ãªã¢ã¼ãã¯ã¼ã¯ç¤¾å¡80人åã®VPNç°å¢ãä½ã³ã¹ããã¤ã¹ã±ã¼ã©ãã«ã«æä¾ããæ¹æ³
ããã«ã¡ã¯ãFinatextã§ã¨ã³ã¸ãã¢ããã¦ãã @s_tajima ã§ãã
æ°åã³ããã¦ã¤ã«ã¹ææçã®å½±é¿ã«ãããè¿å¹´å¾ã ã«åºã¾ãã¤ã¤ãã£ããªã¢ã¼ãã¯ã¼ã¯ããã¬ã¯ã¼ã¯ã¨ãã£ãåãæ¹ããã®è¨åã«å¯¾ããä¼æ¥ã®æ¸©åº¦æããããã£ãããããããããç¡ãã¨ã ããã«æ¥éã«å¤ããã¤ã¤ããã®ãæãã¾ãã
å¼ç¤¾ãå
æ¥ã®ç·æ¥äºæ
宣è¨ãåãã å
¨ç¤¾çã«ååå¨å®
å¤åã¨ããä½å¶ ã«ç§»è¡ãã¾ããã
ããã§ä»åã¯ãFinatextã®ãªã¢ã¼ãã¯ã¼ã¯ï¼å¨å®
å¤åï¼ãæ¯ããVPNã®ã·ã¹ãã ã«ã¤ãã¦ãç´¹ä»ãããã¨æãã¾ãã
Finatextã®VPNã·ã¹ãã ã¯ä»¥ä¸ã®ããã«éç¨ãã¦ãã¾ãã
- æã«2ä¸åç¨åº¦ã®ã³ã¹ã
- Pritunlã¨ãããªã¼ãã³ã½ã¼ã¹ã®ã½ããã¦ã§ã¢ã使ç¨
- AWSä¸ã«ã¹ã±ã¼ã©ãã«ãªå½¢ã§æ§ç¯
- ã¨ã³ã¸ãã¢ã»éã¨ã³ã¸ãã¢å«ãã¦80人ã»ã©ã®ç¤¾å¡ãå©ç¨
ä»ä½¿ã£ã¦ããVPNã«ä½ãããã®ä¸æºãããæ¹ãçªç¶VPNã®ç°å¢ãå¿ è¦ã«ãªãã©ã®ããã«æ§ç¯ããããããããããªãã£ãããã³ã¹ãã®é¢ã§å°ã£ã¦ããæ¹ãªã©ã®åèã«ãªãã°ããããã§ãã
â»ãªããVPNã¨ä¸å£ã«è¨ã£ã¦ãæ§ã ãªç¨®é¡ãããã¾ãããæ¬è¨äºã§ã¯ã社å¡ãã¤ã³ã¿ã¼ãããåç·è¶ãã«å®å ¨ã«ä¼ç¤¾ã®æ å ±è³ç£ã«ã¢ã¯ã»ã¹ã§ããç°å¢ãæä¾ããããã®ä»çµã¿ããããããã¯ã©ã¤ã¢ã³ãVPNã«ã¤ãã¦æ±ãã¾ãã
ãªãVPNãå¿ è¦ã
ã·ã¹ãã ã®ç´¹ä»ãããåã«ãã¾ããªãVPNãå¿
è¦ã«ãªãã®ãã¨ããã®ãæ´çãã¦ããã¾ãã
ä¸è¬çã«æãããã主ãªçç±ã¨ãã¦ã¯
- ãã©ã¤ãã¼ããªãããã¯ã¼ã¯ã«ã¢ã¯ã»ã¹ãããã (ã¤ã³ã¿ã¼ãããã«å ¬éããã¦ããªãããªãã£ã¹ããã¼ã¿ã»ã³ã¿ã¼ã®ä¸ã«æ§ç¯ãããã·ã¹ãã ã¸ã®ã¢ã¯ã»ã¹ã®ãã)
- åºå®ãããã°ãã¼ãã«IPã¢ãã¬ã¹ãå©ç¨ãããã (ã¤ã³ã¿ã¼ãããã«ã¯å ¬éããã¦ããããæ¥ç¶å ã®IPã¢ãã¬ã¹ãå¶éããã¯ã©ã¦ããSaaSã¸ã®æ¥ç¶ã®ãã)
- ãããã³ã«ã«ãããããéä¿¡ã®çµè·¯ãæå·åãããã(ç¹ã«ã管çè ãå®å ¨ã«ä¿¡é ¼ã§ããªããããã¯ã¼ã¯ã使ããªããã°ãããªãæã«å¿ è¦ã«ãªãã¾ã)
ã¨ããã®ãããããªã¨æãã¾ãã
Finatextã¯ããªãã£ã¹ã®ãããã¯ã¼ã¯ããã¼ã¿ã»ã³ã¿ã¼çã®ãªã³ãã¬ãã¹ä¸ã®æ
å ±è³ç£ãã»ã¨ãã©æããã大åã®æ¥åãã¯ã©ã¦ããSaaSãã¼ã¹ã®ã·ã¹ãã ã§å®è¡ã§ããããã«ãªã£ã¦ãã¾ãã
ãã®ãããåè¿°ã®çç±ã®ãã¡ã2ã®åºå®ã®ã°ãã¼ãã«IP 㨠3ã®æå·åãã§ããã°å¤§åã®è¦ä»¶ãæºããããã¨ã«ãªãã¾ãã
è¿å¹´ã ã¨ãã¼ããã©ã¹ã / BeyondCorp ã¨ãã£ãèãæ¹ã§VPNãä¸è¦ã¨ããã·ã¹ãã æ§æãåãäºä¾ãå¢ãã¦ãã¦ããã¨æãã¾ããããããæ軽ã«å¤ãã®ã¦ã¼ã¹ã±ã¼ã¹ãã·ã¹ãã ã«å¯¾å¿ãããããã¯ã¼ã¯ã¬ãã«ã§æ»æ表é¢ã®ç¸®å°ãã§ããæ段ã¨ãã¦ãVPNã¯ä¾ç¶ã¨ãã¦æç¨ãªæ段ã ã¨èãã¦ãã¾ãã
ã©ã®ããã«æ§ç¯ãã¦ããã
æåã«è¨è¼ããã¨ãããå¼ç¤¾ã§ã¯VPNã Pritunlã使ãAWSä¸ã«æ§ç¯ãã¦ãã¾ãã
æ§æå³ã¨ãã¦ã¯ãããªããã¡ã§ãã
以éãPritunlã¨AWSã«åãã¦åãã¤ã³ãã説æãã¾ãã
Pritunl
- Pritunlã¯ãOpenVPNããã¼ã¹ã«ãããªã¼ãã³ã½ã¼ã¹ã®VPNã½ããã¦ã§ã¢ã§ãã
- ç¡åã»æåã©ã®ãã©ã³ã§ä½¿ã£ã¦ããã¢ã«ã¦ã³ãã®æ°ã«æ¯ä¾ããã³ã¹ãã¯ãããã¾ããã
- ãµã¼ãã¼ã¯æ§ã ãªLinux Distributionã«å¯¾å¿ãã¦ãããã»ããã¢ããã容æã§ãã
- ã¯ã©ã¤ã¢ã³ãã¯Windowsã¨Macã«å¯¾å¿ãã¦ãã¦ããã¡ããã»ããã¢ããã容æã§ãããã®ä»ã®OSã¯ãå°ç¨ã®ã¯ã©ã¤ã¢ã³ãã¯ãªãã®ã§ãããOpenVPNã®ã¯ã©ã¤ã¢ã³ããããã°æ¥ç¶ãããã¨ã¯ã§ãã¾ãã
- VPNèªä½ã®æ©è½ã¯ãOpenVPNãå©ç¨ãã¦ãããããå®å®æ§ãå®å ¨æ§ã®è¦³ç¹ã§ã®å¿é ã¯å°ãªãã§ãã
- TOTPã«ãã2FAã使ã£ãèªè¨¼ã容æã«æ§ç¯ã§ãã¾ãã
- æè¿ã®ã¢ãããã¼ãã§WireGuardã«ã対å¿ããããã§ã (æªæ¤è¨¼)
AWS
- åè¿°ã®éããå¼ç¤¾ã®ç°å¢ã§ã¯ãªãã£ã¹ããã¼ã¿ã»ã³ã¿ã¼ã«VPNã®ã·ã¹ãã ãæ§ç¯ããå¿ è¦ãããã¾ããããã£ã¦AWSä¸ã«VPNãæ§ç¯ãã¦ãã¾ãã
- Pritunlã®VPNã¯ãPritunl Serverã¨MongoDBããæ§æããã¾ãããããããåé¢ãã¦ãã¾ãã
- Pritunl Server(ã¨OpenVPN Server)ãèµ·åããå¤é¨ããã®ãã±ãããç´æ¥åãä»ããã¤ã³ã¹ã¿ã³ã¹ã¯ãªã¼ãã¹ã±ã¼ã«ãè¨å®ããåé·æ§ãæããã¦ãã£ã¹ãã¼ã¶ãã«ã«ãã¦ããã¾ãã
- Pritunl Serverããã®ã¢ã¦ããã¦ã³ãã®éä¿¡ã¯ãElastic IPãã¤ããNatGatewayãçµç±ããããã¨ã§IPã¢ãã¬ã¹ãåºå®ãããããã«ãã¦ãã¾ãã
éç¨ãã¦ã¿ã¦
è¯ãã£ãã¨ãã
- ãªã¼ãã³ã½ã¼ã¹ã®ã½ããã¦ã§ã¢ãå©ç¨ãã¦ãããããVPNç¨ã®ã¢ãã©ã¤ã¢ã³ã¹ãåææ¥ç¶æ°ãã¨ã®ã©ã¤ã»ã³ã¹è²»ç¨ãå¿ è¦ã¨ããæ§æã«æ¯ã¹ãã¨ãé常ã«ä½ã³ã¹ãã§éç¨ã§ãã¦ãã¾ããæã ã®ã³ã¹ãã¯2ä¸åç¨åº¦ã§ããã¾ããæ§ç¯ã®æéãããã¾ã§ããã£ã¦ããªãã®ã§ã人件費ãèæ ®ãã¦ãä½ã³ã¹ãã¨è¨ããã¨æãã¾ãã
- AWSä¸ã«æ§ç¯ãã¦ããããããã£ãã·ãã£çã«ãã°ããããªããªã£ãå ´åã¯å®¹æã«ã¹ã±ã¼ã«ã¢ããã§ããã¨ããå®å¿æãããã¾ãã
- ãã¨ãã¨ãã®VPNã¯ä¸é¨ã®ã¨ã³ã¸ãã¢ã ãã使ã£ã¦ããã®ã§ãããæ°åã³ããã¦ã¤ã«ã¹é¢é£ã§å¨å® å¤åè ãå¢ãããã¨ã«ãããéã¨ã³ã¸ãã¢ãå«ã40ï½50人åã®ã¢ã«ã¦ã³ããä¸æ°ã«è¿½å ãããã¨ã«ãªãã¾ããããã®éãã¯ã©ã¤ã¢ã³ãå´ã®ã»ããã¢ããã®æéãå°ãªãããµãã¼ãã®ã³ã¹ãããã¾ãããããªãã£ãã®ãè¯ãã£ããã¤ã³ãã§ãã
- æ§ç¯åã¯ãã¬ã¤ãã³ã·çã«ä½¿ãç©ã«ãªããªãã£ãããAWSã®ãããã¯ã¼ã¯ããã®ã¢ã¯ã»ã¹ãå¼¾ãã¦ãã¾ãWebãµã¤ãçãããã®ã§ã¯ãªããã¨æ¸å¿µã§ã¯ããã¾ããããå®éã¯ããã¾ã§åé¡ã«ãªããã¨ã¯ããã¾ããã§ããã
課é¡ã«æã£ã¦ããã¨ãã
- ãã¼ã¿ã¹ãã¢ã¨ãã¦å©ç¨ãã¦ããMongoDBç¨ã®ãµã¼ãã¼ããã£ã¹ãã¼ã¶ãã«ã«ãªã£ã¦ããªãç¹ã§ãããããAmazon DocumentDBã«ç§»è¡ã§ããªãããæ¤è¨¼ãããã¨æã£ã¦ãã¾ãã
- Pritunlã®ç®¡çç»é¢ã§è¨å®å¤æ´ããããã¨ããæã«ãã°ã®ãããªæåãããã管çç»é¢ãä¸æçã«å©ç¨ã§ããªããªãäºè±¡ãããã¾ããããå°ããªåé¡ãªã®ã§è©³ãã調æ»ã¯ãã¦ãã¾ããã
ãããã«
ä»åã¯ãFinatextã®ãªã¢ã¼ãã¯ã¼ã¯ãæ¯ããä½ã³ã¹ãã§ã¹ã±ã¼ã©ãã«ãªVPNç°å¢ã®ã話ã§ããã
éèé¢é£ä¼æ¥ã¨ããã¨ããªã¢ã¼ãã¯ã¼ã¯ãå¨å® å¤åãªãã¦ã§ããªãã ãããã¨æãããããããã¾ããããå¼ç¤¾ã§ã¯ãã®ããã«ã¨ã³ã¸ãã¢ãå ´æã«ã¨ããããæè»ã«åãããããªç°å¢ãæ´ãã¦ãã¾ãï¼
Finatextã°ã«ã¼ãã§ã¯ãä¸ç·ã«åãã¨ã³ã¸ãã¢ãåéãã¦ãã¾ãã
ã¾ã£ããæ°ããéèãã¸ãã¹ãã©ãããã©ã¼ã ãåµé ãããã¨ã«èå³ãããæ¹ããã²ãé£çµ¡ãã ããï¼
æ±äººä¸è¦§ã¯ãã¡ã
社å¡ã¤ã³ã¿ãã¥ã¼ã¯ãã¡ã