Kungani i-VPN ye-Azure Point-to-Site ingayishintshi i-IP yakho yomphakathi
Ithuluzi le-point-to-site lithwala kuphela imizila yenethiwekhi ebonakalayo, ngakho i-IP yakho yomphakathi ihlala isendaweni kuze kube yilapho ukuhamba komhubhe okuphoqelekile kanye ne-SNAT ye-firewall kuhambisa umkhondo wokuphuma kuya ku-Azure.
Ngixhuma iklayenti le-Azure VPN kwi-laptop ye-Windows, ngivula ikhasi lokubuyisa ikheli futhi ngibona ikheli lomphakathi elifanayo nalelo elanikezwa i-router yasekhaya. Ngaleso sikhathi ibhokisi lokugxuma ku-10.20.0.4 liyaphendula futhi igama le-endpoint yangasese liyaxazululwa, ngakho ithuluzi aliphukanga. I-gateway ye-point-to-site yenza ngqo lokho okusho ukucushwa kwayo okuzenzakalelayo: ithwala iziqalo zangasese futhi ishiya konke okunye kuxhumano lwasekhaya. Ukuthola ikheli lokuphuma eliphethwe yi-Azure ukushintsha kwedizayini yomzila, hhayi ukulungiswa.
I-gateway imemezela ini ngokuzenzakalela
I-gateway icindezela imizila yesikhala sekheli lenethiwekhi ebonakalayo, kanye namanethiwekhi angabangani lapho ukudlula kwe-gateway kuvunyelwe kanye neziqalo zasekhaya ezifundwe ngoxhumano lwe-site-to-site noma i-BGP. Akukho 0.0.0.0/0 kulelo qoqo. Uhlelo lwakho lokusebenza lugcina umzila wakho ozenzakalelayo ku-Wi-Fi noma i-Ethernet, ngakho iphakethe eliya ku-API yomphakathi alingeni ithuluzi.
Ikheli elitholwa iklayenti ngaphakathi kwethuluzi liwukuqashwa kwangasese okuvela echibini le-point-to-site. Likhomba iklayenti emithonjeni ese-VNet; akulona ikheli umhlaba wonke ongalibona, futhi ngeke livele njengomthombo wesicelo sokuphuma esiya ku-API ye-SaaS. Ukufakwa kuhlu lwemvume elakhiwe ngokuqashwa lokho ngeke kusebenze, noma ungulinda isikhathi esingakanani ukuthi kuvele kumarekhodi omsabalalisi.
Ithuluzi elihlukanisiwe nokuhamba komhubhe okuphoqelekile eduze
| Split tunnel, the default | Forced tunneling | |
|---|---|---|
| Internet traffic exits through | local ISP or office router | firewall or appliance inside Azure |
| Source address the API sees | your home or office IP | the firewall public IP |
| Inspection and logging in Azure | none | policy rules plus flow logs |
| Ongoing cost | gateway only | gateway, firewall hours, data processing |
| What usually breaks | nothing on the egress path | DNS, on-premises routes, overlapping local ranges |
Umugqa wesibili kuphela oshintsha ikheli elibonwa isevisi ekude. Konke okunye kulelo thebula kuyizindleko nendawo yokusebenza oyemukelayo lapho umkhondo wokuphuma kufanele uhlolwe noma uhunyushwe ngaphakathi kwe-Azure. Uma othile ekucela ukuthi i-IP yomphakathi ishintshe, ucela ikholomu yonke yesokudla, hhayi ukulungiswa okuncane kuklayenti.
Kunesinqumo esiphakathi okufanele sishiwo ngaphambi kokuthi wakhe kabusha noma yini. I-VM ye-proxy noma ye-gateway ngaphakathi kwe-VNet ikunikeza ikheli lomthombo elilawulwayo lezinhlelo zokusebenza ezingabhekiswa kulo, ngaphandle kokuhambisa umzila ozenzakalelayo weklayenti. Lokho kugcina ukuphequlula okuvamile kusendaweni futhi kusazanelisa uzakwethu odinga ukuthi ucingo olulodwa lwe-API lufike luvela ku-Azure. Yehluleka lapho isidingo sikhuluma ngayo yonke ithrafikhi ngempela, ngoba noma yini enganaki isethingi ye-proxy isaphuma endaweni.
Yenza ithuluzi lithwale umzila ozenzakalelayo
Ku-gateway yenethiwekhi ebonakalayo, indlela esekelwayo yokuqondisa yonke ithrafikhi ye-inthanethi yeklayenti ethuluzini ukwengeza imizila yangokwezifiso ekucushweni kwe-point-to-site. Izingxenye ezimbili zihlanganisa sonke isikhala se-IPv4, futhi ngayinye icace kakhulu kunomzila ozenzakalelayo wasekhaya, ngakho iklayenti iyazikhetha ngaphandle kokususa lutho:
Set-AzVirtualNetworkGateway -VirtualNetworkGateway GWOBJ -CustomRoute 0.0.0.0/1,128.0.0.0/1Lowo mugqa uyisibonelo, awuphelele ukukopishwa: qala uthole into ye-gateway nge-Get-AzVirtualNetworkGateway bese ufaka yona esikhundleni se-GWOBJ, futhi ngaphambi kokuyisebenzisa qinisekisa ukuthi i-SKU nemodeli yokusabalalisa zamukela imizila yangokwezifiso. Lezo ziqalo ziyavela kuphothali ekhasini lokucushwa kwe-point-to-site, okuyindawo ephephile yokuzisetha uma ungakakwenzi ukubhala kwe-gateway.
Ukushintsha lezo ziqalo kwenza iphakethe leklayenti lingavumeleki. Landa kabusha iphakethe leklayenti le-VPN bese ulifaka kabusha, ngoba imizila ihamba ngaphakathi kwephrofayela. Iklayenti elixhuma kabusha ngephrofayela yayo endala ligcina isethi yemizila endala, futhi ungalahlekelwa ihora ekulungiseni ingxaki yoshintsho olungakaze lufinyelele kulo.
Ku-hub ye-WAN ebonakalayo evikelwe, okulingana nakho umzila ozenzakalelayo kuthebula lemizila le-hub elixhunywe ku-gateway ye-point-to-site, kanti ithrafikhi ithathwa i-Azure Firewall esekuhubeni. I-firewall ihumusha ukuxhumana okuya kwi-inthanethi kumakheli ayo e-IP omphakathi, futhi ikheli elisha lokuphuma livela kulokho kuhumusha. Uma i-firewall inama-IP amaningi omphakathi, noma yiliphi lawo lingavela njengomthombo, ngakho uhlu lwemvume kufanele lube nayo yonke.
Zombili izakhiwo ezingenhla ziyi-IPv4. Iziqalo ezimbili ze-/1 azenzi lutho nge-IPv6, futhi ukwesekwa kwe-IPv6 kwe-point-to-site kuncane kakhulu ukuthi kufanele uhlole inhlanganisela ngaphambi kokuthembisa ukulingana.
Hlola umzila, bese uhlola umkhondo wokuphuma
Ngemva kokufaka kabusha iphakethe nokuxhuma kabusha, qinisekisa ukuthi iklayenti lafake ngempela izingxenye ezimbili. Ku-Windows, i-Get-NetRoute -DestinationPrefix 0.0.0.0/1 kanye nombuzo ofanayo we-128.0.0.0/1 kufanele isho isixhumi sethuluzi, futhi i-route print ikhombisa zombili eduze komzila wakho wokuqala ozenzakalelayo. Ku-Linux, i-ip route show kufanele ibale lezo ziqalo ezimbili; uma ingakwenzi, iphrofayela ayizange izithwale.
Bese uhlola futhi ikheli lomphakathi kusukela kuklayenti bese ufunda irekhodi le-firewall lalowo xhumano. Umthombo kufanele kube yi-IP yomphakathi ye-firewall enembobo ehumushiwe. Iklayenti elisaphuma endaweni ngenkathi imizila yomibili ikhona lisho ukuthi amaphakethe afinyelela ku-Azure futhi aphuma ngomunye umzila: umzila ochazwe umsebenzisi kusubneti ye-gateway, i-firewall ngokwayo ephoqelelwe ethuluzini eya kunethiwekhi yasekhaya, noma inqubomgomo elahla ukugeleza ngaphambi kokuhumusha.
Hlola futhi indawo eyodwa yangasese ngesikhathi esifanayo. Umkhathi wokugxuma oyeka ukuphendula ngemva koshintsho wuphawu olujwayelekile lokuthi iziqalo ezintsha zisuse okuthile, kungaba umzila wasekhaya omncane owawumenyezelwe ngaphambili noma ukuxazululwa kwamagama osekuya kusixazululi esingenaso isidlulisimva sezindawo zakho zangasese.
Nini okufanele ushiye ithuluzi elihlukanisiwe
Uma umgomo kuwukufinyelela kuphela i-API yangasese, i-endpoint yangasese noma ikhasi lokuphatha langaphakathi, ukuziphatha okuzenzakalelayo kushibhile futhi kuthule kakhulu. Ukuhamba komhubhe okuphoqelekile kunezela amahora e-firewall nezindleko zokucubungula idatha, umzila omude, kanye nenye indawo lapho konke ukugeleza kweklayenti kungahluleka khona. Kubamba futhi ithrafikhi eningi kakhulu kunendawo eyodwa obukhathazeke ngayo.
Kusebenzisa lapho isidingo sisho ngokomkhondo wokuphuma: uzakwethu kufanele abone ikheli le-Azure elingaguquki, ezokuphepha zifuna ukuxhumana kurekhodwe futhi kuhlolwe, noma idatha kufanele iphume endaweni eyodwa elawulwayo. Ngisho nalapho, idizayini inikeza wonke umsebenzisi umkhondo wokuphuma okwabiwe, ngakho ukuziphendulela komsebenzisi ngamunye kufanele kuvele kubunikazi obusohlelweni hhayi ekhelini lomthombo.
Ngaphambi kokuvala ushintsho, qinisekisa izinto ezine: iphakethe leklayenti elifakiwe lisha, imizila emibili ye-/1 isekuxhumweni kwethuluzi, indawo yangasese isaphendula, futhi irekhodi lesevisi ekude likhombisa ikheli le-firewall.