内网域名访问内网服务器（二）

下面是我对两个帖子的学习整理

第一个帖子

环境假设

内网服务器的私网地址为192.168.2.251，将服务器的80端口映射至202.101.1.1的80端口上，并申请域名www.sina.com，内网PC机的IP地址为192.168.2.2
在路由器外网口配置如下命令：
sys acl number 2000
rule permit source 192.168.2.0 0.0.0.255
quit
int g0/0
//外网口
ip address 202.101.1.1 255.255.255.0
nat server protocol tcp global 202.101.1.1 www indise 192.168.2.251 www
nat outbound 2000 quit

数据流程分析

一. 外网用户通过域名或者公网IP地址应该可以访问服务器

外网用户发起到202.101.1.1的TCP 80端口的连接，IP报头结构如下：源IP：外网用户的公网IP，目的IP：202.101.1.1
数据经过路由，到企业边源路由器，由于外网口上有端口映射，则数据会匹配映射，将IP报头结构改变成：源IP：外网用户的公网IP，目的IP：192.168.2.251
数据经过内网路由，交到服务器，服务器回应用户数据，IP报头结构如下：源IP：192.168.2.251，目的IP：外网用户的IP
数据经过边界路由器出公司，由于NAT Server的优先级高于NAT Outbound，所以，数据到达路由器后会先匹配NAT Server记录的会话表项，将IP报头转换成：源IP：202.101.1.1，目的IP：外网用户的公网IP
数据最终通过公网路由到达访问用户，数据访问成功

二. 内网用户通过域名是不能访问服务器的

内网用户发起DNS请求，域名解地址为202.101.1.1，客户机发出请求，IP报头结构如下：源IP：192.168.2.2，目的IP：202.101.1.1
数据到达路由器后，由于路由器上有202.101.1.1的直连路由，数据直接交到外网口，由于外网口配置有NAT Server，目的IP被转换后发到服务器，IP报头结构如下：源IP：192.168.2.2，目的IP：192.168.2.251
服务器收到数据后，发现源IP就是一个本地IP地址，此时服务器就不会以202.101.1.1为ip回复，而是以192.168.2.251为源地址回复。此时的IP数据包结构为：源IP：192.168.2.251，目的IP：192.168.2.2
数据将到客户机后，客户机认为，自己请求的是202.101.1.1的数据，但是收到的是192.168.2.2发送的，则认为这个数据不是自己要的，此时会丢弃掉该数据，从而引起TCP等待超时，导致无法访问

三.未解决问题，可在内网口设置

acl number 3000
rule permit ip source 192.168.2.0 0.0.0.255 destination 192.168.2.251
quit
int g0/1
//内网口 nat outbound 3000
nat server protocol tcp global 202.101.1.1 www inside 192.168.2.251 www
quit

四.再在内网域名访问服务器，查看数据流程

内网用户发起DNS请求，域名解析为202.101.1.1地址，客户机发出请求，IP报头结构如下：源IP：192.168.2.2，目的IP：202.101.1.1
数据交到路由器的内网口，首先匹配端口映射，将目的IP更换掉，此时IP报头结构如下：源IP：192.168.2.2，目的IP：192.168.2.251
路由器发现该数据为内网数据，会再从内网口发出去，此时再匹配nat outbound，将源IP换掉，此时IP报头结构为：源IP：192.168.2.1，目的IP：192.168.2.251
服务器收到数据后响应请求，回复数据包IP报头结构为：源IP：192.168.2.251，目的IP：192.168.2.1
数据到达路由器后，根据NAT Outbound和NAT Server的记录表项，将源IP和目的IP替换掉，此时IP报头结构为：源IP：202.101.1.1，目的IP为192.168.2.2
数据到达客户，目的IP和源IP正确，访问成功

五.如果有一个假设

现在我们假设没有
nat server protocol tcp global 202.101.1.1 www inside 192.168.2.251 www,
来看一下数据报文是否能完整地走完：(目前MSR路由器上的端口映射配置全局有效，不需要再在内网口配置该命令了。)

内网用户发起DNS请求，域名解析为202.101.1.1地址，客户机发出请求，IP报头结构如下：源IP：192.168.2.2，目的IP：202.101.1.1
数据将到路由器，由于外网口上有端口映射，则数据会匹配映射，将IP报文结构改变成：源IP：192.168.2.2，目的IP：192.168.2.251
数据将到路由器内网口，匹配nat outbound,将源IP地址变掉，IP报文结构改变成：源IP：192.168.2.1，目的IP：192.168.2.251
数据交至服务器，服务器回复报文，IP报头为：源IP：192.168.2.251，目的IP：192.168.2.1
路由器收到后，匹配内网口NAT Outbound的记录表项，将其IP报头改为：源IP：192.168.2.251，目的IP：192.168.2.2
数据直接交给客户机，客户机依然认为不是自己请求的数据，丢弃，继续等待，超时，失败

第二个帖子

Add caption

最后的最后，我是这样解决自己路由器问题的，登录官网，发现自己路由器貌似不支持端口回流，然后在线咨询客服，得知在NAPT上添加一条规则即可，作用接口是LAN口

《逢いたくていま》──仁医主题曲

原始链接：听歌学日语 | 唱哭很多人的《逢いたくていま》あいたくていま - MISIA 现在好想见你- MISIA 初はじめて出会であった日ひのこと覚おぼえてますか第一次相遇的那天你是不是还记得呢? 過すぎ行ゆく日ひの思おもい出でを忘わすれずにいて那些过去日子的回忆我一直没有有忘记あなたが見みつめた全すべてを感かんじていたくて凝视着你这一切的全部我都想要感觉空そらを見上みあげた抬头仰望天空今いまはそこで私わたしを見守みまもっているの? 你到现在是否还在那里守护着我？教おしえて… 请你告诉我今いま逢あいたいあなたに现在好想见你伝つたえたい事ことがたくさんある有好多想要告訴你的事情ねえ逢あいたい逢あいたい呐好想见你好想见你気きづけば面影おもかげ探さがして悲かなしくて如果能注意到的话你的面容是在寻找着还是悲伤着どこにいるの? 抱だきしめてよ到底在哪里呢? 好想抱紧你私わたしはここにいるよずっと我会一直在这里一直等你もう二度にどと逢あえないことを知しっていたなら如果能早点知道已经再也无法相见繋つないだ手てをいつまでも離はなさずにいた我会牵在一起的手永远都不会放开『ここにいて』とそう素直すなおに泣ないていたなら如果当初诚实哭泣地告诉你『留在我身边』的话今いまもあなたは変かわらぬまま现在的你是否也依然不变地私わたしの隣となりで ...

阅读全文

Interview with Steve Jobs, WGBH, 1990

Interviewer: what is it about this machine? Why is this machine so interesting? Why has it been so influential? Jobs: Ah ahm, I'll give you my point of view on it. I remember reading a magazine article a long time ago ah when I was ah twelve years ago maybe, in I think it was Scientific American . I'm not sure. And the article ahm proposed to measure the efficiency of locomotion for ah lots of species on planet earth to see which species was the most efficient at getting from point A to point B. Ah and they measured the kilocalories that each one expended. So ah they ranked them all and I remember that ahm...ah the Condor, Condor was the most efficient at [CLEARS THROAT] getting from point A to point B. And humankind, the crown of creation came in with a rather unimpressive showing about a third of the way down...

阅读全文

犀流研习班第十期001-2讲听课笔记

一. 杂谈 1. Max 逼真的效果图和视频 2. SU 显示模式，费力可以作出好看的效果图 3. Maya 支持Nurbs,但不快捷，对CAD导出也不方便

阅读全文

产品随想 | 周刊第69期：Do not go gentle into that good night

Products Windows Apps That Amaze Us https://amazing-apps.gitbook.io/windows-apps-that-amaze-us/ 令人精细的Windows App 文物出版社 https://book.douban.com/press/2456/ 这是一个宝藏出版社，出品书籍质量非常高，大开眼界 blind https://www.teamblind.com/ 老外的匿名职场社交工具，挺有意思，看看硅谷的meme 中国科学技术大学测速网站 https://test.ustc.edu.cn/ 看着还不错，挺靠谱的底层代码是LibreSpeed https://github.com/librespeed/speedtest 能不能好好说话？ https://github.com/itorr/nbnhhsh 也是我的一个痛点 Tree Style Tab (aka TST) https://github.com/piroor/treestyletab 一个超强的浏览器扩展插件，树状呈现浏览器标签 Failory Pitch Decks https://www.failory.com/pitch-deck 超级多的融资计划投资板，Pitch Book AutoCut https://github.com/mli/autocut 用文本编辑器剪视频全网漫游指南 https://tagly.notion.site/tagly/a333efd8c3e54e12b123acd541e8d3e6 数字时代的指引，希望他们成功 IT eBooks https://it-ebooks.info/ IT书籍下载 ToastFish https://github.com/Uahh/ToastFish 一个利用摸鱼时间背单词的软件。利用Win10通知栏，出现、背单词 Ideas 沈向洋：IDEA 如何找到创新的「甜区」 https://mp.weixin.qq.com/s/OlI5VUxQKU_ijWZClQCG0Q AIGC How Did Nor...

阅读全文

产品随想 | 周刊第115期：2024.5.16 Great libraries build communities

Loop https://github.com/MrKai77/Loop Loop is a macOS app that simplifies window management for you! 我的电视 my-tv https://github.com/lizongying/my-tv 我的电视电视直播软件，安装即可使用 When we think about this technology, we need to put human dignity, human well-being—human jobs—in the center of consideration. ————Fei-Fei Li Author Talks: Dr. Fei-Fei Li sees ‘worlds’ of possibilities in a multidisciplinary approach to AI https://www.mckinsey.com/featured-insights/mckinsey-on-books/author-talks-dr-fei-fei-li-sees-worlds-of-possibilities-in-a-multidisciplinary-approach-to-ai Randy Ubillos https://apple.fandom.com/wiki/Randy_Ubillos Randall Hayes "Randy" Ubillos is the original software engineer behind Adobe Premiere and Final Cut Pro. 影响全球视频制作的男人， Reminders MenuBar https://github.com/DamascenoRafael/reminders-menubar Simple macOS menu bar application to view and interact with reminders. Developed with SwiftUI and using Apple Reminders as a source. Bad libraries build colle...

阅读全文

产品爱好者周刊第36期：走进Linux

Products OpenShot https://github.com/OpenShot/openshot-qt OpenShot Video Editor is an award-winning free and open-source video editor for Linux, Mac, and Windows 开源的视频剪辑工具，跨平台 Run https://github.com/The-Run-Philosophy-Organization/run 润学全球官方指定GITHUB，整理润学宗旨、纲领、理论和各类润之实例 Dozer https://github.com/Mortennn/Dozer Hide menu bar icons on macOS ThisIsWin11 https://github.com/builtbybel/ThisIsWin11 Win11的隐私保护 RoundedTB https://github.com/torchgm/RoundedTB Add margins, rounded corners and segments to your taskbars! Droptop Four https://github.com/Droptop-Four/Basic-Version Droptop Four is the fourth iteration of the popular dropdown app launcher for Windows & Rainmeter. LibreTube https://github.com/Libre-tube/LibreTube An alternative frontend for YouTube, for Android. nheko https://github.com/Nheko-Reborn/nheko Quaternion https://github.com/quotient-im/Quaternion 多平台的Matrix客户端 FluffyChat https://fluffychat.im/ Phone端的Matrix...

阅读全文

Apple's One-Dollar-a-Year Man, By Steve Jobs, 2000

(FORTUNE Magazine) – Now that Steve Jobs has showed his hand on Apple's Internet and system software strategies and dropped the "interim" from his title, other questions loom. He's always denied it, but isn't it true that his old company, Next, did wind up taking over Apple? Will there ever be an encore to the 15-year-old Macintosh? Short of that, does Apple have any plans to jump into the "Internet appliance" fray? Will Apple ever build computers for business people again? And what, pray tell, does Steve think of all these young Internet zillionaires? Let's ask. Practically every technology that your old company, Next, possessed when Apple acquired it in 1997 is now being used by Apple in some strategic way. This must seem like sweet vindication. The thing about Next was that we produced something that was truly brilliant for an audience that our heart really wasn't into selling to--namely, the enterprise. I suppose if you were wr...

阅读全文

产品随想 | 周刊第43期：历史上的今天

Products Huberman Lab https://hubermanlab.com/ 一款聚焦于健康的播客今日热榜 https://tophub.today/ 聚合展示，国内各热门榜单，对跟进热点非常有帮助，热点运营的好帮手 SketchyBar https://github.com/FelixKratz/SketchyBar A highly customizable macOS status bar replacement Mac菜单栏定制自定义程度很高，看作者展示的案例，暂时没想出这样的好处（不过应用本身的编辑，确实也没啥意义）生命在于折腾吧！ Thanks-Mirror https://github.com/eryajf/Thanks-Mirror 整理记录各个包管理器，系统镜像，以及常用软件的好用镜像，Thanks Mirror。 Musicn https://github.com/zonemeen/musicn 一个下载高品质音乐的命令行工具，音乐来源: 咪咕 Planet Minecraft A creative Minecraft community fansite sharing maps, minecraft skins, resource packs, servers, mods, and more. 里面有很多动人的故事可能是世界上最大的Minecraft社区，从2010年至今 The Uncensored Library https://www.uncensoredlibrary.com/en blockworks https://www.blockworks.uk/ "Distinctive maps for Minecraft that have educated players and risen to the level of art" 游戏也可以让人有更高的实现，而不仅仅是沉迷其中，国外游戏厂商比我们做的好太多 Minecraft_Memory_Bypass_GUI https://github.com/xingchuanzhen/Minecraft_Memory_Bypass_GUI 绕过Minecraft...

阅读全文

Steve Jobs: `There's Sanity Returning', 1998

Nobody can doubt the charisma of Steven P. Jobs. The interim CEO of Apple Computer Inc., who returned to the company last July after his ignominious 1985 ouster, has brought back his legendary vision, impatience, and infectious passion for the Macintosh. Jobs spoke to Business Week Correspondent Andy Reinhardt in Apple's stark, fourth-floor boardroom, just after the company rolled out its new software strategy on May 11. Note: This is an extended, online-only version of the Q&A that appears in the May 25, 1998, issue of Business Week. Q: Now that you've introduced the new, bold-looking iMac, are you going to do some radically different products? A: There's a lot of talk about such things -- about handhelds, set-top boxes. A lot of computer companies have been searching for a consumer product. My view is that the personal computer has been the most successful consumer product of the last 10 years. What we have to do, what the industry stopp...

阅读全文

有关密码学 Cryptography

% Crypto 101 % CUI Hao 密码学 Cryptography 加密：军事、商业保密、身份认证、日记... 计算机出现前：加密人类语言文字。计算机出现后：加密比特流（ASCII文本、网络协议）古典替换式密码凯撒密码文本中每个字母在字母表上后移 k 个位置。 ATTACK -> DWWDFN (k=3) IBM -> HAL (k=-1) 改进重新排列字母表（单字母替换）： alphabet: ABCDEFGHIJKLMNOPQRSTUVWXYZ map to: RCPWUXNQBZFMYTLIEGVDJOAKHS example: ATTACK -> RDDRPF "密码组合"有 26! 种之多。维吉尼亚密码每k个字母一组，与长度k的密码做加法： ATTACKATDAWN (plaintext) + LEMONLEMONLE (key: LEMON) = LXFOPVEFRNHR (ciphertext) 多个字母的凯撒密码。替换式密码 substitution cipher 单字母替换/多字母替换/密码本... 加密算法：映射密码：描述映射关系解密算法：反过来映射另一种设计方案也许是中国人发明的吧：群书万卷常暗诵，主人顾盼千金重。药物楚老渔商市，丸剑跳踯霜雪浮。移位式密码 ( transposition cipher ) 列移位密码按密码重新排列文本各列，然后竖着读出来： KEY: 6 3 2 4 1 5 TEXT: W E A R E D CT: I S C O V E ==> EVLNEACDTKESEAQROFOJDEECUWIREE R E D F L E E A T O N C E Q K J E U (WE ARE DISCOVERED. FLEE AT ONCE) ...

阅读全文

产品随想的博客

搜索此博客