Kungani i-GRE ne-ESP yehluleka nge-AWS NAT gateway

I-tunnel iyehluleka, iqembu lokuvikeleka selivele livumela yonke i-traffic, futhi isiphetho siwukuthi i-AWS ivimba i-VPN. Akubhangi lutho. I-NAT gateway ephethwe idlulisa isethi ebhaliwe yama-protocol angaphandle, futhi i-GRE yomdabu noma i-ESP yomdabu ayikho kuyo, ngakho awukho umthetho ongawengezayo ozokwenza i-gateway izithwale. Umthetho wemvume nekhono lokuthutha kuyizinto ezimbili ezihlukene, futhi kweyodwa yazo ongayishintsha.

Isethi yemithetho ayiyona isethi yama-protocol

Iqembu lokuvikeleka linquma ukuthi iyiphi i-traffic evunyelwe ukuphuma ku-instance. I-NAT gateway inquma ukuthi ingakwazi ukuhumusha nokudlulisela ini. Lapho kusebenza umkhawulo wesibili, umthetho ovumelayo ukhiqiza kanye uphawu abantu abalufunda ngokungalungile njengenkinga ye-firewall: amaphakethe aphuma ku-instance, ukushintshana kokulawula kungase kuqede ngisho, futhi akukho okufika kumlingani.

I-AWS isicaciso sama-protocol e-NAT gateway sibala i-TCP, i-UDP ne-ICMP kusevisi ephethwe. Yiso sonke isethi esekelwayo. Umthetho wemvume womunye umthetho we-IP awukwazi ukuwukhulisa, ngoba umthetho uhlolwa kudala ngaphambi kokuthi kufinyelelwe indlela yokudlulisela ye-gateway.

Lo mehluko ubalulekile ngoba ukwehluleka kokubili kubonakala kufana kusuka kuklayenti futhi kunezixazululo ezihluke ngokuphelele.

I-PPTP ibonisa ukuthi kungani ukuhlola kwephothi kuqamba amanga

I-PPTP iyisibonelo sakudala esicacile kakhulu sokuhlola kwephothi okungafakazi lutho. Ivula ukuxhumana kokulawula kwe-TCP kuphothi 1723 bese ithwala idatha ye-tunnel nge-GRE, okuyi-protocol ye-IP 47. I-protocol 47 akulona iphothi le-TCP 47, futhi lezi zinombolo ezimbili azihlobene ngalutho ngaphandle kokwabelana ngamadijithi.

Umsebenzi ohlola ukuxhumana ku-1723 futhi abone ukuxhawulana okuqediwe uphetha ngokuthi indlela iyasebenza. Bese kuthi isiteshi sedatha singadluli nephakethe elilodwa, ngoba i-gateway ayinakho ukusekelwa kwe-GRE engakunikeza. Lokhu kuwukuhumusha kwezidingo ze-protocol endala, hhayi iseluleko sokuthumela i-PPTP, esiphelelwe yisikhathi iminyaka.

Ukucabanga okufanayo kusebenza kunoma iyiphi i-protocol okungukuthi isiteshi sayo sokulawula si-TCP noma i-UDP kuyilapho indlela yayo yedatha ingeyona.

IPsec isinda kuphela njenge-UDP

I-IPsec yisimo lapho impendulo inemibandela hhayi cha eliqondile. I-AWS ibhala ukudlula kwe-NAT njengokuhleleka okusekelwayo kwe-IPsec nge-NAT gateway. Lapho i-NAT-T kuxoxiwe, i-ESP ifakwa ngaphakathi kwe-UDP futhi i-gateway ibona i-UDP evamile esikhundleni se-protocol 50.

Ukuvumela i-UDP 4500 akukwenzi amaphoyinti okugcina asebenzise ukudlula kwe-NAT. Ivumela amaphakethe kuphela uma esekulolo hlobo. Qinisekisa kusuka kokukhishwayo kwengxoxo yeklayenti uqobo ukuthi yikuphi ukufakwa okukhethiwe, futhi uqinisekise ohlangothini olwamukelayo ukuthi umlingani ukwamukele. Amaphoyinti amabili okugcina alungiselelwe i-ESP yomdabu azoqhubeka nokuthumela i-ESP yomdabu, noma ngabe isethi yemithetho ithini.

I-VPN esekelwe ku-TCP noma i-UDP iyafanelana nesethi yokuthutha ebhaliwe futhi ingase yehluleke ngenxa yomzila, ukuhlunga noma ukuqinisekisa. Ukufanelana nesethi kuyadingeka, akwanele.

Hlola indlela ngaphambi kokwandisa inqubomgomo

Qinisekisa umzila wangempela we-subnet yomthwalo womsebenzi kanye nobuwena begxathu elilandelayo kuqala. Umzila womphakathi oqondile, i-NAT instance, i-NAT gateway ephethwe kanye nomzila wangasese odlula kwi-transit gateway kuyimiklamo emine ehlukene, futhi eyodwa kuphela yayo iyisevisi ephethwe echazwe lapha.

Bese urekhoda iphoyinti lokugcina elizanyiwe, umndeni wamakheli, i-protocol yangaphandle nephothi lapho i-protocol inalo. Sebenzisa ukuxilongwa kweklayenti nokubonwa kokugeleza komnikazi wenethiwekhi esikhundleni sesicelo sebhrawuza esiphumelelayo, esifakazela kuphela ukuthi i-TCP ne-UDP ziyasebenza. Ngemuva kwalokho, buyekeza iqembu lokuvikeleka, i-ACL ye-subnet, i-firewall yesivakashi kanye nenqubomgomo yesevisi kuzo zombili izinhlangothi zokugeleza.

Ungavuli yonke i-traffic ukuze unxephezele ukuthutha i-sevisi engakwazi ukukuthwala. Ukushintsha komthetho ngeke kukulungise, futhi kuzophila ngemuva kwesigameko.

Lapho ukuthutha kungafanelani

Uma i-protocol yangaphandle ingaphandle kwesethi esekelwayo, ukulungisa kungokwakhiwo: khetha ukuthutha indlela engakukwazi ukukuthwala, noma hambisa ukuphuma endaweni ethwala lokho okudingayo. OpenVPN phezu kwe-UDP, i-WireGuard phezu kwe-UDP namathaneli asekelwe ku-TLS wonke ayafanelana nesethi ebhaliwe. I-NAT instance ephethwe yiklayenti iyinketho lapho i-protocol ethile kufanele idlule futhi izindleko zokusebenza zokuyiphatha ziyamukeleka.

Ukusingatha iseva ye-VPN engenayo kuyinkinga ehlukile enempendulo ehlukile. I-NAT gateway inikeza ukuhumusha okuphumayo futhi ayinikezi ukudluliselwa kwamaphothi angenayo okuvamile, ngakho iseva engemuva kwayo idinga ukungena kwayo komphakathi okugunyaziwe okuklanywe ngemibandela yayo.

Ukulandelana komsebenzi: shono i-protocol yangaphandle, qinisekisa igxathu elilandelayo, qhathanisa nesethi ebhaliwe, bese ushintsha ukwakhiwa noma ukuthutha. Inombolo yephothi ehlukile ayikwazi ukuguqula i-GRE ibe yi-TCP, futhi umthetho owengeziwe ovumelayo awukwazi ukuguqula ukushintshana kokulawula okuqediwe kube isiteshi sedatha esisebenzayo.