内网域名访问内网服务器

部门ftp服务器和远程服务器内网域名无法访问问题困扰我好久，钻研了几天，终于明白了一些，和大家做一个分享，原帖子在这里，表示感谢

一. 网络需求

现状：内网中两台服务器，对外提供ftp和samba服务，网关路由器公网接口上已下发nat server 配置，DNS服务器位于公网，将两台服务器对应的域名映射到公网出口地址上，公网用户已经可以正常通过域名访问服务器
改进：内网用户可以使用域名或是公网IP访问内部服务器
涉及路由器：TL-WVR1300G AC1300双频无线企业VPN路由器

二. 待选方案

方案一：DNS-mapping 方案：
在路由器上配置DNS map功能，建立域名-公网地址-公网端口号-服务协议的匹配表项。当内网用户发出的DNS解析请求得到的DNS Server响应到达配置了NAT server 的公网出接口时，接口上查找到DNS map表项后会将内网服务器的地址替换解析到的公网地址，主机就可以使用内网地址直接访问服务器。

方案二：利用NAT 和NAT Server 下发在内网网关接口上，使内网主机通过公网地址去访问服务器。
在不使用DNS-mapping的情况下，主机用域名访问服务器意味着主机必须能使用公网地址去访问内网服务器。通过将NAT和NATServer 配置下发在内网网关接口上可以满足该应用（原先下发在公网接口上的nat server 配置是为了满足公网用户访问的，该部分配置不变）。

三. 配置步骤

方案一配置
<H3C>system-view
[H3C]sysname Gateway
[Gateway]interface g0/1
[Gateway-GigabitEthernet0/1]ip address 202.38.1.1 24
[Gateway-GigabitEthernet0/1]nat server protocol tcp global 202.38.1.1 www inside 10.110.1.1 www
[Gateway-GigabitEthernet0/1]nat server protocol tcp global 202.38.1.1 ftp inside 10.110.1.2 ftp
[Gateway-GigabitEthernet0/1]quit
[Gateway]interface g0/0
[Gateway-GigabitEthernet0/0]ip address 10.110.1.10 24
[Gateway-GigabitEthernet0/0]quit
// 注意dns-map 配置中对应的地址是公网地址而不是服务器的内网地址
[Gateway] nat dns-map domain www.server.com protocol tcp ip 202.38.1.2 port www
[Gateway] nat dns-map domain ftp.server.com protocol tcp ip 202.38.1.2 port ftp

方案二配置
<H3C>system-view
[H3C]sysname Gateway
[Gateway]acl number 3000
//编写acl 匹配来自内网网段目的地址为两台server的数据流
[Gateway-acl-adv-3000]rule permit ip source 10.110.1.0 0.0.0.255 destination 10.110.1.1 0
[Gateway-acl-adv-3000] rule permit ip source 10.110.1.0 0.0.0.255 destination 10.110.1.2 0
[Gateway]interface g0/0
[Gateway-GigabitEthernet0/0]ip address 10.110.1.10 24
//将nat及nat server 配置下发在内网网关口上
[Gateway-GigabitEthernet0/0]nat server protocol tcp global 202.38.1.1 www inside 10.110.1.1 www.luyouqiwang.com
[Gateway-GigabitEthernet0/0]nat server protocol tcp global 202.38.1.1 ftp inside 10.110.1.2 ftp
[Gateway-GigabitEthernet0/0]nat outbound 3000
[Gateway-GigabitEthernet0/0]quit
//其它基础配置略

四. 配置关键点

1．注意dns-map的配置中的ip地址应该配置公网出接口地址。
Nat server 的相关配置应该下发在公网出接口上。
2．在方案二中，nat server 及 nat outbound的配置应当配置在内网网关接口上。并且注意acl 规则中的目的地址应匹配服务器主机地址。
3. 在方案二中，可以使用 nat static 方式为私网server地址和公网地址间建立1对1转换。这一配置可以用来代替nat server 的相关配置。

《Becoming Steve Jobs》Chapter 12 Two Decisions

Jim Collins, the bestselling author of the management classics Built to Last: Successful Habits of Visionary Companies and Good to Great: Why Some Companies Make the Leap … and Others Don’t, has a wonderful phrase to describe an essential characteristic of great leaders: deep restlessness. Collins applies the phrase to Steve, one of the two great leaders who inspire him the most (the other is Winston Churchill, the great English politician who was prime minister during most of World War II, from 1940 to 1945, and again from 1951 to 1955). Collins believes this restlessness is far more important and powerful than simple ambition or raw intelligence. It is the foundation of resilience, and self-motivation. It is fueled by curiosity, the ache to build something meaningful, and a sense of purpose to make the most of one’s entire life. 自己何其有幸，在不到30的年纪，就能感受到乔布斯的心境 “The things he was trying to do,” says Collins, “were always hard. Sometimes those things beat him up. But the response to fighti...

阅读全文

产品随想 | 周刊第69期：Do not go gentle into that good night

Products Windows Apps That Amaze Us https://amazing-apps.gitbook.io/windows-apps-that-amaze-us/ 令人精细的Windows App 文物出版社 https://book.douban.com/press/2456/ 这是一个宝藏出版社，出品书籍质量非常高，大开眼界 blind https://www.teamblind.com/ 老外的匿名职场社交工具，挺有意思，看看硅谷的meme 中国科学技术大学测速网站 https://test.ustc.edu.cn/ 看着还不错，挺靠谱的底层代码是LibreSpeed https://github.com/librespeed/speedtest 能不能好好说话？ https://github.com/itorr/nbnhhsh 也是我的一个痛点 Tree Style Tab (aka TST) https://github.com/piroor/treestyletab 一个超强的浏览器扩展插件，树状呈现浏览器标签 Failory Pitch Decks https://www.failory.com/pitch-deck 超级多的融资计划投资板，Pitch Book AutoCut https://github.com/mli/autocut 用文本编辑器剪视频全网漫游指南 https://tagly.notion.site/tagly/a333efd8c3e54e12b123acd541e8d3e6 数字时代的指引，希望他们成功 IT eBooks https://it-ebooks.info/ IT书籍下载 ToastFish https://github.com/Uahh/ToastFish 一个利用摸鱼时间背单词的软件。利用Win10通知栏，出现、背单词 Ideas 沈向洋：IDEA 如何找到创新的「甜区」 https://mp.weixin.qq.com/s/OlI5VUxQKU_ijWZClQCG0Q AIGC How Did Nor...

阅读全文

产品随想 | 周刊第88期：抢救中文社科历史讲座

抢救中文人文社科历史讲座 https://github.com/jeffyus/renwenjiangzuo 苹果公司的招聘理念就是两点。（1）优秀人才是自我管理的，但需要领导者为大家提供一个共同目标。（2）只有某个人看到 Macintosh 电脑感到无比兴奋，我们才会雇佣他。 ————喬布斯衡量一个人的领导能力的最好方法，就是看如果这个人休假了，他的下属在做什么。优秀的产品经理和工程师可以休假一周，他管理的工作不发生任何问题。优秀的主管和技术负责人可以休假一个月。领导能力越优秀，休假的时间就越长。 -- Andrew Bosworth，Facebook 的 CEO ——可惡，想了想，好像還真是這樣阅读不会过时，除非写作过时了。写作不会过时，除非思考过时了。（Reading won't be obsolete till writing is, and writing won't be obsolete till thinking is.） -- Paul Graham ——深刻 Cheetah https://github.com/leetcode-mafia/cheetah Cheetah is an AI-powered macOS app designed to assist users during remote software engineering interviews by providing real-time, discreet coaching and live coding platform integration. 對面試官的要求，變更高了，哈哈哈 AI's Hardware Problem https://asianometry.substack.com/p/ais-hardware-problem 有趣，瓶頸在內存 Clash 入土为安 https://gyrojeff.top/index.php/archives/Clash-入土为安/ 有趣的介紹 OP Vault ChatGPT https://github.com/pashpashpash/vault-ai Give ChatGPT long-term memory using the ...

阅读全文

可能比较危险的

全网监控公司： 1）中国厦门的美亚柏科 2）KIS（Knowlesys Intelligence System） 3）除中美之外的第三大AI监控技术供应商是：日本的NEC Corporation 中国的VPN公司： 1）VyprVPN、玲珑加速器 Point： 1）被GFW屏蔽的IP，反向也会无法访问大陆网络

阅读全文

Steve Jobs introduced the iPhone on January 9, 2007.

This is a day I’ve been looking forward to for two and a half years. Link Every once in a while, a revolutionary product comes along that changes everything. And Apple has been— well, first of all, one’s very fortunate if you get to work on just one of these in your career. Apple’s been very fortunate. It’s been able to introduce a few of these into the world. In 1984, we introduced the Macintosh. It didn’t just change Apple, it changed the whole computer industry. In 2001, we introduced the first iPod, and it didn’t just change the way we all listen to music, it changed the entire music industry. Well, today, we’re introducing three revolutionary products of this class. The first one is a widescreen iPod with touch controls. The second is a revolutionary mobile phone. And the third is a breakthrough internet communications device. So, three things: a widescreen iPod with touch controls; a revolutionary mobile phone; and a breakthrough internet communicat...

阅读全文

Interview at the All Things Digital D5 Conference, Steve and Bill Gates spoke with journalists Kara Swisher and Walt Mossberg onstage in May 2007.

Kara Swisher: The first question I was interested in asking is what you think each has contributed to the computer and technology industry— starting with you, Steve, for Bill, and vice versa. Steve Jobs: Well, Bill built the first software company in the industry. And I think he built the first software company before anybody really in our industry knew what a software company was, except for these guys. And that was huge. That was really huge. And the business model that they ended up pursuing turned out to be the one that worked really well for the industry. I think the biggest thing was, Bill was really focused on software before almost anybody else had a clue that it was really the software that— KS: Was important? SJ: That’s what I see. I mean, a lot of other things you could say, but that’s the high-order bit. And I think building a company’s really hard, and it requires your greatest persuasive abilities to hire the best ...

阅读全文

ISSUU使用指南--木喵

作者：木喵出处： Wonderworks 问：issuu是什么？答：Issuu是国外的一个在线文档共享网站，它是你的PDF文档发布专家。它类似于我们熟悉的youtube，但它共享的是文档、杂志之类的文本。简而言之、同志们想看国外的各种杂志？想找国外的汇报文本么？想借鉴国外学生的作品集么？那么你就要用到它啦~ 今天主要和大家讲两个方面一、如何在pc端使用和下载issuu上的pdf文档首先我们打开issuu的网址 https://issuu.com/ 我们可以很清楚的看到网页上呢都是国外的杂志以及一些作者自己制作的pdf文档首先我们点击右上角的 sign up 然后填写相关信息注册一个账户：注册完成之后我们就可以搜索我们想要找的资料：比如说，我想找一些分析图的资料，我们就搜索： architecture diagram 然后我们就可以看到相关的文档了：点击你所选择的文档，好了问题来了： sorry，this publication is not available 这个时候！就需要在用pc端的我们做一件必不可少的事：翻墙然后我们就能将页面刷新粗来了好、接下来是非常有建设性意义的一步怎样把我们网页上的文件下载下来呢？截图？ no~no~no~ 接下来，让木喵告诉你怎么下载：首先你需要复制上面的网址然后将 https://wenfan.hk/issuu/index_link.php 在另一个网址中打开将你之前复制的pdf的网址粘贴在下面的对话框中点击 I‘m not a robot 再点击 get it 然后会出现一堆网址代码我们全选打开你的迅雷点击新建将你之前的复制粘贴到下载链接里然后呢~我们就全都下载成功啦~ 然后我们回到之前的网页向下看我们可以看到有上传文档的作者（记得要关注哟）然后还有 info share stack ❤ 如果...

阅读全文

产品随想 | 周刊第43期：历史上的今天

Products Huberman Lab https://hubermanlab.com/ 一款聚焦于健康的播客今日热榜 https://tophub.today/ 聚合展示，国内各热门榜单，对跟进热点非常有帮助，热点运营的好帮手 SketchyBar https://github.com/FelixKratz/SketchyBar A highly customizable macOS status bar replacement Mac菜单栏定制自定义程度很高，看作者展示的案例，暂时没想出这样的好处（不过应用本身的编辑，确实也没啥意义）生命在于折腾吧！ Thanks-Mirror https://github.com/eryajf/Thanks-Mirror 整理记录各个包管理器，系统镜像，以及常用软件的好用镜像，Thanks Mirror。 Musicn https://github.com/zonemeen/musicn 一个下载高品质音乐的命令行工具，音乐来源: 咪咕 Planet Minecraft A creative Minecraft community fansite sharing maps, minecraft skins, resource packs, servers, mods, and more. 里面有很多动人的故事可能是世界上最大的Minecraft社区，从2010年至今 The Uncensored Library https://www.uncensoredlibrary.com/en blockworks https://www.blockworks.uk/ "Distinctive maps for Minecraft that have educated players and risen to the level of art" 游戏也可以让人有更高的实现，而不仅仅是沉迷其中，国外游戏厂商比我们做的好太多 Minecraft_Memory_Bypass_GUI https://github.com/xingchuanzhen/Minecraft_Memory_Bypass_GUI 绕过Minecraft...

阅读全文

《Becoming Steve Jobs》Chapter 15 The Whole Widget

What the world did see was an effective and visionary leader at the height of his powers. These were complicated years for Apple, but Steve handled almost every challenge in exactly the manner he wanted. He had fallen into leadership at such a young age, but he was comfortable in that role now, and justifiably sure of his capacity to guide Apple’s tens of thousands of employees to the goals he set for them. During these years, he would ensure the company’s continued success in personal computers by engineering a deft switch to a new kind of microprocessor; ruthlessly and successfully managing some major transitions in his executive team; and optimizing and building upon the efficiency and ambition of the company’s product development “treadmill,” as Tim Cook describes it. This is also when he delivered what is likely to be remembered as the most notable product of his life, the iPhone, and then improved even that by pivoting once again into a strategy he personally had not wanted to pu...

阅读全文

《Becoming Steve Jobs》Chapter 11 Do Your Level Best

As a mass-market consumer electronics device, the iPod would eventually be sold, of course, all the usual places: Best Buy, Circuit City, big-box department stores, and even the computer retailers like CompUSA. Steve disdained all these outlets. His obsession with his products continued well after they’d been manufactured. The tacky, low-margin hustle of these chains ran completely against the minimalist aesthetic of his products and the clean exuberance of his marketing. There was only one place where he really enjoyed seeing his products sold to the public: his own Apple stores, which had debuted four months ahead of the iPod. 觉得那些喧嚣、嘈杂的零售渠道，配不上自己极美的产品 Going back as far as the debut of the Mac, Steve had always groused about the way Apple computers were sold in its resellers’ stores. The way his computers were displayed and sold represented the very worst of what could go wrong when things weren’t done his way. The salespeople, always interested in quick turnover, seemed to make litt...

阅读全文

产品随想的博客

搜索此博客