Lecture 139: DX Security - Public IP VPN over DX connection (Layer 3)
- 课程：[NEW] AWS Certified Advanced Networking Specialty 2026
- 视频时长：07:10
- 来源：Udemy Lecture 56353835
- Slide 数量：21
- 画面切换：00:36、00:41、00:59、01:21、01:40、02:01、02:22、02:50、03:01、03:20、03:29、03:50、04:11、04:23、04:41、05:23、05:30、05:46、06:05、06:40
扫描说明
逐条检查了 Udemy 页面中的 98 条 Transcript cue，并扫描了全长约 7:10 的视频。依据 Site-to-Site VPN 基础、VPN 外部/内部地址、Public VIF 与 Transit VIF 两种方案、VGW/TGW 架构逐步绘制及 Public IP VPN 挑战逐条渐显，共划分为 21 个小节。正式截图逐张按完整媒体边界抓取；质检发现一张处于淡化转场而出现重影后，改用稳定帧重截。最终 21 张截图均无黑边、无顶部课程栏、无底部或中心播放器控件，也无右侧或下方裁切，并统一输出为 1364×770。
Transcript 来自 Udemy 页面自带的英文自动字幕，没有使用 ASR。下面保留页面原文，包括其中的语法或识别错误。
1. 在 DX 上使用 Site-to-Site VPN 做三层加密
时间范围：00:00–00:36
总结 / Summary
中文
当应用层 TLS/HTTPS 不可用时，可在 Direct Connect（DX）路径上建立站点到站点 VPN（Site-to-Site VPN），通过 IPsec 提供 OSI 第三层加密。
English
When application-layer TLS/HTTPS is unavailable, a Site-to-Site VPN can run over the Direct Connect path and provide IPsec encryption at OSI Layer 3.
Transcript
00:00 Alright, so as you know, we can always apply layer 7 encryption and that's all the application
00:06 layer encryption.
00:07 So, there is no point in discussing that because it's a general encryption.
00:11 If you know HTTPS, if you know TLS, you know that encryption.
00:16 So here, let's talk about other layer encryption, that is layer 3 and layer 2.
00:21 And here we are going to start with layer 3 encryption.
00:25 Now before direct connect, you already learned about AWS side to side VPN, which is basically
00:30 a layer 3 IPSec encryption.
00:30 And you know how the VPN connection works.
2. AWS Site-to-Site VPN 的终止点
时间范围：00:36–00:41
总结 / Summary
中文
AWS Site-to-Site VPN 在客户网关（Customer Gateway）与 AWS 侧的虚拟私有网关（Virtual Private Gateway，VGW）或中转网关（Transit Gateway，TGW）之间建立。
English
AWS Site-to-Site VPN is established between a customer gateway and either a Virtual Private Gateway or Transit Gateway on the AWS side.
Transcript
00:36 So on the AWS side, typically you have some VPN router, for example, VPN gateway or the
3. 每条 VPN 连接包含两个 IPsec 隧道
时间范围：00:41–00:59
总结 / Summary
中文
每条 AWS Site-to-Site VPN 连接包含两个 IPsec 隧道（IPsec Tunnels），以便在单一隧道故障或维护时保持高可用（High Availability）。
English
Each AWS Site-to-Site VPN connection includes two IPsec tunnels so connectivity can remain available during a tunnel failure or maintenance event.
Transcript
00:41 transit gateway.
00:42 And on the customer side, there is a customer router.
00:42 And then you set up two tunnels for high availability, which basically transmit your encrypted traffic.
00:52 So if you want to now use the same site to site VPN, but over the direct connect connection,
4. 把 VPN 隧道承载在 Direct Connect 上
时间范围：00:59–01:21
总结 / Summary
中文
要让 VPN 流量使用 Direct Connect（DX）而不是互联网，隧道外部端点的可达性必须通过适当的虚拟接口（Virtual Interface，VIF）提供。
English
To carry VPN traffic over Direct Connect rather than the internet, reachability to the tunnel outside endpoints must be provided through the appropriate virtual interface.
Transcript
00:59 then how will you do that?
01:00 So for this, there are a couple of options.
01:04 Now if you remember, for AWS managed site to site VPN, we used to have the public IPs
01:09 on the AWS side, and also the public IP for the customer gateway on the customer side.
01:15 And whether you create a VPN gateway or a transit gateway, AWS provides those two public
5. VPN 外部地址与内部地址
时间范围：01:21–01:40
总结 / Summary
中文
每条 VPN 隧道具有公网外部 IP（Outside IP）作为端点，并在加密隧道内部使用隧道内地址（Inside IP）；外部地址决定底层传输路径。
English
Each VPN tunnel has public outside IPs for its endpoints and inside tunnel IPs within the encrypted connection; the outside addresses determine the underlying transport path.
Transcript
01:21 IPs for two VPN tunnels.
01:21 So one way to do that is to have this VPN gateway or a transit gateway on AWS site.
01:30 And then on the customer side also you have the public IPs, but the traffic now doesn't
01:35 go over the internet, but rather traffic flows through the direct connect connection.
6. Public VIF 提供公网端点可达性
时间范围：01:40–02:01
总结 / Summary
中文
由于标准 VPN 隧道使用 AWS 与客户侧的公网 IP，Direct Connect（DX）需要公共虚拟接口（Public VIF）来访问 AWS VPN 端点。
English
Because standard VPN tunnels use public IPs on the AWS and customer sides, Direct Connect requires a Public VIF to reach the AWS VPN endpoints.
Transcript
01:40 Now if you know how direct connect works, we said that if you want to reach to any public
01:40 IPs on the AWS side, then on the direct connect, you need a public WIF.
01:51 So the first option to set up this site to site VPN over the DX connection is to use
01:56 the standard site to site VPN, but using the public WIF.
7. 方案一：Public VIF 上的标准 VPN
时间范围：02:01–02:22
总结 / Summary
中文
标准 Site-to-Site VPN over DX 使用公共虚拟接口（Public VIF），让公网隧道端点经 Direct Connect 路径互通。
English
Standard Site-to-Site VPN over DX uses a Public VIF so the public tunnel endpoints communicate across the Direct Connect path.
Transcript
02:01 So this works, however, it is not considered as a most secure option, because here you
02:01 are still dealing with the public IPs.
02:10 And there are some challenges using these public IPs, which we are going to talk soon.
02:15 But other than this, you can also now establish private IP VPN over the direct connect connection.
8. 方案二：Transit VIF 上的 Private IP VPN
时间范围：02:22–02:50
总结 / Summary
中文
另一种方案是基于私有 IP 的 VPN（Private IP VPN over DX），它使用中转虚拟接口（Transit VIF）和 Transit Gateway；下一讲将详细说明。
English
The alternative is Private IP VPN over DX, which uses a Transit VIF and Transit Gateway; it is covered in detail in the next lecture.
Transcript
02:22 And there you have to use the transit gateway.
02:25 And again, we are going to talk about that.
02:27 So the point here is that for layer three encryption or the direct connect connection,
02:32 there are these two options, either use the public WIF and establish a standard site to
02:32 site VPN, or if you want to have private IP VPN, then use the transit WIF.
02:43 So in this lecture, let's particularly talk about the standard site to site VPN over a public WIF.
9. 标准 VPN 两端都使用公网 IP
时间范围：02:50–03:01
总结 / Summary
中文
标准 Public IP VPN 的两个隧道端点在 AWS 侧和本地侧都使用公网 IP（Public IP Addresses），Public VIF 负责这些地址之间的路由。
English
Standard Public IP VPN uses public IP addresses for tunnel endpoints on both AWS and on-premises sides, with the Public VIF routing between them.
Transcript
02:50 So here the VPN tunnels use the public IP addresses on both ends.
02:55 And the difference here is that the traffic doesn't go over the internet, but the traffic
02:59 goes through your direct connect connection.
10. VPN 可终止在 VGW 或 TGW
时间范围：03:01–03:20
总结 / Summary
中文
公网 IP VPN 可以终止在虚拟私有网关（VGW）上，也可以终止在中转网关（TGW）上；TGW 可为多个 VPC 提供集中式连接。
English
A Public IP VPN can terminate on a VGW or TGW; a TGW can provide centralized connectivity for multiple VPCs.
Transcript
03:01 Further, as I said, on the AWS side, the VPN tunnels can be terminated on the virtual private
03:08 gateway or a VPN gateway or a transit gateway.
03:13 And as you establish this VPN connection, it adds the IPSec encryption on top of your
03:18 existing direct connect path.
11. 在 DX 路径上叠加 IPsec
时间范围：03:20–03:29
总结 / Summary
中文
Public VIF 提供底层 Direct Connect（DX）传输，而 IPsec VPN 在其上叠加加密，从而同时利用专线路径与三层机密性保护。
English
The Public VIF supplies the underlying Direct Connect transport, while the IPsec VPN adds encryption on top, combining a dedicated path with Layer 3 confidentiality.
Transcript
03:20 All right, with that, now let me show you the architecture for this standard site to
03:26 site VPN over the DX connection.
12. 使用 VGW 的 Public IP VPN 拓扑
时间范围：03:29–03:50
总结 / Summary
中文
在 VGW 架构中，VPC 的虚拟私有网关（Virtual Private Gateway，VGW）通过 Public VIF 与客户路由器的公网端点建立 IPsec VPN。
English
In the VGW design, the VPC's Virtual Private Gateway establishes an IPsec VPN with the customer router's public endpoint through the Public VIF.
Transcript
03:29 So architecture is like this, where you have the AWS region, inside that you have VPC,
03:35 and there is a virtual private gateway.
03:37 Now, that's the first option.
03:39 And here you are using the public WIF.
03:41 And then this virtual private gateway will have two tunnels with two public IPs.
03:46 And on the customer gateway side as well, you will have the public IP, and you will
13. Public VIF 承载到 VGW 的 VPN 隧道
时间范围：03:50–04:11
总结 / Summary
中文
VPN 隧道的加密报文通过 Public VIF 穿过 Direct Connect 位置；Public VIF 只提供端点可达性，实际私有业务流量封装在 IPsec 中。
English
Encrypted VPN packets traverse the Direct Connect location over the Public VIF; the VIF provides endpoint reachability while private application traffic remains encapsulated in IPsec.
Transcript
03:50 establish these two VPN tunnels.
03:53 Now, as I said, this traffic goes through your direct connect connection and doesn't
03:57 go over the internet.
03:59 So as you can see, this is very similar to your normal site to site VPN connection, but
04:03 just that traffic is private.
04:06 Alright, so in this case, we are basically using the VPN gateway and we are of course
14. VGW 公网端点与带宽限制
时间范围：04:11–04:23
总结 / Summary
中文
Public VIF 可以访问 VGW 的公网 VPN 端点，但每条 VPN 连接受约 1.25 Gbps 带宽限制（Bandwidth Limit），因此不能直接获得 DX 端口的全部容量。
English
A Public VIF can reach the VGW public VPN endpoint, but each VPN connection is limited to roughly 1.25 Gbps, so it cannot directly consume the full DX port capacity.
Transcript
04:11 then limited by the VPN gateway bandwidth, that is 1.25 Gbps per VPN connection.
04:11 Now, if you want to go beyond this bandwidth limit, while still using the public WIF, then
04:23 rather you can use the transit gateway.
15. 使用 TGW 的 Public IP VPN 拓扑
时间范围：04:23–04:41
总结 / Summary
中文
使用中转网关（Transit Gateway，TGW）时，多个 VPC 可共享集中式 VPN 终止点，同时 Public VIF 仍承载公网端点之间的流量。
English
With a Transit Gateway, multiple VPCs share a centralized VPN termination point while the Public VIF still carries traffic between the public tunnel endpoints.
Transcript
04:26 Now there also you are going to use the public IPs of the transit gateway for the VPN tunnels.
04:32 But just that because it's a transit gateway, it supports the multiple VPN connection, it
04:36 supports the ECMP.
04:38 So you can get better aggregated bandwidth.
16. TGW 公网端点、ECMP 与汇总带宽
时间范围：04:41–05:23
总结 / Summary
中文
Public VIF 可访问 TGW 的公网 VPN 端点；单连接仍约为 1.25 Gbps，但 TGW 支持基于 BGP 的等价多路径（Equal-Cost Multi-Path，ECMP），可跨多条 VPN 连接提高汇总带宽。
English
A Public VIF can reach TGW public VPN endpoints; each connection remains about 1.25 Gbps, but BGP-based ECMP across multiple VPN connections can increase aggregate bandwidth.
Transcript
04:41 So overall, the architecture is quite similar.
04:44 But then you can connect your transit gateway to the multiple VPCs and you can have higher
04:49 aggregated bandwidth.
04:51 So for having this site to site VPN over the public IPs, you can use either the VPN gateway
04:58 or the transit gateway.
05:00 And the thing here to remember is that you have to use the public WIF for the direct
05:05 connection, because you are connecting over the public IPs on AWS site, right?
05:11 So I hope it is clear.
05:12 Now, when I started this lecture, I told you that there are some concerns when you use the public WIF.
05:18 So now let's talk about those concerns.
05:20 And then we will see the private IP VPN.
17. Public IP VPN 的挑战概览
时间范围：05:23–05:30
总结 / Summary
中文
Public IP VPN over Direct Connect 虽能提供三层加密，但公网端点与 Public VIF 会引入额外的安全、路由和合规考虑。
English
Public IP VPN over Direct Connect provides Layer 3 encryption but introduces additional security, routing, and compliance considerations through public endpoints and the Public VIF.
Transcript
05:23 So what are the challenges if you are using this public WIF and public IPs for the VPN connection?
18. 公网端点增加 DDoS 风险
时间范围：05:30–05:46
总结 / Summary
中文
公网 IP 增加外部拒绝服务（Denial of Service，DoS/DDoS）攻击面，因此客户可能需要部署额外的网络安全设备和防护控制。
English
Public IPs increase exposure to external denial-of-service attacks, potentially requiring customers to deploy additional network-security controls.
Transcript
05:30 So the public IPs increase basically the probability of DDoS attacks because these are public IPs.
05:35 So anybody can just target your public IPs.
05:39 And that's where typically customer would need to have the additional security firewalls
05:43 deployed for this public IPs.
19. Public VIF 扩大 AWS 公共服务可达范围
时间范围：05:46–06:05
总结 / Summary
中文
Public VIF 不只连接 VPN 端点，还可提供 AWS 公共服务与本地网络之间的可达性，因而会扩大潜在风险范围。
English
A Public VIF reaches more than VPN endpoints; it can provide connectivity between AWS public services and the on-premises network, widening the potential exposure.
Transcript
05:46 Further, public WIF also opens the access between all AWS public services and customer
05:51 on-premises network.
05:53 And that's where it opens unnecessary doors for any traffic which may target your public IPs.
06:00 Next, as you know, when you create the public WIF, you exchange a lot of routes, that is
20. 使用 BGP Communities 严格过滤路由
时间范围：06:05–06:40
总结 / Summary
中文
必须使用 BGP 社区（BGP Communities）和路由策略谨慎限制 AWS 与本地之间发布和接收的前缀，避免不必要的公共路由传播。
English
BGP communities and routing policies must carefully restrict prefixes advertised and accepted between AWS and on-premises networks to avoid unnecessary public-route propagation.
Transcript
06:05 public routes between AWS and on-premise network.
06:09 And many times you would want to filter those routes, because maybe on AWS side, you don't
06:14 need to have all the public IPs for say EC2 instances or S3 service, for example, right?
06:20 And typically for this, customer will have some kind of filtering applied when the AWS
06:25 exchanges this route over the BGP peering.
06:28 So if you are using public IP, you would have to also filter these routes.
06:33 And apart from that, customers may have some compliance policies, which prohibits the use of public IPs.
21. 某些合规策略禁止使用公网 IP
时间范围：06:40–07:10
总结 / Summary
中文
医疗、金融或政府等环境的合规策略可能禁止使用公网 IP（Public IPs），即使流量实际经过专用 Direct Connect 路径；此时应考虑 Private IP VPN。
English
Compliance policies in healthcare, financial, or government environments may prohibit public IPs even when traffic traverses Direct Connect, making Private IP VPN a more suitable option.
Transcript
06:40 And that's a very common scenario, which I have seen while I worked at AWS.
06:44 And in those cases, customer doesn't want to use the public WIF and they want to go
06:49 for transit WIF or private WIF for connecting to AWS. Right.
06:55 So considering these challenges, and given the requirement that we still want to encrypt
07:00 the traffic at layer three, let's look at another option that is private IP VPN.
07:06 So now in the next lecture, let's talk about that.
整讲总结 / Overall Summary
中文
Public IP VPN over Direct Connect（DX）使用 Public VIF 访问 AWS 侧的公网 VPN 端点，并在 DX 路径上叠加 IPsec 加密。VPN 可终止在 VGW 或 TGW；VGW 方案简单但单连接约受 1.25 Gbps 限制，TGW 还可使用 BGP ECMP 跨多条 VPN 连接提升汇总带宽。该方案的代价是公网端点带来的 DoS/DDoS 风险、Public VIF 对 AWS 公共服务的广泛可达性、复杂的 BGP 路由过滤，以及某些行业禁止公网 IP 的合规限制。
English
Public IP VPN over Direct Connect uses a Public VIF to reach public AWS VPN endpoints and layers IPsec encryption on the DX path. The VPN can terminate on a VGW or TGW; the VGW design is straightforward but each connection is limited to about 1.25 Gbps, while TGW can use BGP ECMP across multiple VPN connections for higher aggregate throughput. Tradeoffs include DoS/DDoS exposure from public endpoints, broad AWS public-service reachability through the Public VIF, more demanding BGP route filtering, and compliance policies that may prohibit public IPs.
返回顶部 ↑