内网域名访问内网服务器

部门ftp服务器和远程服务器内网域名无法访问问题困扰我好久，钻研了几天，终于明白了一些，和大家做一个分享，原帖子在这里，表示感谢

一. 网络需求

现状：内网中两台服务器，对外提供ftp和samba服务，网关路由器公网接口上已下发nat server 配置，DNS服务器位于公网，将两台服务器对应的域名映射到公网出口地址上，公网用户已经可以正常通过域名访问服务器
改进：内网用户可以使用域名或是公网IP访问内部服务器
涉及路由器：TL-WVR1300G AC1300双频无线企业VPN路由器

二. 待选方案

方案一：DNS-mapping 方案：
在路由器上配置DNS map功能，建立域名-公网地址-公网端口号-服务协议的匹配表项。当内网用户发出的DNS解析请求得到的DNS Server响应到达配置了NAT server 的公网出接口时，接口上查找到DNS map表项后会将内网服务器的地址替换解析到的公网地址，主机就可以使用内网地址直接访问服务器。

方案二：利用NAT 和NAT Server 下发在内网网关接口上，使内网主机通过公网地址去访问服务器。
在不使用DNS-mapping的情况下，主机用域名访问服务器意味着主机必须能使用公网地址去访问内网服务器。通过将NAT和NATServer 配置下发在内网网关接口上可以满足该应用（原先下发在公网接口上的nat server 配置是为了满足公网用户访问的，该部分配置不变）。

三. 配置步骤

方案一配置
<H3C>system-view
[H3C]sysname Gateway
[Gateway]interface g0/1
[Gateway-GigabitEthernet0/1]ip address 202.38.1.1 24
[Gateway-GigabitEthernet0/1]nat server protocol tcp global 202.38.1.1 www inside 10.110.1.1 www
[Gateway-GigabitEthernet0/1]nat server protocol tcp global 202.38.1.1 ftp inside 10.110.1.2 ftp
[Gateway-GigabitEthernet0/1]quit
[Gateway]interface g0/0
[Gateway-GigabitEthernet0/0]ip address 10.110.1.10 24
[Gateway-GigabitEthernet0/0]quit
// 注意dns-map 配置中对应的地址是公网地址而不是服务器的内网地址
[Gateway] nat dns-map domain www.server.com protocol tcp ip 202.38.1.2 port www
[Gateway] nat dns-map domain ftp.server.com protocol tcp ip 202.38.1.2 port ftp

方案二配置
<H3C>system-view
[H3C]sysname Gateway
[Gateway]acl number 3000
//编写acl 匹配来自内网网段目的地址为两台server的数据流
[Gateway-acl-adv-3000]rule permit ip source 10.110.1.0 0.0.0.255 destination 10.110.1.1 0
[Gateway-acl-adv-3000] rule permit ip source 10.110.1.0 0.0.0.255 destination 10.110.1.2 0
[Gateway]interface g0/0
[Gateway-GigabitEthernet0/0]ip address 10.110.1.10 24
//将nat及nat server 配置下发在内网网关口上
[Gateway-GigabitEthernet0/0]nat server protocol tcp global 202.38.1.1 www inside 10.110.1.1 www.luyouqiwang.com
[Gateway-GigabitEthernet0/0]nat server protocol tcp global 202.38.1.1 ftp inside 10.110.1.2 ftp
[Gateway-GigabitEthernet0/0]nat outbound 3000
[Gateway-GigabitEthernet0/0]quit
//其它基础配置略

四. 配置关键点

1．注意dns-map的配置中的ip地址应该配置公网出接口地址。
Nat server 的相关配置应该下发在公网出接口上。
2．在方案二中，nat server 及 nat outbound的配置应当配置在内网网关接口上。并且注意acl 规则中的目的地址应匹配服务器主机地址。
3. 在方案二中，可以使用 nat static 方式为私网server地址和公网地址间建立1对1转换。这一配置可以用来代替nat server 的相关配置。

Steve Jobs at 44, By Michael Krantz, 1999

Differences and Similarities Between Apple and Pixar Apple turns out many products--a dozen a year; if you count all the minor ones, probably a hundred. Pixar is striving to turn out one a year. But the converse of that is that Pixar's products will still be used fifty years from now, whereas I don't think you'll be using any product Apple brings to market this year fifty years from now. Pixar is making art for the ages. Kids will be watching Toy Story in the future. And Apple is much more of a constant race to continually improve things and stay ahead of the competition. His Role At Pixar At Pixar my job is to help build the studio and recruit people and help create a situation where they can do the best work of their lives. And to some degree it's the same at Apple. But at Pixar, I don't direct the movies, whereas at Apple probably, if I had to pick a role out of a film production, I'd be the director. So it...

阅读全文

Foobar2000 组件安装教程

原作者博客地址汉化作者 Asion博客关于foobar 2000的一些资源前言 foobar2000 由于其软件架构特点以及开放的姿态，使得第三方很容易开发组件（component）来拓展它的功能。由于在官网下载的默认安装文件只带了少量几个默认的组件，满足不了使用的需求，例如：默认不带 ape，tta，tak 等音频文件格式的解码器，很多无损压缩格式音乐没法播放。所以自己下载安装组件是必备的基本技能。 foobar2000 的中文汉化版（Asion 汉化）为了方便使用，集成了无损压缩文件解码器以及一些其它有用的插件，安装时选上即可，不喜欢折腾的建议使用汉化版。这里组件指的是 foobar2000 标准组件（*.dll 文件），而非 vst 插件等其它插件，姑且把组件分为两类：官方组件：英文版安装包自带，安装时可选择；第三方组件：非官方自带的组件除了 foo_input_std.dll 和 foo_ui_std.dll 这两个组件是必须的外，其它的所有组件都非必需的，可以随需要增删。第三方组件可以去官网、官方论坛或者官方 wiki 去找，也可以去贴吧等地逛逛。下载还是要强调一下，这里说的是 foobar2000 component ，不是中文网上通常说的 vst 插件。下载好的组件包一般是 xxx.zip 或 xxx.fb2k-component 格式的文件，也有用 7z 打包的。前两种都是 zip 压缩（只要把 fb2k-component 改成 zip 文件就变成了 zip：包）。标准状况下压缩包里的内容结构应该是 xxx.zip yyy.dll README.txt (可能没有) LICENCE.txt (可能没有) (其它杂七杂八）除少数外一般只有一个 xxx.dll 文件.一定要注意压缩包结构不能是: xxx.zip yy folder (文件夹） zzz.dll … 否则要解压缩，提取那个 dll 文件。安装方法一（推荐）打开 foobar2000 的菜单文件 > 首选项(file >preferences) 的组件(components...

阅读全文

《Becoming Steve Jobs》Chapter 15 The Whole Widget

What the world did see was an effective and visionary leader at the height of his powers. These were complicated years for Apple, but Steve handled almost every challenge in exactly the manner he wanted. He had fallen into leadership at such a young age, but he was comfortable in that role now, and justifiably sure of his capacity to guide Apple’s tens of thousands of employees to the goals he set for them. During these years, he would ensure the company’s continued success in personal computers by engineering a deft switch to a new kind of microprocessor; ruthlessly and successfully managing some major transitions in his executive team; and optimizing and building upon the efficiency and ambition of the company’s product development “treadmill,” as Tim Cook describes it. This is also when he delivered what is likely to be remembered as the most notable product of his life, the iPhone, and then improved even that by pivoting once again into a strategy he personally had not wanted to pu...

阅读全文

360T7 刷机步骤及固件

https://cmi.hanwckf.top/p/360t7-firmware/ 360T7的固件支持由immortalwrt-mt798x项目提供支持，请参考： https://cmi.hanwckf.top/p/immortalwrt-mt798x https://github.com/hanwckf/immortalwrt-mt798x 刷机步骤参考此处的办法开启原厂固件的UART和telnet功能在以下链接下载360T7测试固件（纯净版，无任何插件） https://wwd.lanzout.com/b0bt9idwd 密码:ezex （此固件已过时，请选择其它更新的固件）接下来将刷入修改版uboot。修改版uboot的优点有：固件分区可达108MB，原厂uboot只能使用36M 自带一个简单的webui恢复页面到以下仓库的Release页面下载uboot，目前暂时仅支持360T7，后续将支持更多mt798x路由器。推荐使用 mt7981_360t7-fip-fixed-parts.bin ， fixed-parts 代表uboot分区表在编译期间固定，不会随着uboot环境变量变化。 https://github.com/hanwckf/bl-mt798x/releases/latest 将 mt7981_360t7-fip-fixed-parts.bin 通过HFS等方式上传到路由器，使用以下命令刷入uboot mtd write mt7981_360t7-fip-fixed-parts.bin fip 确认刷入完毕后，拔掉路由器电源。然后将电脑的IP地址设置为固定的 192.168.1.2 ，接着按住路由器的RESET按钮后通电开机，等待8s后用浏览器进入 192.168.1.1 在uboot恢复页面选择要刷入的固件。immortalwrt-mt798x目前编译两个版本的360T7固件。建议修改版uboot直接使用 immortalwrt-mediatek-mt7981-mt7981-360-t7-108M-squashfs-factory.bin ，两种固件区别如下： mt7981-360-t7-108M 为108M固件分区，原厂uboot不可启动，需要修改版u...

阅读全文

ISSUU使用指南--木喵

作者：木喵出处： Wonderworks 问：issuu是什么？答：Issuu是国外的一个在线文档共享网站，它是你的PDF文档发布专家。它类似于我们熟悉的youtube，但它共享的是文档、杂志之类的文本。简而言之、同志们想看国外的各种杂志？想找国外的汇报文本么？想借鉴国外学生的作品集么？那么你就要用到它啦~ 今天主要和大家讲两个方面一、如何在pc端使用和下载issuu上的pdf文档首先我们打开issuu的网址 https://issuu.com/ 我们可以很清楚的看到网页上呢都是国外的杂志以及一些作者自己制作的pdf文档首先我们点击右上角的 sign up 然后填写相关信息注册一个账户：注册完成之后我们就可以搜索我们想要找的资料：比如说，我想找一些分析图的资料，我们就搜索： architecture diagram 然后我们就可以看到相关的文档了：点击你所选择的文档，好了问题来了： sorry，this publication is not available 这个时候！就需要在用pc端的我们做一件必不可少的事：翻墙然后我们就能将页面刷新粗来了好、接下来是非常有建设性意义的一步怎样把我们网页上的文件下载下来呢？截图？ no~no~no~ 接下来，让木喵告诉你怎么下载：首先你需要复制上面的网址然后将 https://wenfan.hk/issuu/index_link.php 在另一个网址中打开将你之前复制的pdf的网址粘贴在下面的对话框中点击 I‘m not a robot 再点击 get it 然后会出现一堆网址代码我们全选打开你的迅雷点击新建将你之前的复制粘贴到下载链接里然后呢~我们就全都下载成功啦~ 然后我们回到之前的网页向下看我们可以看到有上传文档的作者（记得要关注哟）然后还有 info share stack ❤ 如果...

阅读全文

产品随想 | 陪读《Make Something Wonderful：Steve Jobs in his own words》1976-1996

There’s lots of ways to be, as a person. And some people express their deep appreciation in different ways. But one of the ways that I believe people express their appreciation to the rest of humanity is to make something wonderful and put it out there. And you never meet the people. You never shake their hands. You never hear their story or tell yours. But somehow, in the act of making something with a great deal of care and love, something’s transmitted there. And it’s a way of expressing to the rest of our species our deep appreciation. So we need to be true to who we are and remember what’s really important to us. ──Steve, 2007 Introduction by Laurene Powell Jobs Much of what’s in these pages reflects guiding themes of Steve’s life: his sense of the worlds that would emerge from marrying the arts and technology; his unbelievable rigor, which he imposed first and most strenuously on himself; his tenacity in pursuit of assembling and leading great teams; and perhaps, above all,...

阅读全文

Steve Jobs talks about the difference between art and technology

When asked by Time magazine about the difference between art and technology, Jobs said, “I’ve never believed that they’re separate. Leonardo da Vinci was a great artist and a great scientist. Michelangelo knew a tremendous amount about how to cut stone at the quarry. The finest dozen computer scientists I know are all musicians. Some are better than others, but they all consider that an important part of their life. I don’t believe that the best people in any of these fields see themselves as one branch of a forked tree. I just don’t see that. People bring these things together a lot. Dr. Land at Polaroid said, ‘I want Polaroid to stand at the intersection of art and science,’ and I’ve never forgotten that. I think that that’s possible, and I think a lot of people have tried.”

阅读全文

产品随想 | 周刊第108期：Invent instruments that don't exist. Invent sounds that don't exist

J. Paul Getty Museum https://artsandculture.google.com/pocketgallery/DAWRu4WOO5gsew?hl=en 这有可能是Apple Vision Pro的优雅应用 The Mycroft Project https://mycroftproject.com/ OpenSearch标准，来自Apple Sherlock的遗产，一切开始连接 'Artifacts' book https://shop.porsche.com/gb/en-GB/p/-artifacts-book-P-MAP09000723-B/MAP09000723 认识更多保时捷 Deep Learning System & AI System https://github.com/chenzomi12/DeepLearningSystem Deep Learning System core principles introduction. Betterfox https://github.com/yokoffing/Betterfox Firefox user.js for speed, privacy, and security. Your favorite browser, but better. Browsers for Daily Using https://anhkhoakz.neocities.org/blog/browsers-for-daily-using/ In 2010, a New York Times reporter had a conversation that revealed a lot about the life of the founder of Apple. Nick Bilton commented, “Your kids must love the iPad, right?” After the launch of the device. Jobs replied, “They haven't used it. We limit the amount of technology our ...

阅读全文

Steve Jobs: `There's Sanity Returning', 1998

Nobody can doubt the charisma of Steven P. Jobs. The interim CEO of Apple Computer Inc., who returned to the company last July after his ignominious 1985 ouster, has brought back his legendary vision, impatience, and infectious passion for the Macintosh. Jobs spoke to Business Week Correspondent Andy Reinhardt in Apple's stark, fourth-floor boardroom, just after the company rolled out its new software strategy on May 11. Note: This is an extended, online-only version of the Q&A that appears in the May 25, 1998, issue of Business Week. Q: Now that you've introduced the new, bold-looking iMac, are you going to do some radically different products? A: There's a lot of talk about such things -- about handhelds, set-top boxes. A lot of computer companies have been searching for a consumer product. My view is that the personal computer has been the most successful consumer product of the last 10 years. What we have to do, what the industry stopp...

阅读全文

产品随想 | 周刊第117期：He saw the intersection of art and science and business and built an organization to reflect that.

He disliked biography attempts. “I regard my scientific papers as my essential biography,’’ Land said. “I pour my whole life into the scientific project I’m investigating. I leave behind the things I’ve done in the past to do the work in the present.’’ “The purpose of inventing instant photography was essentially aesthetic,’’ Land said in 1947, announcing the process’s invention. “We live in a world changing so rapidly that what we mean frequently by common sense is doing the thing that would have been right last year.” — Edwin Land, Statement to Polaroid Corporation employees (25 June 1958) The worldview he was describing perfectly echoed Land’s: “Market research is what you do when your product isn’t any good.” And his sense of innovation: “Every significant invention,” Land once said, “must be startling, unexpected, and must come into a world that is not prepared for it. If the world were prepared for it, it would not be much of an invention.” Thirty years later, when a reporter ask...

阅读全文

产品随想的博客

搜索此博客