kunokungabi nasimo, ngoba sifihla inkinga kuze kube khona isigameko.

Thembela kuphela i-proxy ebhala kabusha ikheli

Izayithi eziningi zomphakathi zingemuva kwe-CDN noma i-proxy ehlanekezelayo, ngakho ikheli le-socket lomthombo lingelalowo mchamo wangaphambili hhayi elomvakashi. Umchamo wangaphambili uvamise ukudlulisa ikheli lokuqala esihlokweni, futhi leso sihloko silawulwa umhlaseli ngaphandle uma umthombo usamukela kuphela kuma-proxy aziwayo. Lungisa ngokusobala uhlu lwemithombo ethenjwayo futhi wenze umthombo ungafinyeleleki kusuka kunoma yikuphi okunye. Ngaphandle kwaleyo ngxenye yesibili, umhlaseli udlula i-proxy futhi uthumela isihloko ngqo.

set_real_ip_from 192.0.2.0/24;
real_ip_header X-Forwarded-For;
real_ip_recursive on;
curl -H 'X-Forwarded-For: 198.51.100.27' https://origin.example.com/admin

Ukucabanga okufanayo kusebenza kuphrothokholi ye-PROXY: ithembekile kuphela lapho umlaleli eboshelwe ku-interface i-proxy engafinyelela kuyo futhi akukho okunye okungafinyelela. Umongo wekheli ongekho kufanele wehlule ukuhlolwa okuvikelwe esikhundleni sokuwa emvumelweni ozenzakalelayo. Isihloko esingekho akusona ubufakazi bomzila othembekile.

Namathisela isimo kumsebenzi ngamunye ovikelwe

Beka ukuhlolwa emngceleni wokugunyaza okudlula kuwo wonke umsebenzi ovikelwe, hhayi ekhasini elidweba imenyu. Amaqembu emizila, i-middleware noma ungqimba lwenqubomgomo konke kuyasebenza; ikhophi ngesiphathi ngasinye ayisebenzi, ngoba isiphathi umuntu azosengeza ngayo ikota elandelayo ngeke sibe nayo.

user = requireAuthenticatedSession()
requirePermission(user, "admin")
requireVpnEgress(verifiedClientAddress(request))
performProtectedOperation(user, request)

Umngcele ofanayo kufanele uhlanganise i-JSON API, okuthunyelwayo, ama-URL okulanda asayiniwe kanye nokuxhawana kwe-WebSocket, ngoba akukho kukodwa okudinga ukuthi ikhasi le-HTML licelwe kuqala. Isixhumanisi sokulanda esidalwe ngesikhathi i-VPN isebenza sihlala sisebenza ngemuva kwalokho ngaphandle uma indawo yokulanda ihlola futhi. Amaseshini esikhathi eside nawo adinga umthetho wokuhlola kabusha, ngaphandle kwalokho isicelo esisodwa esiqinisekisiwe siba ukukhululwa unomphela. Ukwenqaba okuzenzakalelayo ukuphela kokuhlela okusinda ekushintshweni kwabasebenzi.

Ama-cache abiwekiwe ayenye indlela yokuzungeza ukuhlolwa. I-cache esivele inempendulo evikelwe ingayihambisa ngaphandle kokuxhumana nomthombo, ngakho phawula izimpendulo zokuphatha njengeziyimfihlo futhi uzigeze kude nesitoreji esabiwekiwe. Uma i-cache kufanele izihambise, ukuhlolwa kokufinyelela kufanele kusebenze ngaphambi kokuhambisa, lokho ngokuvamile kusho ukuthi ayikwazi nhlobo ukuba i-cache ebiwekiwe.

Hlola izindlela zokudlula ozivale manje

Zilolonge imethrikhi hhayi umzila ojabulisayo: umphathi ongena nge-VPN, lowo mphathi ngaphandle kwayo, ongewona umphathi ongena ngayo, nesihloko sekheli esingamanga. Engeza isicelo esiqonde emthombweni nesicelo esinempendulo egcinwe ku-cache, ngoba yilezo ezimbili ezidlula ngokuphelele umchamo wangaphambili.

curl -sI https://admin.example.com/export.csv
curl -s -H 'X-Forwarded-For: 198.51.100.27' https://origin.example.com/admin
curl -s https://admin.example.com/api/me -o /dev/null -w '%{http_code}\n'

Isicelo ngasinye kufanele sibuyise isimo isimiso esithembisa sona, futhi ilogi kufanele ibhale ukuthi yibuphi ubufakazi bekheli obusetshenzisiwe. Hlanganisa i-IPv6 ngokwahlukile, ngoba umthombo we-stack ekabili ungabona umndeni womthombo ohlukile kunalowo owuhlolile. Gcina imisebenzi evamile yamakhasimende isebenza ngaphandle kwe-VPN, ngaphandle kwalokho ushintsho luzobuyiselwa lapho ikhasimende likhononda okokuqala. Bhala umphumela olindelekile womugqa ngamunye ngaphambi kokuwusebenzisa, ukuze ukuphumelela okumangazayo kubonakale.

Ikheli lokuphuma lifakazela umzila wenethiwekhi ovunyelwe, hhayi umuntu futhi hhayi idivayisi ephethwe. Ligcine njengesimo esisodwa eduze kokuqinisekisa nokugunyaza, futhi indawo yokuphatha ihlala incane ngaphandle kokuguqula wonke umkhiqizo ube yisevisi ye-VPN kuphela. Lokho kwehlukana wukuklama uqobo, hhayi umkhawulo walo.

Izihloko ezihlobene