strongSwan ku-EC2: vumela i-VPC ihambise umthwalo womsebenzi

Umhubhe osebenza kusuka kusango ufakaza kuphela isango. Hambisa isizinda esincane somthwalo womsebenzi, vula ukudluliswa kumvakashi, ukhulise izikhethi, bese uhlola kusuka kuwo.

Umhubhe ukhona, i-instance yesango iyakwazi ukupinga inethiwekhi ekude, kanti i-instance yohlelo lokusebenza eseduze kwayo ayifinyeleli lutho. Akukho okugqekile. Ukuhlolwa okuphumelele kwaqala ku-host ye-VPN, futhi akuzange kubuze ukuthi lowo host angakwazi yini ukuthwala ikheli lomthombo elihlukile ngobudlelwano obufanayo be-IPsec. Le ncwadi yokusebenza ivala lelo gebe ngezinyathelo ezine, ngohlelo olugcina ukwehluleka ngakunye kubonakala.

Qala ngokubhala amakheli amane

Isinyathelo ngasinye esingezansi sibhekisa kuwo, ngakho-ke wagcwalisele i-akhawunti yakho ngaphambi kokuthinta ithebula lemizila.

VPC:             10.60.0.0/16
Gateway subnet:  10.60.1.0/24, gateway ENI address 10.60.1.10
Workload subnet: 10.60.2.0/24, application address 10.60.2.20
Remote network:  10.90.0.0/24

Isibonelo sithatha ukuxhumana kwe-IPsec okugunyaziwe nokusebenzayo okusekwe kumgomo, kanye nokugeleza okugcina umthombo. Lokhu akulona iklayenti lokufinyelela kude le-NAT eliboleka ikheli elilodwa elabiwe, futhi lowo mehluko unquma ukuthi izikhethi kufanele zishintshe yini.

Isinyathelo 1: nikeza isizinda esincane somthwalo womsebenzi umzila

Ithebula lemizila elihlotshaniswa ngempela nesizinda esincane somthwalo womsebenzi lidinga indlela yesiqalo esikude ekhomba kusixhumi senethiwekhi sesango. Umzila womvakashi ofakwe ngaphakathi kwe-instance awusona isilinganiso kulelo thebula lemizila le-AWS, futhi akukho nani lokucushwa kwe-strongSwan okuzokwakha elinjalo.

Umhlahlandlela we-AWS wokuhambisa ngokusebenzisa idivayisi uchaza izinhloso zesixhumi senethiwekhi kanye nesidingo sokuhlola komthombo/nendawo ye-instance edlulisayo. Khawulela lokho kushintsha kokuhlola endimeni yesango, futhi ushiye izinto zohlelo lokusebenza ezijwayelekile zihlezi.

Ungayishintshi imizila yasendaweni ye-VPC noma yonke into ekhona ukuze wenze indawo yenethiwekhi eyodwa egunyaziwe. Hlola okuxhunyiwe nokusebenzayo, hhayi lokho ikhasi le-console elikukhombisa ngethebula lemizila okungekho muntu olisebenzisayo. Amathebula amabili abukeka efana angaba nokuxhumana okuhlukile. Elibalulekile yilelo isizinda esincane somthwalo womsebenzi esixhunywe kulo.

Isinyathelo 2: vula ukudluliswa kumvakashi

sysctl -w net.ipv4.ip_forward=1
# persist in /etc/sysctl.d/ and re-apply after reboot

I-kernel kufanele idlulise, futhi umlilo we-host kufanele uvume ukudlula. Engeza imithetho yokudlulisa ehlosiwe yesiqalo somthwalo womsebenzi nesikude esikhundleni sokwamukela konke, futhi uqinisekise ukuthi isizinda esincane sesango sigcina umzila wezokuthutha osebenzisekayo womgudu waso.

Amaqembu okuphepha yindawo lapho lesi sinyathelo sivame ukumisa khona. Idivayisi ephakathi ayizuzi ukuziphatha kokubhekisela kweqembu lokuphepha kokuxhumana okuqondile kwe-instance, ngakho-ke umthetho okopishwe esibonelweni se-Client VPN ephethwe kungenzeka ungafani neze. Hlola iqembu lokuphepha kanye ne-ACL yesizinda esincane endleleni yangempela, kuzo zombili izinhlangothi.

Isinyathelo 3: khulisa izikhethi ziye emithonjeni yangempela

Umgomo okhuluma 10.60.1.10/32 kuphela ohlangothini lwe-AWS uchaza impumelelo eqale esangweni ngaphandle kokukhuluma 10.60.2.20. Umzila obheke endaweni ekude awukhulisi isikhethi sokugcwala, futhi lokho kuyingxenye yesibili yalolo kumangala olunye.

swanctl --list-sas
# read the installed CHILD-SA local and remote traffic selectors

Uma idizayini okuvunyelwene ngayo ivikela i-VPC yonke, izinhlangothi zombili kufanele zamukele 10.60.0.0/16 ne-10.90.0.0/24. Uma ivikela umthwalo womsebenzi owodwa, sebenzisa leso siqalo esincane ngamabomu. Kunoma yikuphi, hlola umgomo we-CHILD-SA ofakiwe, ngoba ukucushwa okuhleliwe kanye nohlangothi olunciphise ngendlela ehlukile akusona isivumelwano esifanayo.

Indawo ekude kufanele futhi ihambise izimpendulo zemithombo ye-VPC egciniwe zibuyele emuva ngokusebenzisa isango le-IPsec elihlosiwe. Gcina ukukhululwa kwe-NAT okusekelwayo komgudu ovikelwe lapho kuneminye imithetho ye-NAT yomthombo; ukuhumusha umthwalo womsebenzi ongagunyaziwe ube ikheli le-host elivunyelwe kungenye inkontileka yobunikazi, hhayi indlela emfushane yokufinyelela obukufunayo.

Isinyathelo 4: qinisekisa, bese uhlehla uma kudingeka

Hlola kusuka kumthwalo womsebenzi uqobo ngokusebenza kohlelo lokusebenza okusha okuvunyelwe, bese uphinda ngendawo okufanele ikhishwe. Bhala ikheli lomthombo elibonwa yisevisi ekude kanye nendlela yokubuya eliyisebenzisayo. Ukupinga kwesango noma isimo se-IKE esiluhlaza akusona leso sihlolo.

Uma umthwalo womsebenzi usuhluleka ngenkathi isango lisebenza, buyela emuva ngezinyathelo ngokulandelana: isikhethi, bese ukudluliswa namakholomu okuphepha, bese ithebula lemizila elixhunyiwe. Ngayinye inophawu oluhlukile, futhi ukuqagela kweqa leyo eyiphutha ngempela.

Ukuhlehla kuguqula ukulandelana okufanayo. Susa umzila wesizinda esincane somthwalo womsebenzi ekugcineni, ngemva kokubuyisela izikhethi zangaphambili, ukuze ungashiyi isizinda esincane esikhomba esangweni olungasavikeli imithombo yaso. Ukuzihostela kungasebenza ngaphezu kwe-host yesango uma lezi zinkontileka zihlala, futhi i-Site-to-Site VPN ephethwe yi-AWS iyimodeli ehlukile yokusebenza lapho i-strongSwan ingase ihlale ohlangothini lwesango leklayenti esikhundleni salokho.

Izihloko ezihlobene