跳至主要内容

内网域名访问内网服务器（二）


将碰到的好帖子做一个集合
NAT分析（内网用户通过域名访问服务器）
下面是我对两个帖子的学习整理

第一个帖子

环境假设

内网服务器的私网地址为192.168.2.251，将服务器的80端口映射至202.101.1.1的80端口上，并申请域名www.sina.com，内网PC机的IP地址为192.168.2.2
在路由器外网口配置如下命令： 
 sys acl number 2000 
 rule permit source 192.168.2.0 0.0.0.255 
 quit 
 int g0/0
//外网口 
 ip address 202.101.1.1 255.255.255.0 
 nat server protocol tcp global 202.101.1.1 www indise 192.168.2.251 www 
 nat outbound 2000 quit

数据流程分析

一. 外网用户通过域名或者公网IP地址应该可以访问服务器

  1. 外网用户发起到202.101.1.1的TCP 80端口的连接，IP报头结构如下：源IP：外网用户的公网IP，目的IP：202.101.1.1
  2. 数据经过路由，到企业边源路由器，由于外网口上有端口映射，则数据会匹配映射，将IP报头结构改变成：源IP：外网用户的公网IP，目的IP：192.168.2.251
  3. 数据经过内网路由，交到服务器，服务器回应用户数据，IP报头结构如下：源IP：192.168.2.251，目的IP：外网用户的IP
  4. 数据经过边界路由器出公司，由于NAT Server的优先级高于NAT Outbound，所以，数据到达路由器后会先匹配NAT Server记录的会话表项，将IP报头转换成：源IP：202.101.1.1，目的IP：外网用户的公网IP
  5. 数据最终通过公网路由到达访问用户，数据访问成功

二. 内网用户通过域名是不能访问服务器的

  1. 内网用户发起DNS请求，域名解地址为202.101.1.1，客户机发出请求，IP报头结构如下：源IP：192.168.2.2，目的IP：202.101.1.1
  2. 数据到达路由器后，由于路由器上有202.101.1.1的直连路由，数据直接交到外网口，由于外网口配置有NAT Server，目的IP被转换后发到服务器，IP报头结构如下：源IP：192.168.2.2，目的IP：192.168.2.251
  3. 服务器收到数据后，发现源IP就是一个本地IP地址，此时服务器就不会以202.101.1.1为ip回复，而是以192.168.2.251为源地址回复。此时的IP数据包结构为：源IP：192.168.2.251，目的IP：192.168.2.2
  4. 数据将到客户机后，客户机认为，自己请求的是202.101.1.1的数据，但是收到的是192.168.2.2发送的，则认为这个数据不是自己要的，此时会丢弃掉该数据，从而引起TCP等待超时，导致无法访问

三.未解决问题，可在内网口设置

  1. acl number 3000
  2. rule permit ip source 192.168.2.0 0.0.0.255 destination 192.168.2.251
  3. quit
  4. int g0/1
  5. //内网口   nat outbound 3000
  6. nat server protocol tcp global 202.101.1.1 www inside 192.168.2.251 www
  7. quit

四.再在内网域名访问服务器，查看数据流程

  1. 内网用户发起DNS请求，域名解析为202.101.1.1地址，客户机发出请求，IP报头结构如下：源IP：192.168.2.2，目的IP：202.101.1.1
  2. 数据交到路由器的内网口，首先匹配端口映射，将目的IP更换掉，此时IP报头结构如下：源IP：192.168.2.2，目的IP：192.168.2.251
  3. 路由器发现该数据为内网数据，会再从内网口发出去，此时再匹配nat outbound，将源IP换掉，此时IP报头结构为：源IP：192.168.2.1，目的IP：192.168.2.251
  4. 服务器收到数据后响应请求，回复数据包IP报头结构为：源IP：192.168.2.251，目的IP：192.168.2.1
  5. 数据到达路由器后，根据NAT Outbound和NAT Server的记录表项，将源IP和目的IP替换掉，此时IP报头结构为：源IP：202.101.1.1，目的IP为192.168.2.2
  6. 数据到达客户，目的IP和源IP正确，访问成功

五.如果有一个假设

现在我们假设没有
nat server protocol tcp global 202.101.1.1 www inside 192.168.2.251 www,
来看一下数据报文是否能完整地走完：(目前MSR路由器上的端口映射配置全局有效，不需要再在内网口配置该命令了。)
  1. 内网用户发起DNS请求，域名解析为202.101.1.1地址，客户机发出请求，IP报头结构如下：源IP：192.168.2.2，目的IP：202.101.1.1
  2. 数据将到路由器，由于外网口上有端口映射，则数据会匹配映射，将IP报文结构改变成： 源IP：192.168.2.2，目的IP：192.168.2.251
  3. 数据将到路由器内网口，匹配nat outbound,将源IP地址变掉，IP报文结构改变成：源IP：192.168.2.1，目的IP：192.168.2.251
  4. 数据交至服务器，服务器回复报文，IP报头为：源IP：192.168.2.251，目的IP：192.168.2.1
  5. 路由器收到后，匹配内网口NAT Outbound的记录表项，将其IP报头改为：源IP：192.168.2.251，目的IP：192.168.2.2
  6. 数据直接交给客户机，客户机依然认为不是自己请求的数据，丢弃，继续等待，超时，失败

第二个帖子

Add caption
最后的最后，我是这样解决自己路由器问题的，登录官网，发现自己路由器貌似不支持端口回流，然后在线咨询客服，得知在NAPT上添加一条规则即可，作用接口是LAN口





标签：

Popular posts from 产品随想的博客

Interview at the All Things Digital D5 Conference, Steve and Bill Gates spoke with journalists Kara Swisher and Walt Mossberg onstage in May 2007.

Kara Swisher: The first question I was interested in asking is what you think each has contributed to the computer and technology industry— starting with you, Steve, for Bill, and vice versa. Steve Jobs: Well, Bill built the first software company in the industry. And I think he built the first software company before anybody really in our industry knew what a software company was, except for these guys. And that was huge. That was really huge. And the business model that they ended up pursuing turned out to be the one that worked really well for the industry. I think the biggest thing was, Bill was really focused on software before almost anybody else had a clue that it was really the software that— KS: Was important? SJ: That’s what I see. I mean, a lot of other things you could say, but that’s the high-order bit. And I think building a company’s really hard, and it requires your greatest persuasive abilities to hire the best ...
阅读全文

Commencement Address at Stanford University--“Stay hungry. Stay foolish.”

I am honored to be with you today for your commencement from one of the finest universities in the world. Truth be told— I never graduated from college. This is the closest I’ve ever gotten to a college graduation. Today I want to tell you three stories from my life. That’s it. No big deal. Just three stories. The first story is about connecting the dots. I dropped out of Reed College after the first six months but then stayed around as a drop-in for another eighteen months or so before I really quit. So why did I drop out? It started before I was born. My biological mother was a young, unwed graduate student, and she decided to put me up for adoption. She felt very strongly that I should be adopted by college graduates, so everything was all set for me to be adopted at birth by a lawyer and his wife. Except that when I popped out they decided at the last minute that they really wanted a girl. So my parents, who were on a waiting...
阅读全文

产品随想 | 周刊 第43期：历史上的今天

Products Huberman Lab   https://hubermanlab.com/ 一款聚焦于健康的播客 今日热榜   https://tophub.today/ 聚合展示，国内各热门榜单，对跟进热点非常有帮助，热点运营的好帮手 SketchyBar   https://github.com/FelixKratz/SketchyBar A highly customizable macOS status bar replacement Mac菜单栏定制 自定义程度很高，看作者展示的案例，暂时没想出这样的好处（不过应用本身的编辑，确实也没啥意义）生命在于折腾吧！ Thanks-Mirror   https://github.com/eryajf/Thanks-Mirror 整理记录各个包管理器，系统镜像，以及常用软件的好用镜像，Thanks Mirror。 Musicn   https://github.com/zonemeen/musicn 一个下载高品质音乐的命令行工具，音乐来源: 咪咕 Planet Minecraft A creative Minecraft community fansite sharing maps, minecraft skins, resource packs, servers, mods, and more. 里面有很多动人的故事 可能是世界上最大的Minecraft社区，从2010年至今 The Uncensored Library   https://www.uncensoredlibrary.com/en blockworks   https://www.blockworks.uk/ "Distinctive maps for Minecraft that have educated players and risen to the level of art" 游戏也可以让人有更高的实现，而不仅仅是沉迷其中，国外游戏厂商比我们做的好太多 Minecraft_Memory_Bypass_GUI   https://github.com/xingchuanzhen/Minecraft_Memory_Bypass_GUI 绕过Minecraft...
阅读全文

巴菲特致股东信-1976年

 笔记： 为什么选择轻资产行业：当竞争疯狂时，不会强迫加入降价大战 最终选择了费雪的思想，选择能理解的优秀企业，以合理的价格买入并长期拥有 翻译： 雪球：https://xueqiu.com/6217262310/131440258 备份：https://archive.ph/XLK0S 原文： To the Stockholders of Berkshire Hathaway Inc, After two dismal years, operating results in 1976 improved significantly. Last year we said the degree of progress in insurance underwriting would determine whether our gain in earnings would be "moderate" or "major." As it turned out, earnings exceeded even the high end of our expectations. In large part, this was due to the outstanding efforts of Phil Liesche's managerial group at National Indemnity Company. In dollar terms, operating earnings came to $16,073,000, or $16.47 per share. While this is a record figure, we consider return on shareholders' equity to be a much more significant yardstick of economic performance. Here our result was 17.3%, moderately above our long-term average and even further above the average o...
阅读全文

巴菲特致股东信-1973年

 笔记： 在上一年度预测的今年竞争加剧导致利润下滑，真的发生了 翻译Link： 雪球：https://xueqiu.com/6217262310/131257618 备份：https://archive.ph/KIfdT 原文： To the Stockholders of Berkshire Hathaway Inc.: Our financial results for 1973 were satisfactory, with operating earnings of $11,930,592, producing a return of 17.4% on beginning stockholders' equity. Although operating earnings improved from $11.43 to $12.18 per share, earnings on equity decreased from the 19.8% of 1972. This decline occurred because the gain in earnings was not commensurate with the increase in shareholders' investment. We had forecast in last year's report that such a decline was likely. Unfortunately, our forecast proved to be correct. Our textile, banking, and most insurance operations had good years, but certain segments of the insurance business turned in poor results. Overall, our insurance business continues to be a most attractive area in which to employ capital. Management'...
阅读全文

巴菲特致股东信-1975年

 笔记： 华盛顿邮报已成为伯克希尔第一重仓股 翻译： 雪球：https://xueqiu.com/6217262310/131409324 备份：https://archive.ph/4hgK3 原文： To the Stockholders of Berkshire Hathaway Inc.: Last year, when discussing the prospects for 1975, we stated “the outlook for 1975 is not encouraging.” This forecast proved to be distressingly accurate. Our operating earnings for 1975 were $6,713,592, or $6.85 per share, producing a return on beginning shareholders ’ equity of 7.6%. This is the lowest return on equity experienced since 1967. Furthermore, as explained later in this letter, a large segment of these earnings resulted from Federal income tax refunds which will not be available to assist performance in 1976. On balance, however, current trends indicate a somewhat brighter 1976. Operations and prospects will be discussed in greater detail below, under specific industry titles. Our expectation is that significantly better results in textiles, earnings added from recent acquisitio...
阅读全文

Steve Jobs introduced the iPhone on January 9, 2007.

This is a day I’ve been looking forward to for two and a half years. Link Every once in a while, a revolutionary product comes along that changes everything. And Apple has been— well, first of all, one’s very fortunate if you get to work on just one of these in your career. Apple’s been very fortunate. It’s been able to introduce a few of these into the world. In 1984, we introduced the Macintosh. It didn’t just change Apple, it changed the whole computer industry. In 2001, we introduced the first iPod, and it didn’t just change the way we all listen to music, it changed the entire music industry. Well, today, we’re introducing three revolutionary products of this class. The first one is a widescreen iPod with touch controls. The second is a revolutionary mobile phone. And the third is a breakthrough internet communications device. So, three things: a widescreen iPod with touch controls; a revolutionary mobile phone; and a breakthrough internet communicat...
阅读全文

产品随想 | 周刊 第90期：史家之绝唱，无韵之离骚

Why AI Will Save the World   https://a16z.com/2023/06/06/ai-will-save-the-world/ Marc Andreessen的雄文，十分有說服力，邏輯清晰 辯證了現今AI監管拋出的5個可能的AI問題 讀的過程中，腦海裏浮現的都是編程隨想那篇文章 为什么马克思是错的？——全面批判马列主义的知名著作导读   https://program-think.blogspot.com/2018/09/Book-Review-The-Errors-of-Marxism-Leninism.html 兩者的思維鏈條、敘事方式，非常相似 人民聖殿教   https://zh.wikipedia.org/zh-hk/人民圣殿教?useskin=vector 瓊斯自稱是神的化身，幾千年前轉世為釋迦牟尼，創建了佛教；後來又轉世為耶穌基督，創建了基督教；之後短期化身轉世為巴孛，建立巴哈伊信仰；最後轉世為列寧，將社會主義發揚光大。 邪教徒聲稱自己轉世成了列寧，這說明了什麼？ Apple Vision   https://stratechery.com/2023/apple-vision Omnivore   https://github.com/omnivore-app/omnivore Omnivore is a complete, open source read-it-later solution for people who like reading. How the YouTube Algorithm Works in 2023: The Complete Guide   https://blog.hootsuite.com/how-the-youtube-algorithm-works/#A_brief_history_of_the_YouTube_algorithm 外人眼中的YouTube推薦算法變遷 Histography   https://histography.io/ “Histography" is interactive timeline that spans across 14 billion years of history, f...
阅读全文

巴菲特致股东信-1974年

 笔记： 价格战企业的逻辑：需要降价获取销量--->需要降低成本--->怎么降？扩大规模以摊低成本--->提高固定资产投入--->净资产回报率会降低 翻译： 雪球：https://xueqiu.com/6217262310/131257947 备份：https://archive.ph/5CEP6 原文： To the Stockholders of Berkshire Hathaway Inc.: Operating results for 1974 overall were unsatisfactory due to the poor performance of our insurance business. In last year's annual report some decline in profitability was predicted but the extent of this decline, which accelerated during the year, was a surprise. Operating earnings for 1974 were $8,383,576, or $8.56 per share, for a return on beginning shareholders' equity of 10.3%. This is the lowest return on equity realized since 1970. Our textile division and our bank both performed very well, turning in improved results against the already good figures of 1973. However, insurance underwriting, which has been mentioned in the last several annual reports as running at levels of unsustainable profitability, turned dramatically worse...
阅读全文

Interview with Steve Jobs, WGBH, 1990

Interviewer: what is it about this machine? Why is this machine so interesting? Why has it been so influential? Jobs: Ah ahm, I'll give you my point of view on it. I remember reading a magazine article a long time ago ah when I was ah twelve years ago maybe, in I think it was Scientific American . I'm not sure. And the article ahm proposed to measure the efficiency of locomotion for ah lots of species on planet earth to see which species was the most efficient at getting from point A to point B. Ah and they measured the kilocalories that each one expended. So ah they ranked them all and I remember that ahm...ah the Condor, Condor was the most efficient at [CLEARS THROAT] getting from point A to point B. And humankind, the crown of creation came in with a rather unimpressive showing about a third of the way down...
阅读全文