内网域名访问内网服务器

部门ftp服务器和远程服务器内网域名无法访问问题困扰我好久，钻研了几天，终于明白了一些，和大家做一个分享，原帖子在这里，表示感谢

一. 网络需求

现状：内网中两台服务器，对外提供ftp和samba服务，网关路由器公网接口上已下发nat server 配置，DNS服务器位于公网，将两台服务器对应的域名映射到公网出口地址上，公网用户已经可以正常通过域名访问服务器
改进：内网用户可以使用域名或是公网IP访问内部服务器
涉及路由器：TL-WVR1300G AC1300双频无线企业VPN路由器

二. 待选方案

方案一：DNS-mapping 方案：
在路由器上配置DNS map功能，建立域名-公网地址-公网端口号-服务协议的匹配表项。当内网用户发出的DNS解析请求得到的DNS Server响应到达配置了NAT server 的公网出接口时，接口上查找到DNS map表项后会将内网服务器的地址替换解析到的公网地址，主机就可以使用内网地址直接访问服务器。

方案二：利用NAT 和NAT Server 下发在内网网关接口上，使内网主机通过公网地址去访问服务器。
在不使用DNS-mapping的情况下，主机用域名访问服务器意味着主机必须能使用公网地址去访问内网服务器。通过将NAT和NATServer 配置下发在内网网关接口上可以满足该应用（原先下发在公网接口上的nat server 配置是为了满足公网用户访问的，该部分配置不变）。

三. 配置步骤

方案一配置
<H3C>system-view
[H3C]sysname Gateway
[Gateway]interface g0/1
[Gateway-GigabitEthernet0/1]ip address 202.38.1.1 24
[Gateway-GigabitEthernet0/1]nat server protocol tcp global 202.38.1.1 www inside 10.110.1.1 www
[Gateway-GigabitEthernet0/1]nat server protocol tcp global 202.38.1.1 ftp inside 10.110.1.2 ftp
[Gateway-GigabitEthernet0/1]quit
[Gateway]interface g0/0
[Gateway-GigabitEthernet0/0]ip address 10.110.1.10 24
[Gateway-GigabitEthernet0/0]quit
// 注意dns-map 配置中对应的地址是公网地址而不是服务器的内网地址
[Gateway] nat dns-map domain www.server.com protocol tcp ip 202.38.1.2 port www
[Gateway] nat dns-map domain ftp.server.com protocol tcp ip 202.38.1.2 port ftp

方案二配置
<H3C>system-view
[H3C]sysname Gateway
[Gateway]acl number 3000
//编写acl 匹配来自内网网段目的地址为两台server的数据流
[Gateway-acl-adv-3000]rule permit ip source 10.110.1.0 0.0.0.255 destination 10.110.1.1 0
[Gateway-acl-adv-3000] rule permit ip source 10.110.1.0 0.0.0.255 destination 10.110.1.2 0
[Gateway]interface g0/0
[Gateway-GigabitEthernet0/0]ip address 10.110.1.10 24
//将nat及nat server 配置下发在内网网关口上
[Gateway-GigabitEthernet0/0]nat server protocol tcp global 202.38.1.1 www inside 10.110.1.1 www.luyouqiwang.com
[Gateway-GigabitEthernet0/0]nat server protocol tcp global 202.38.1.1 ftp inside 10.110.1.2 ftp
[Gateway-GigabitEthernet0/0]nat outbound 3000
[Gateway-GigabitEthernet0/0]quit
//其它基础配置略

四. 配置关键点

1．注意dns-map的配置中的ip地址应该配置公网出接口地址。
Nat server 的相关配置应该下发在公网出接口上。
2．在方案二中，nat server 及 nat outbound的配置应当配置在内网网关接口上。并且注意acl 规则中的目的地址应匹配服务器主机地址。
3. 在方案二中，可以使用 nat static 方式为私网server地址和公网地址间建立1对1转换。这一配置可以用来代替nat server 的相关配置。

产品随想 | 陪读《乔布斯传》：1-17章

乔布斯经典照片集坐在麗莎電腦旁。他說：「毕加索曾說：「好的藝術家懂得模仿，佛大的藝術家善於偷取。」因此，窃取偉大的點子沒有什麼好羞耻的。與蓋茲在電話中達成協議：「比爾，謝謝你支持蘋果。因為你的支持，世界將變得更美好。」 1997年蘋果在波士頓舉行的麥金塔世界大會，蓋茲透過衛星連線在巨大的螢幕上出現。質伯斯說：「我真是笨死了，竟然讓蓋兹以這種方式現身。他讓我看起來好沙小。」 ──时刻自省前言 The people who are crazy enough to think they can change the world are the ones who do. 只有那些瘋狂到以為自己可以改變世界的人，才能改變這個世界。這麼些年來，賈伯斯說起話來的認真與專注態度，著實打動不少人。我們一直保持連絡，即使在他被逐出蘋果之後，我們還有來往。每次他有新產品要推出時，像 NeXT 電腦或皮克斯 (Pixar）的電影，他就會來找我。他常帶我去曼哈頓下城一家壽司店用餐，講起他的產品，渾身散發出光和熱，眉飛色舞的說這是他登峰造極之作。我喜歡這個人。 ──对自己产品深深的爱他的堅持教我疑惑。人人都知道賈伯斯不道餘力捍衛隱私，而且我不知道他是否看過我寫的任何一本傳記。我還是不敢立刻答應，只說或許再等等。然而到了 2009年，我接到他太太蘿琳．鮑威爾打來的電話。她直截了當說：「如果你還想為史帝夫寫傳，最好趕快動筆。」這是他第二次因病向公司請長假。我坦言他早在2004 年得知自己罹患胰臟癌的時候就曾主動邀我寫傳，但我當時對他罹癌的事一無所知。蘿琳解釋說，他們盡量保密，因此當時根本沒幾個人知道。他是在動手術的前夕打電話給我的。 ──和Make Something Wonderful对照起来看他還說，自從他回到蘋果重新掌權，這十二年來是他創造新產品的高峰期，但他還有更重要的目標，也就是效法惠普的惠立和普克（David Packard），締造一家創新動力無限的公司，進而超越惠普。 ──苹果公司才是乔布斯最得意的产品他說：「我一直認為，自己是個偏向人文的孩子，但我也喜歡電子的東西。後來，我讀到寶麗來(Polaroid）創辦人蘭德 (Edwin Land）曾說過，一個人能站在人文和科學的交會口，兼容贯通，才是真正的人才。在那當下，我决定要當這樣的人。」他似乎在暗示我，這可以做為傳...

阅读全文

Steve Jobs at 44, By Michael Krantz, 1999

Differences and Similarities Between Apple and Pixar Apple turns out many products--a dozen a year; if you count all the minor ones, probably a hundred. Pixar is striving to turn out one a year. But the converse of that is that Pixar's products will still be used fifty years from now, whereas I don't think you'll be using any product Apple brings to market this year fifty years from now. Pixar is making art for the ages. Kids will be watching Toy Story in the future. And Apple is much more of a constant race to continually improve things and stay ahead of the competition. His Role At Pixar At Pixar my job is to help build the studio and recruit people and help create a situation where they can do the best work of their lives. And to some degree it's the same at Apple. But at Pixar, I don't direct the movies, whereas at Apple probably, if I had to pick a role out of a film production, I'd be the director. So it...

阅读全文

产品随想 | 周刊第85期：e-Residency与数字游民

David Shambaugh https://www.google.com/search?q=David+Shambaugh 中国问题研究专家，著作极多郭玉闪 https://zh.wikipedia.org/wiki/郭玉闪?useskin=vector 中国公共知识分子我只想好好观影 github.com/BetterWorld-Liuser/autoMovies 刘煜辉：中国资本市场灵魂出窍最有活力的公司几乎不在A股 https://finance.sina.com.cn/stock/marketresearch/2017-06-23/doc-ifyhmtek7705574.shtml 回看17年的专家讲话，还是挺有水平的，挺多都认可纽约文化沙龙 https://www.youtube.com/@user-cu2hl5tf6y/videos 视频质量出奇的高，推荐透视中国政治by吴国光、程晓农备忘下，貌似评价挺好的一本书 CAPI China Chair Wu Guoguang (吴国光 / 吳國光) https://www.youtube.com/playlist?list=PLIt1szHhnm_Hso3jGUbfGpnEAbsPOuEVV 因为热爱中国，我们越要看懂中国 AI Canon https://a16z.com/2023/05/25/ai-canon/ in this post, we’re sharing a curated list of resources we’ve relied on to get smarter about modern AI. We call it the “AI Canon” because these papers, blog posts, courses, and guides have had an outsized impact on the field over the past several years. 希望中国的投資機構，也能有更多的分享與輸出，提升整個社會的認知 Cantonese Font 粵語字體 https://visual-fonts.com/zh/...

阅读全文

巴菲特致股东信-1975年

笔记：华盛顿邮报已成为伯克希尔第一重仓股翻译：雪球：https://xueqiu.com/6217262310/131409324 备份：https://archive.ph/4hgK3 原文： To the Stockholders of Berkshire Hathaway Inc.: Last year, when discussing the prospects for 1975, we stated “the outlook for 1975 is not encouraging.” This forecast proved to be distressingly accurate. Our operating earnings for 1975 were $6,713,592, or $6.85 per share, producing a return on beginning shareholders ’ equity of 7.6%. This is the lowest return on equity experienced since 1967. Furthermore, as explained later in this letter, a large segment of these earnings resulted from Federal income tax refunds which will not be available to assist performance in 1976. On balance, however, current trends indicate a somewhat brighter 1976. Operations and prospects will be discussed in greater detail below, under specific industry titles. Our expectation is that significantly better results in textiles, earnings added from recent acquisitio...

阅读全文

Interview with Steve Jobs, WGBH, 1990

Interviewer: what is it about this machine? Why is this machine so interesting? Why has it been so influential? Jobs: Ah ahm, I'll give you my point of view on it. I remember reading a magazine article a long time ago ah when I was ah twelve years ago maybe, in I think it was Scientific American . I'm not sure. And the article ahm proposed to measure the efficiency of locomotion for ah lots of species on planet earth to see which species was the most efficient at getting from point A to point B. Ah and they measured the kilocalories that each one expended. So ah they ranked them all and I remember that ahm...ah the Condor, Condor was the most efficient at [CLEARS THROAT] getting from point A to point B. And humankind, the crown of creation came in with a rather unimpressive showing about a third of the way down...

阅读全文

产品随想 | 周刊第67期：静水铭室

Products Design Scenes #77 https://walling.app/TGE6qnCacxmwEV3d2lg2/design-scenes-77efbc88e4bbaeefbc89 非常不错的产品/设计周报静水铭室 https://liuliu.me/ 静水可铭，丰山须镂。 - Silent Water and Curved Mountain 不错的中英博客 Classic HCI Demos https://jackrusher.com/classic-ux/ A curated collection of HCI demo videos produced during the golden age from 1983-2002. 经典老演示Demo health-code-index https://github.com/ilovexjp/health-code-index 健康码模拟 - 索引 EnergyStar https://github.com/imbushuo/EnergyStar EnergyStar is a terrible* Windows application that leverages Windows EcoQoS API to throttle any inactive user process and background applications to improve system thermal and battery life, similar to the process management strategy on modern Apple macOS releases. 中共政治精英数据库 https://chinadatalab.ucsd.edu/elites/ Victor Shih/史宗瀚维护的一个履历库 Tribler https://github.com/Tribler/tribler Privacy enhanced BitTorrent client with P2P content discovery 在美国执法区会有帮助 nuclear https://github....

阅读全文

Steve Jobs: Rolling Stone’s 2003 Interview

When Steve Jobs cruises into the airy reception area on the Apple Computer campus in Cupertino, California, on a recent morning, nobody pays much attention to him, even though he’s the company’s CEO. He’s wearing shorts, a black T-shirt and running shoes. Tall and a little gawky, Jobs has a fast, loping walk, like a wolf in a hurry. These days Jobs seems eager to distance himself from his barefoot youth – who was that crazy kid who once called the computer “a bicycle for the mind”? – and driven to prove himself as a clear-thinking Silicon Valley capitalist. Jobs punches the elevator button to the fourth floor, where his small office is located. For a man who is as responsible as anyone for the wonder and chaos of Silicon Valley, Jobs’ view of it all is surprisingly modest: shrubby treetops extending out toward San Francisco Bay, the distant whoosh of the freeway below. There is nothing modest, however, about Apple’s recent accomplishments. In the past few months,...

阅读全文

SS机场常用服务器线路微普及

原文link：https://www.duyaoss.com/archives/57/ 为何写这么个帖子？更新时间：2019-11-29 由于机场用户增多，很多新用户压根不懂节点上面的名字代表什么，也不知道什么服务器比较适合自己，不懂什么是原生，等等。所以开一个小帖，稍微介绍一下比较常见的服务器，专业知识有限，所以只是给小白们介绍一下，其实我也很白，各位大佬见笑了。在这里尤其感谢 Sukka 苏卡卡大佬和喵酱指导，以及 Nexitally 佩奇提供的资料介绍，否则我真不知道从哪儿开始动笔。后面地区内容都是佩奇帮忙码出来的。时间有限，慢慢再继续填充和修整本文仅仅是抛砖引玉写一些机场主们告知我的 ISP、IDC 的体验，仅供参考。网络环境每天都在变化，今天飞快的服务器明天有可能龟速，有写的不对或者过时的地方还望大家指正。所以本文也算是一些机场主们把曾经踩过的坑分享给大家吧。（本来是想给小白写服务器介绍的，佩奇大佬写着写着就专业惯性的转到了商家哈哈哈，这是一个悲伤的故事）测速图 Telegram 频道： https://t.me/DuyaoSS 主用链接： DuyaoSS - 毒药机场简介博客常见名词： IPLC: "International Private Leased Circuit"的缩写，即“国际专线”。不过大部分机场通常看到的iplc，都只是阿里的经典网络，跨数据中心内网互通，阿里内网，并不是严格意义的iplc专线；当然也有其他渠道的，或真iplc，不过比较少。阿里云的内网互通底层原理是通过采购多个点对点的iplc专线，来连接各个数据中心，从而把各个数据中心纳入到自己的一套内网里面来。这样做有两个好处，其一是iplc链路上的带宽独享，完全不受公网波动影响，其二是过境的时候不需要经过GFW，确保了数据安全且不受外界各种因素干扰。但是需要注意一下阿里云的iplc也是有带宽上限的，如果过多的人同时挤到同一条专线上，峰值带宽超过专线的上限的话也同样会造成网络不稳定。其他渠道购买到的iplc价格很高，阿里云内网这种性价比超高这种好东西且用且珍惜。 IEPL国际以太网专线（International Ethernet Private Line,简称IEPL)，构建于MSTP设备平台上...

阅读全文

Linux私房菜-14章 Linux帐号管理

1.认识三个文件夹 '/etc/passwd' '/etc/shadow' '/etc/group' 2.Mac更改Terminal shell: chsh -s /bin/bash 3.权限更改的一种姿势: chmod u+x file user group others 4.一般帐号密码忘记：root身份passwd即可 root帐号密码忘记：重启进入用户维护模式再以 passwd命令更改密码，或Live CD开机挂载根目录再修改/etc/shadow,将root密码字段清空，重启后root将不再需要密码 5.有效用户组与初始用户组认识 groups命令查看当前登录用户支持的用户组

阅读全文

The Three Faces Of Steve Jobs, Brent Schlender, 1998 Fortune

(FORTUNE Magazine) – Well into the conversation with FORTUNE that you're about to read, Steve Jobs, the once and interim CEO of Apple Computer, professes to feel, at the wizened age of 43, no different from when he was a frisky 17-year-old. True to form, he contradicts himself a little later, confessing to be "an old man now." Those comments reveal as much about why Jobs has been able to pull off his prestidigital revival of Apple--his first and still greatest creation--as do his observations on his business strategies and actions of the past year. Here's why. Jobs is most effective as a businessman and leader when he invokes the pathos and gestalt of his generation. He is, after all, a child of the 1960s--you're still likely to find him barefoot in the office, and for breakfast he eats granola doused in apple juice. Yet Jobs is also a mature baby-boomer, with an impressive if offbeat store of business experience, plus the typical worries that go with...

阅读全文

产品随想的博客

搜索此博客