Kungani i-AWS Client VPN ilahla ithrafikhi ngaphandle komzila ohambisanayo

Ipoyinti lokugcina lidlulisa iphakethe kuphela lapho ithebula lemizila yalo limboza indawo ekuyiwa kuyo. Funda imizila, memezela iziqalo nge-for_each, qinisekisa indlela yokubuya.

I-Client VPN inikeza iklayenti ikheli, ukuxhawulana kwezandla kuqedwa, futhi uxhumano lusaqhubeka lungayi ndawo. Ngaphambi kokuthinta izitifiketi noma izinguqulo zeklayenti, bheka ithebula lemizila lepoyinti lokugcina ngokwalo. Ipoyinti lokugcina le-AWS Client VPN lidlulisa iphakethe kuphela lapho omunye wemizila yalo umboza isiqalo sendawo ekuyiwa kuyo; uma kungenasinto esihambisanayo, iphakethe liyalahlwa epoyintini lokugcina futhi umsingathi oqondiwe akakaze abone i-SYN.

Lesi yisinqumo sokudlulisa, hhayi esokuqinisekisa ubunikazi. Kwenzeka ngemva kokuba umhubhe usuvulekile nangemva kokuba imithetho yokugunyaza ihloliwe, yingakho isitifiketi esivumelekile neqembu elivumelekile kusengakhi umxhumano ofile.

Ipoyinti lokugcina lidlulisa kuphela lokho okumbozwa yithebula lemizila yalo

Umzila ngamunye yi-CIDR yendawo ekuyiwa kuyo kanye nesubnet okufanele yamukele ithrafikhi. Ipoyinti lokugcina liqhathanisa indawo ekuyiwa kuyo yeklayenti nalolo hlu, likhetha umbhalo ohambisanayo bese lithumela iphakethe kusubnet ehlobene. Akukho mbhalo kusho akukho gxuma elilandelayo.

Qaphela ukuthi umzila awuyona ini. Awuwona umbhalo othebula lemizila le-VPC, futhi awugunyazi lutho. Imithetho yokugunyaza inquma ukuthi iqembu lingafinyelela yini endaweni ekuyiwa kuyo; imizila inquma ukuthi ipoyinti lokugcina linendawo yokuthumela iphakethe yini. Kokubili kufanele kuvumelane, futhi kwehluleka ngezimpawu ezihlukene, ngakho ukuqagela ukuthi yikuphi okugqekile kuchitha intambama yonke.

Ukungavumelani okujwayelekile yi-VPC enamaphoyinti ahlobene. Othile wengeza umzila we-10.20.0.0/24 kuyilapho umsingathi ehlala ku-10.20.4.0/24, ngakho ikheli liwela ngaphandle kwawo wonke umbhalo. Ukuthwebula ohlangothini lweklayenti kubonisa ama-SYN aphindaphindayo ngaphandle kwempendulo, futhi amalogi endawo ekuyiwa kuyo awabonisi lutho.

Funda uhlu lwemizila ngaphambi kwesitifiketi

Imizila yepoyinti lokugcina iyinto ehlukile, ngakho yibuze ngqo esikhundleni sokufunda ithebula le-VPC:

aws ec2 describe-client-vpn-routes --client-vpn-endpoint-id cvpn-endpoint-0123456789abcdef0 --query 'Routes[].{Dest:DestinationCidr,Target:TargetSubnet,Origin:Origin}'

Thatha ikheli eliwukuphela nokubude kwesiqalo kuklayenti ehlulekayo, bese uhlola ukumbozeka ngohlamvu nolunye. Ukufana kwesiqalo eside kakhulu kuyasebenza, ngakho umzila obanzi awukusindisi uma omncane ukhomba kwenye indawo.

Isisetshenziswa esisodwa sendawo ekuyiwa kuyo kube nge-for_each

Amabhulokhi emizila abhalwe ngesandla ayashintsha ngaso leso sikhathi lapho othile engeza isiqalo kukhonsoli. Gcina izindawo ekuyiwa kuzo kumephu futhi wakhe isisetshenziswa esisodwa ngokhiye ngamunye, ukuze konke okwengezwayo noma okususwayo kuhlale kwehlukile.

variable "client_vpn_routes" {
  type = map(string)
  default = {
    "10.20.0.0/16"  = "subnet-0aa11bb22cc33dd44"
    "172.31.0.0/20" = "subnet-0aa11bb22cc33dd44"
  }
}

resource "aws_ec2_client_vpn_route" "this" {
  for_each               = var.client_vpn_routes
  client_vpn_endpoint_id = var.client_vpn_endpoint_id
  destination_cidr_block = each.key
  target_vpc_subnet_id   = each.value
  depends_on             = [aws_ec2_client_vpn_network_association.this]
}

Gcina ukuncika ekuhlobeni kwenethiwekhi. Umzila udinga isubnet ehlobene, ngakho i-apply eyakha kokubili kufanele ihlele ukuhlobana kuqala, futhi ngaphandle kwaleso sikhombo i-Terraform ikhululekile ukuzama umzila kuqala. Bese ufunda uhlelo: inani lezinto ezingeziwe zomzila kufanele lihambisane neziqalo ozengezile. Uma uhlelo lushintsha nephoyinti lokugcina, isisetshenziswa sephoyinti lokugcina sibhalwe ngokungalungile, futhi ukusisebenzisa kunqamula wonke iklayenti elixhunyiwe.

Ukwamukela iphoyinti lokugcina ongalakhi

Amaqembu amaningi azuza iphoyinti lokugcina elakhiwe kukhonsoli, yingakho kungekho khodi yemizila. Ungavusi elinye iphoyinti lokugcina ukuze nje ufaka imizila ku-Terraform.

Esikhundleni salokho ngenisa, noma dlulisa ama-id njengeziguquguqukayo futhi ushiye izinto ezizuziwe zingaphethwe. Ukungenisa kudinga ifomethi yesihlonzi echazwa umhlinzeki kuhlobo ngalunye lwesisetshenziswa; ikhoda iphoyinti lokugcina, isiqalo sendawo ekuyiwa kuyo nesubnet eqondiwe. Kopisha leyo ntambo emibhalweni yesisetshenziswa esikhundleni sokuyihlanganisa ngesikhumbulo, gijimisa uhlelo, futhi ulindele ukuthi kube lula ukungabi khona kwezinguquko ngaphambi kokwengeza okusha.

Landelela iphakethe ngokulandelana elihamba ngakho

Uma umzila ukhona futhi uxhumano lusahluleka, hamba indlela ngokulandelana esikhundleni sokuqagela esigabeni esiphezulu.

  1. Umzila: isiqalo simboza indawo ekuyiwa kuyo futhi sikhomba esubnetini ehlobene nephoyinti lokugcina.
  2. Umgunyazo: umthetho wokugunyaza uvumela leyo ndawo ekuyiwa kuyo eqenjini lomsebenzisi. Umzila wodwa awuniki ukufinyelela.
  3. Indlela yokubuya: ithebula lemizila lesubnet eqondiwe libuyisela izimpendulo liphindela epoyintini lokugcina, futhi iqembu lokuphepha livumela imbobo evela echibini lamakheli eklayenti.
  4. Uhlelo lokusebenza: vula uxhumano lwe-TCP lwangempela kuklayenti, bese uqinisekisa ukuthi amalogi endawo ekuyiwa kuyo akhombisa ikheli lomthombo elilindelekile elivela echibini.

Shintsha isiqalo esisodwa nge-apply ngayinye, bese ufunda kabusha uhlu lwemizila, futhi ubhale ndawonye indawo ekuyiwa kuyo, umthetho ogunyazayo kanye nendlela yokubuya. Umuntu olandelayo ozolungisa uxhumano olwenqatshiwe kufanele aqale kulolo hlu, hhayi emcabangweni ngezitifiketi.

Izihloko ezihlobene