Izinqumo ezintathu zekheli ngaphambi kokubeka izinzwa ze-IoT ngemuva kwe-VPN
Amakheli amathathu enza imisebenzi emithathu: ihabhu lomphakathi, umlingani wesayithi oqinisekisiwe kanye nekheli langasese lomzwana. Hlela ngalinye ngaphambi kokwaba noma yini yomphakathi.
Amakheli amathathu ayazihlanganisa kuwo wonke uhlelo lwe-IoT nge-VPN, futhi awasiona uhlobo olufanayo lwesinqumo. Elinye liwukuthi umsebenzi okude uthola kanjani iphoyinti lokuphela lomhubhe, elinye liwukuthi isayithi libonisa kanjani ukuthi yilona isayithi, kanti elesithathu liwukuthi umsebenzi womzwana ulalela kuphi ngempela. Phendula ngokulandelana kwalokho futhi umklamo uvele wona. Phendula njengombuzo owodwa futhi uzogcina waba amakheli omphakathi emithonjeni engakaze iwadinge. Umzwana ongemuva komhubhe wesayithi ophumayo uyafinyeleleka kumsebenzi ogunyaziwe ngaphandle komthetho wokungena okhomba kumzwana.
Qala ngokuthi ngubani oqalayo
Ukuthi ngubani oshayayo kunquma cishe konke okulandelayo. Lapho isayithi lishayela ihabhu, isayithi alidingi ukufinyeleleka kokungena, kanti ihabhu lidinga igama noma ikheli isayithi elingalixazulula. Lokho kukhetha okukodwa kususa ingxenye enkulu yengxabano yamakheli omphakathi angaguquki ngaphambi kokuba iqale.
Izinhlaka ezintathu ziyahlukana ngokucacile, futhi ithebula elingezansi liyisimo esifushane sesinqumo.
| Decision | What you are actually choosing | Usual default |
|---|---|---|
| Hub endpoint | How the tunnel service is published | A DNS name, no inbound rule toward the site |
| Site peer | How the site proves its identity and which prefixes it carries | One key pair or certificate per site, prefix in the tunnel config |
| Sensor service | How the application is addressed inside the site | A stable private address from the site plan |
Umgqa ngamunye unomnikazi ohlukile, futhi yilokho okuyiphuzu langempela. Ihabhu elikamuntu oqhuba insizakalo ye-VPN, umlingani wesayithi eliqembu lenethiwekhi, futhi ikheli lomzwana likamuntu ophethe idivayisi.
Ikheli lehabhu liwukuqala, hhayi indawo yokuyisa
Igama elixazulula iye ekhelini lomphakathi elinakekelwayo lanele ihabhu. Irekhodi le-DNS lingalandela iphoyinti lokuphela lapho lihamba, ngaphandle kokuhlela ukucushwa kwesayithi ngakunye ngesandla. Lokho i-DNS engakwenzi ukudala ukufinyeleleka noma ukuvuselela iklayenti eligcina impendulo endala, futhi lezo izinkinga ezihlukene ezinezixazululo ezihlukene.
Uma uqhuba imihubhe yesayithi-kuya-kwesayithi ngaphandle kwehabhu, umqondo ofanayo usebenza ngesinye isimo: uhlangothi olulodwa ludinga iphoyinti lokuphela elifinyeleleka, noma izinhlangothi zombili zishayela umuntu wesithathu. Othile kusafanele abe ngumnikazi walelo kheli nokuvuselelwa kwalo.
Umlingani wesayithi uwubuwena obunesiqalo esinanyathiselwe
Umlingani uwubuwena kuqala bese kuba yisiqalo. Ngamagama e-WireGuard umlingani uphethe ipheya lokhiye futhi umusho we-AllowedIPs wehabhu uhlanganisa lolo khiye nesiqalo sesayithi. Ngamagama e-IKEv2 isitifiketi noma ukhiye owabiwe ngaphambili ukhomba isayithi futhi izikhethi zayo zokuhamba zisho ukuthi ingathwala ini. Ukushintsha ingxenye eyodwa kuphela kuphula ukuhlelwa, yingakho ukushintsha kwekheli kungafanele kuthathwe njengokushintsha kobuwena.
Gcina ubunikazi bokhiye noma kwesitifiketi esayithini hhayi kumsebenzi wehabhu, ukuze ukushintsha komhlinzeki kungabi ukushintsha kobuwena.
Isiqalo siyingxenye abantu abakhohlwa ukuyihlela. Ihabhu kufanele lixhumanise inethiwekhi encane yomzwana nomlingani ofanele, futhi iklayenti lomsebenzi lidinga umzila oya kuyo; umzila okhona kuphela kuklayenti uthumela uhambo lungene kumhubhe olulahla buthule. Bhala isiqalo erekhodini lesayithi eduze kwesigxivizo somunwe sokhiye, ukuze isango elishintshiwe lingavela ngokumboza okuhlukile ngaphandle kokuthi othile abone.
Ikheli lomzwana ngelohlelo lokusebenza
Ikheli langasese elivela ohlelweni lwesayithi lanele, futhi elikudingayo ukuqina hhayi ukufinyeleleka komphakathi: ukugcinelwa kwe-DHCP, ukwabiwa okumile, noma igama esifundeni sesayithi uqobo. Uma idivayisi ingakwazi ukufakwa izinombolo kabusha, ukuhumusha esangweni lesayithi kuyimpendulo esemthethweni inqobo nje uma ukuhumusha kubhaliwe futhi uhambo olubuyayo lululandela.
Omunye umkhuba okufanele ugcinwe: ungalokothi unamathisele ikheli lomphakathi lehabhu emkhakheni wokugxuma okulandelayo kumsingathi womzwana. I-VPN ifaka indlela yayo, futhi ukusondela kwe-Ethernet okuvamile ephoyintini lomphakathi kuyindaba eqanjiwe ekhiqiza ukucushwa okubonakala kukholakala.
Iziphendulo ziyizingxenye ezishiywayo. Idivayisi kufanele ithumele impendulo yayo ibuyele emhubheni, kungaba ngomzila oya kuklayenti lomsebenzi noma ngesango elifanayo elihumushe isicelo. Umzwana onesango elizenzakalelayo elingalungile lwamukela isicelo futhi liphendule endaweni engenalutho, futhi amanothi okudlulisela achaza ukuthi kungani ukufika nokuhlelwa komzila wempendulo kuyizidingo ezimbili hhayi esisodwa.
Nquma, bese ubhala umngcele
Bhala umngcele wokufinyelela ngaphambi kokuthi othile axhumane. Khawulela isango esigabeni se-IoT nakumasevisi athile adingwa umsebenzi, ngoba umzila osebenzayo uvamise ukuba ukufinyelela okuvamile ngengozi. Gcina ukuqapha kokufunda kuphela negunya lokucushwa njengezindima ezihlukene ezinobuwena obuhlukene, futhi isho umuntu osusa ukufinyelela lapho inkontileka iphela.
Imvume ingeyomnikazi wenethiwekhi, futhi ukuba ku-DMZ akusona isu lokufinyelela.
Ukuhlolwa ngemuva kokufakwa kuyisicefe futhi kuqinisekile: isicelo esisodwa ngaphakathi kwesiqalo esivunyelwe esiphumelelayo, isibali esikhula esangweni, kanye nomzamo owodwa wamabomu ngaphandle kwesiqalo ohlulekayo.