Kungani i-EC2 ingenakufinyelela ilaptop yakho ye-AWS Client VPN
I-Client VPN ihumusha imithombo ye-IPv4 yeklayenti ku-interface yenodi yokugcina. Yingakho impendulo isebenza kanti ukuxhumana okusha okuvela ku-EC2 akusebenzi.
Ilaptop exhunywe nge-AWS Client VPN ifinyelela uhlelo lokusebenza ku-EC2 ngaphandle kwenkinga. Bese uzama okuphambene, kusuka ku-EC2 kuye ekhelini elinikezwe iklayenti, futhi ukuxhumana kuyalenga noma kunqatshwe. Lokho kungalingani akuvamisile ukuba umthetho weqembu lokuphepha ongekho. Kunodi yokugcina ye-Client VPN ehlobene namasubneti e-VPC, i-AWS ihumusha imithombo ye-IPv4 yeklayenti ku-interface yenethiwekhi yenodi yokugcina, ngakho akukho khelo le-VPC elingenayo elimele ilaptop yakho.
Qala ngalokho okukhonjiswa ukubamba
Bamba iphakethe kusibungu se-EC2 ngenkathi iklayenti ixhuma, bese ufunda ikheli lomthombo uhlelo olubona ngempela. Uma kuyi-interface yenodi yokugcina ohlangothini lwe-VPC hhayi ikheli elivela echibini lamaklayenti, ukuhumusha sekuqinisekisiwe ngaphambi kokuba ushintshe ngisho umthetho owodwa.
Ichibi lamaklayenti iyibanga lokwabiwa, hhayi isubneti enomzila wokubuyela. Yilo mehluko lapho iningi lalolu phenyo luye lwephuke khona.
Ukuhumusha okuchaza ukungalingani
Imigudu emithathu iyadidaniswa, futhi muntingi muni kuphela umgudu abantu abawuhlolayo.
| Flow | Started by | What the VPC sees | Outcome |
|---|---|---|---|
| Client to EC2 service | The client | A translated source at the endpoint interface | Works, with a stateful reply |
| EC2 host to client pool address | The EC2 host | A destination with no route and no translation state | No usable path |
| Client to client | A client, when the feature is configured | Traffic mediated by the endpoint | Works only with that feature and its authorisation |
Incazelo yezingxenye ze-Client VPN isho ngokucacile ukuthi imithombo ye-IPv4 yeklayenti ihunyushwa ku-interface yenodi yokugcina, futhi lokho kwanele ukubona ukuthi kungani umugqa ophakathi ungenakho okungafaniswa nakho.
Ukuxhumana okusha kudinga umzila, isinyathelo sokuxazulula ikheli nesinqumo sokugunyaza. Isimo sokuhumusha esivela kuseshini yomunye umuntu asikunikeli nanye kulezi zintathu.
Kungani impendulo kungekona ukuxhumana okusha
Impendulo ye-TCP ifaniswa nokufakiwe okukhona, yingakho indlela yokubuyela isebenza ngaphandle komthetho wokungena. I-SYN entsha evela kusibungu se-EC2 ayinakho okufakiwe engakufanisa nakho, ngakho iba umzamo ojwayelekile wokuphuma obheke endaweni i-VPC engakwazi ukufinyelela kuyo.
Yingakho futhi ukuchaza lokhu njengethrafikhi ehamba ngendlela eyodwa kuphela kuduka. Ithrafikhi yokubuyela igobhoza ngokuqhubekayo kulezi zeshini. Ingxenye engenawo umzila ukuqala.
Yini isahlikiza iseshini okufanele isebenze
Amaqembu okuphepha, ama-ACL enethiwekhi kanye ne-firewall yelaptop ngokwayo konke kubalulekile ekuxhumaneni okufanele kuphumelele. I-ping ehlulekile isho okuncane kakhulu, ngoba inqubomgomo ye-ICMP ivamise ukwehlukana nenqubomgomo ye-TCP onenkinga ngayo.
Bhala leyo mikhawulo ngokuhambisana nomthombo ohunyushiwe, hhayi ikheli leklayenti. Imithetho eboshelwe ekhelini elingakaze livele kunethiwekhi iyiphutha elivame kakhulu elizibangelayo kulolu hlelo.
Lapho i-VPC kumele ngempela iqale ingxoxo
Uma insizakalo kufanele yazise isiteshi somsebenzi, guqula isiqondiso futhi uvumele iklayenti ukuthi libambe isiteshi sokuphuma esihlala njalo insizakalo ephendula kuso. Uma yonke inethiwekhi ekude kufanele ifinyeleleke isuka ku-VPC, khetha isakhiwo esishicilela izimvume zaso kanye nenqubomgomo yokufinyelela esikhundleni sokucabanga ukuthi i-Client VPN isivele ikwenza lokho. Ukufinyelela kweklayenti kuya kwelinye iklayenti yicala lesithathu, elincane kakhulu, elinezinto zaso zomzila nokugunyaza. Akukho kulokhu okuyisikhonkwane sokuhlola kunodi yokugcina ekhona.
Gcina futhi ububanzi bencazelo ye-IPv4 buqotho. Imibhalo yamanje ye-AWS ihlukanisa i-IPv6, lapho lokho kuhumusha kungasetshenziswa khona, kanye namanye amamodeli okuxhumana ahambisa ngendlela ehlukile.
Hlola ngezinyathelo ezintathu ezinamalebula: iklayenti livula iseshini evunyelwe, insizakalo ye-VPC iphendula leyo seshini, futhi isibungu se-VPC sivula iseshini entsha sibheke eklayentini. Ukuthi ezimbili zokuqala ziphumelele kanti eyesithathu yehluleka yilokho okulindelekile kwalolu hlelo, hhayi iphutha okufanele lixoshwe ngemithetho ye-firewall.