Iyiphi i-IP yomthombo esetshenziswa yi-NAT gateway ye-AWS ibheke ku-VPN?

Uvula i-console ye-VPC ngoba uzakwethu ubuze ukuthi yiluphi uhla lomthombo oluzofika nge-VPN yesayithi-kuya-sayithi. Ikhasi lama-NAT gateway likhombisa i-gateway yomphakathi ene-Elastic IP exhunyiwe, futhi isilingo ukuthumela lelo kheli bese uqhubeka. Yimpendulo efanele yomzila we-inthanethi nempendulo engafanele yomzila we-VPN, futhi umehluko ukuthi ithebula lemizila ikhomba kuyiphi i-gateway. Hamba umzila ngaphambi kokubhala uhlu oluvunyelwe.

Qala ekhasini lama-NAT gateway, hhayi ohlwini oluvunyelwe

Ikhasi lama-NAT gateway likutshela i-subnet, uhlobo ne-Elastic IP, futhi lezo zinkambu ezintathu zanele ukuqala. Engakutsheli kona umzila othathwa yi-traffic ngemuva kwalokho. Lokho kuvela emathelini emizila axhunywe ku-subnet ye-NAT gateway.

Funda uhlobo kuqala, ngoba owomphakathi noma oyangasese unquma ukuthi i-gateway ye-inthanethi izovela kamuva yini ochungechungeni. Bese ufunda i-subnet, ngoba umzila wesibili uhlala lapho.

Landela izinguquko ezimbili

Womabili ama-NAT gateway omphakathi nawangasese aguqula umthombo we-IPv4 wangasese womsebenzi uye kukheli lwangasese le-IPv4 le-NAT gateway uqobo. Leyo nguquko yokuqala yenzeka kungakhathalekile uhlobo. Unguquko wesibili yilowo abantu abawukhohlayo: i-NAT gateway yomphakathi inikela i-traffic ku-gateway ye-inthanethi, ehlanganisa ikheli ne-Elastic IP exhunyiwe.

workload 10.20.1.5 -> NAT gateway 10.20.2.10 -> internet gateway -> Elastic IP 203.0.113.25
workload 10.20.1.5 -> NAT gateway 10.20.2.10 -> transit or virtual private gateway -> partner sees 10.20.2.10

Emzileni wangasese akukho gateway ye-inthanethi ochungechungeni. Lapho i-traffic iphuma nge-gateway yokudlulisa noma i-gateway yangasese ebonakalayo, umhlahlandlela wama-NAT gateway ubhala ikheli langasese le-NAT gateway njengomthombo otholwa uhlangothi olukude. Yilolo kheli okufanele uzakwethu alivumele, hhayi i-Elastic IP.

Umzila we-VPN uvamise ukukhombisa ikheli langasese

Kumsebenzi oku-10.20.1.0/24 ofinyelela isiqalo sozakwethu, ithebula lemizila le-subnet yomsebenzi likhomba ku-NAT gateway, futhi ithebula lemizila le-subnet ye-NAT gateway likhomba emzileni we-gateway yangasese. Womabili amagxathu abalulekile, futhi iwelesibili kuphela elinquma lokho okubona uzakwethu. Uma i-subnet ye-NAT ingenayo imizila eya emzileni we-VPN, iphakethe alifiki neze, futhi lokho kuyihluleka ehlukile ekhelini lomthombo elingalungile.

Qinisekisa lowo mzila wesibili ngaphambi kokukhuluma ngamakheli nhlobo. Umzila ongekho nomthombo obikwe kabi kubonakala kufana ncamashi kuzakwethu ongayiboni i-traffic.

Lapho uguquko lwesibili lushintsha impendulo

I-AWS iphinde inikeze ukumephu kwe-NAT okucacile nokuhambisanayo okukodwa-kuya-kukodwa kusihlomelo se-gateway yokudlulisa. Lokho kumephu kungaguqula umthombo futhi ngaphambi kokuba insizakalo ekude ibone, futhi akukhona ukuziphatha okuzenzakalelayo okumane kuhambise umzila. Njengoba kufanele kulungiswe ngamabomu, kuthatha njengokuhlukile komklamo hhayi njengento oyizuza ngengozi. Uma kungekho muntu eqenjini lakho okhumbulayo ukuthi wayivula, thatha ukuthi ayikho kuze kube uyifunda isihlomelo.

Uma umklamo wakho uyisebenzisa, uhlu oluvunyelwe kufanele luchaze ukumephu kokugcina hhayi ikheli le-NAT gateway. Ukunakekela okufanayo kusebenza emizileni yokutholakala: lapho amakheli amaningi e-gateway ebamba iqhaza, isethi yomthombo elindelekile iyinhlanganisela, hhayi ikheli elilodwa elimele. Bhala ukuthi ikheli ngalinye lingelaluphi uguquko, ngoba uhlu olungenamsuka alunakucwaningwa kamuva.

I-NAT gateway yangasese ayinakunikezwa insizakalo ye-inthanethi ngokuyikhomba ku-gateway ye-inthanethi; i-AWS ibhala ukuthi i-traffic enjalo iyalahlwa. Khetha uhlobo emzileni ogcwele, hhayi egameni elithi VPN esidingweni.

Bhala isivumelwano uzakwethu angasebenza ngaso

Isivumelwano esisebenzisekayo sinezingxenye ezine: indlela okugqama ngayo ukuhamba, ubunikazi obuguquliwe uzakwethu azobona, umzila wokubuya walobo bunikazi kanye nobubanzi bokuvikela obusebenzayo. Ukuhamba kwe-NAT gateway kuqala ohlangothini lomthombo olusekelwayo, ngakho lokhu akukhona insizakalo yokudlulisela amachweba angenayo ukudalula umsebenzi wangasese. Ukusho lokho ngokuzwakalayo kusenesikhathi kuvimbela ukubuyekezwa komklamo lapho uhlangothi ngalunye lucabanga ukuthi olunye luqalile.

Uguquko luthenga ukukhululeka ekushayisaneni kwamakheli nenqubomgomo yomthombo ebikezelwayo, futhi kukulahlekisela ubunikazi bomsebenzi ngamunye emibhalweni yozakwethu. Uma ukucwaninga kudinga ukwabiwa komsebenzi ngamunye, gcina lobo bunikazi esigabeni sohlelo esikhundleni sokuzama ukububuyisa ekhelini lomthombo eliguquliwe.

Ngemuva kwalokho hlola futhi womabili amathebula emizila ngemuva kwanoma yiluphi ushintsho, ngoba isihlomelo esisha noma i-subnet exhunywe kabusha ibhala kabusha impendulo ngokuthula.