侧边栏壁纸
博主头像
华灯上 博主等级

行动起来,活在当下

  • 累计撰写 176 篇文章
  • 累计创建 24 个标签
  • 累计收到 3 条评论

目 录CONTENT

文章目录

【frp】搭建自己的内网穿透服务 - 适用无公网 ip 的web 服务器以及 NAS

华灯
2024-04-16 / 0 评论 / 0 点赞 / 22 阅读 / 0 字

**作为折腾党,我们怎么能开云服务器呢?我们要用家里有限的资源,**搞出一个机房。像什么花生壳啊,nat123 啊,那速度可是真的不敢恭维,chinaz 去 ping 一下红的橙的黄的一大片,打开网页的速度可想而知,站长看着看着就哭了。那么怎么办呢?大概已经有兄弟有所耳闻,Github 上有一个 Demo,叫 Frp,它能够在具有公网 IP 地址的服务器上,将 NAT 或防火墙后面的任何 tcp 或 udp 服务暴露给互联网,无论有没有公网 ip,能上网就行。通俗来讲,就是找一台有公网 ip 的服务器,然后跟你家里的服务器或者 NAT 建立连接,让这个有公网 ip 的服务器转发用户对内网服务器的请求。相当于给内网服务器一个 ip。

看到这里,又会有兄弟说了,喔,那照样是要买一台云服务器咯,我不干这活!其实呐,我个人理解,买一台超低配,大带宽的服务器就行了,LAMP 或 LNMP 都根本不用装,就用来跑 Frp,1H1G 相信也不会特别贵吧。我们只需要云服务器的带宽和公网 ip,其他一概不需要。如果你的域名备了案,直接去腾讯云秒杀一台服务器完了,一年三十多块钱 (不是广告),要是没有备案,就买一台香港的云服务器可以了,也不会很贵的,这就交给大家自由抉择了

东扯西扯又扯了这么多,赶紧开始正文

正文开始

1. 下载服务端 Frp 源码

github 上有的下,而且是最新版,我用的是 0.33 版本的,没换过

我也可以提供我现在用的 frp 压缩包:

上传到服务端 (也就是有公网 ip 的云服务器), 解压

2.Frp 服务端配置

修改 frps.ini (记住,是 frps.ini,别搞混了)

先删除里面所有内容:

#往里填

[common]
bind_port = 7000
vhost_http_port = 8080 //这是内网穿透对外端口,可以自己修改

#仪表盘配置
dashboard_port = 7500//端口可以修改
dashboard_user = admin//用户名和密码可以自己修改
dashboard_pwd = admin
“bind_port”表示用于客户端和服务端连接的端口,这个端口号我们之后在配置客户端的时候要用到。
“dashboard_port”是服务端仪表板的端口,若使用7500端口,在配置完成服务启动后可以通过浏览器访问 x.x.x.x:7500 (其中x.x.x.x为VPS的IP)查看frp服务运行信息。
“token”是用于客户端和服务端连接的口令,请自行设置并记录,稍后会用到。
“dashboard_user”和“dashboard_pwd”表示打开仪表板页面登录的用户名和密码,自行设置即可。
“vhost_http_port”和“vhost_https_port”用于反向代理HTTP主机时使用

img

防火墙放行端口:

img

进入 frp 文件目录,启动 frp 服务:

setsid ./frps -c ./frps.ini

img

看到 success 了吗,你应该懂得~

我们访问一下 frp 控制面板,刚刚没有启用的大佬可以跳过

浏览器访问 ip + 端口 (默认 7500), 输入用户名和密码

img

可以随便看看,到时候你创建了穿透服务后,就可以在控制面板统一管理了

img

3. 下载客户端 Frp 源码

版本要对应啊!要是用了 0.33 的大佬,就接着下载吧

上传到客户端 (也就是没有公网 ip 的云服务器), 解压

4.Frp 客户端配置

修改 frpc.ini (记住,是 frpc.ini,别搞混了)

先删除里面所有内容:

#往里填

[common]
server_addr = your_公网ip
server_port = 7000

vhost_http_port = 8080//要跟服务端端口一样
“server_addr”为服务端IP地址,填入即可。
“server_port”为服务器端口,填入你设置的端口号即可,如果未改变就是7000
“token”是你在服务器上设置的连接口令,原样填入即可。

防火墙放行对应端口

进入 frp 文件目录,启动 frp 服务:

setsid ./frpc -c ./frpc.ini

img

图示成功穿透

完整配置文件示例,按需使用(大佬可以仔细研究,具体穿透教程拉下)

#frps

# [common] is integral section
[common]
# A literal address or host name for IPv6 must be enclosed
# in square brackets, as in "[::1]:80", "[ipv6-host]:http" or "[ipv6-host%zone]:80"
bind_addr = 0.0.0.0
bind_port = 7000

# udp port to help make udp hole to penetrate nat
bind_udp_port = 7001

# udp port used for kcp protocol, it can be same with 'bind_port'
# if not set, kcp is disabled in frps
kcp_bind_port = 7000

# specify which address proxy will listen for, default value is same with bind_addr
# proxy_bind_addr = 127.0.0.1

# if you want to support virtual host, you must set the http port for listening (optional)
# Note: http port and https port can be same with bind_port
vhost_http_port = 80
vhost_https_port = 443

# response header timeout(seconds) for vhost http server, default is 60s
# vhost_http_timeout = 60

# TcpMuxHttpConnectPort specifies the port that the server listens for TCP
# HTTP CONNECT requests. If the value is 0, the server will not multiplex TCP
# requests on one single port. If it's not - it will listen on this value for
# HTTP CONNECT requests. By default, this value is 0.
# tcpmux_httpconnect_port = 1337

# set dashboard_addr and dashboard_port to view dashboard of frps
# dashboard_addr's default value is same with bind_addr
# dashboard is available only if dashboard_port is set
dashboard_addr = 0.0.0.0
dashboard_port = 7500

# dashboard user and passwd for basic auth protect, if not set, both default value is admin
dashboard_user = admin
dashboard_pwd = admin

# enable_prometheus will export prometheus metrics on {dashboard_addr}:{dashboard_port} in /metrics api.
enable_prometheus = true

# dashboard assets directory(only for debug mode)
# assets_dir = ./static
# console or real logFile path like ./frps.log
log_file = ./frps.log

# trace, debug, info, warn, error
log_level = info

log_max_days = 3

# disable log colors when log_file is console, default is false
disable_log_color = false

# DetailedErrorsToClient defines whether to send the specific error (with debug info) to frpc. By default, this value is true.
detailed_errors_to_client = true

# AuthenticationMethod specifies what authentication method to use authenticate frpc with frps.
# If "token" is specified - token will be read into login message.
# If "oidc" is specified - OIDC (Open ID Connect) token will be issued using OIDC settings. By default, this value is "token".
authentication_method = token

# AuthenticateHeartBeats specifies whether to include authentication token in heartbeats sent to frps. By default, this value is false.
authenticate_heartbeats = false

# AuthenticateNewWorkConns specifies whether to include authentication token in new work connections sent to frps. By default, this value is false.
authenticate_new_work_conns = false

# auth token
token = 12345678

# OidcClientId specifies the client ID to use to get a token in OIDC authentication if AuthenticationMethod == "oidc".
# By default, this value is "".
oidc_client_id =

# OidcClientSecret specifies the client secret to use to get a token in OIDC authentication if AuthenticationMethod == "oidc".
# By default, this value is "".
oidc_client_secret = 

# OidcAudience specifies the audience of the token in OIDC authentication if AuthenticationMethod == "oidc". By default, this value is "".
oidc_audience = 

# OidcTokenEndpointUrl specifies the URL which implements OIDC Token Endpoint.
# It will be used to get an OIDC token if AuthenticationMethod == "oidc". By default, this value is "".
oidc_token_endpoint_url = 

# heartbeat configure, it's not recommended to modify the default value
# the default value of heartbeat_timeout is 90
# heartbeat_timeout = 90

# only allow frpc to bind ports you list, if you set nothing, there won't be any limit
allow_ports = 2000-3000,3001,3003,4000-50000

# pool_count in each proxy will change to max_pool_count if they exceed the maximum value
max_pool_count = 5

# max ports can be used for each client, default value is 0 means no limit
max_ports_per_client = 0

# TlsOnly specifies whether to only accept TLS-encrypted connections. By default, the value is false.
tls_only = false

# if subdomain_host is not empty, you can set subdomain when type is http or https in frpc's configure file
# when subdomain is test, the host used by routing is test.frps.com
subdomain_host = frps.com

# if tcp stream multiplexing is used, default is true
tcp_mux = true

# custom 404 page for HTTP requests
# custom_404_page = /path/to/404.html

[plugin.user-manager]
addr = 127.0.0.1:9000
path = /handler
ops = Login

[plugin.port-manager]
addr = 127.0.0.1:9001
path = /handler
ops = NewProxy
#frpc

# [common] is integral section
[common]
# A literal address or host name for IPv6 must be enclosed
# in square brackets, as in "[::1]:80", "[ipv6-host]:http" or "[ipv6-host%zone]:80"
server_addr = 0.0.0.0
server_port = 7000

# if you want to connect frps by http proxy or socks5 proxy, you can set http_proxy here or in global environment variables
# it only works when protocol is tcp
# http_proxy = http://user:passwd@192.168.1.128:8080
# http_proxy = socks5://user:passwd@192.168.1.128:1080

# console or real logFile path like ./frpc.log
log_file = ./frpc.log

# trace, debug, info, warn, error
log_level = info

log_max_days = 3

# disable log colors when log_file is console, default is false
disable_log_color = false

# for authentication
token = 12345678

# set admin address for control frpc's action by http api such as reload
admin_addr = 127.0.0.1
admin_port = 7400
admin_user = admin
admin_pwd = admin
# Admin assets directory. By default, these assets are bundled with frpc.
# assets_dir = ./static

# connections will be established in advance, default value is zero
pool_count = 5

# if tcp stream multiplexing is used, default is true, it must be same with frps
tcp_mux = true

# your proxy name will be changed to {user}.{proxy}
user = your_name

# decide if exit program when first login failed, otherwise continuous relogin to frps
# default is true
login_fail_exit = true

# communication protocol used to connect to server
# now it supports tcp and kcp and websocket, default is tcp
protocol = tcp

# if tls_enable is true, frpc will connect frps by tls
tls_enable = true

# specify a dns server, so frpc will use this instead of default one
# dns_server = 8.8.8.8

# proxy names you want to start seperated by ','
# default is empty, means all proxies
# start = ssh,dns

# heartbeat configure, it's not recommended to modify the default value
# the default value of heartbeat_interval is 10 and heartbeat_timeout is 90
# heartbeat_interval = 30
# heartbeat_timeout = 90

# additional meta info for client
meta_var1 = 123
meta_var2 = 234

# 'ssh' is the unique proxy name
# if user in [common] section is not empty, it will be changed to {user}.{proxy} such as 'your_name.ssh'
[ssh]
# tcp | udp | http | https | stcp | xtcp, default is tcp
type = tcp
local_ip = 127.0.0.1
local_port = 22
# limit bandwidth for this proxy, unit is KB and MB
bandwidth_limit = 1MB
# true or false, if true, messages between frps and frpc will be encrypted, default is false
use_encryption = false
# if true, message will be compressed
use_compression = false
# remote port listen by frps
remote_port = 6001
# frps will load balancing connections for proxies in same group
group = test_group
# group should have same group key
group_key = 123456
# enable health check for the backend service, it support 'tcp' and 'http' now
# frpc will connect local service's port to detect it's healthy status
health_check_type = tcp
# health check connection timeout
health_check_timeout_s = 3
# if continuous failed in 3 times, the proxy will be removed from frps
health_check_max_failed = 3
# every 10 seconds will do a health check
health_check_interval_s = 10
# additional meta info for each proxy
meta_var1 = 123
meta_var2 = 234

[ssh_random]
type = tcp
local_ip = 127.0.0.1
local_port = 22
# if remote_port is 0, frps will assign a random port for you
remote_port = 0

# if you want to expose multiple ports, add 'range:' prefix to the section name
# frpc will generate multiple proxies such as 'tcp_port_6010', 'tcp_port_6011' and so on.
[range:tcp_port]
type = tcp
local_ip = 127.0.0.1
local_port = 6010-6020,6022,6024-6028
remote_port = 6010-6020,6022,6024-6028
use_encryption = false
use_compression = false

[dns]
type = udp
local_ip = 114.114.114.114
local_port = 53
remote_port = 6002
use_encryption = false
use_compression = false

[range:udp_port]
type = udp
local_ip = 127.0.0.1
local_port = 6010-6020
remote_port = 6010-6020
use_encryption = false
use_compression = false

# Resolve your domain names to [server_addr] so you can use http://web01.yourdomain.com to browse web01 and http://web02.yourdomain.com to browse web02
[web01]
type = http
local_ip = 127.0.0.1
local_port = 80
use_encryption = false
use_compression = true
# http username and password are safety certification for http protocol
# if not set, you can access this custom_domains without certification
http_user = admin
http_pwd = admin
# if domain for frps is frps.com, then you can access [web01] proxy by URL http://test.frps.com
subdomain = web01
custom_domains = web02.yourdomain.com
# locations is only available for http type
locations = /,/pic
host_header_rewrite = example.com
# params with prefix "header_" will be used to update http request headers
header_X-From-Where = frp
health_check_type = http
# frpc will send a GET http request '/status' to local http service
# http service is alive when it return 2xx http response code
health_check_url = /status
health_check_interval_s = 10
health_check_max_failed = 3
health_check_timeout_s = 3

[web02]
type = https
local_ip = 127.0.0.1
local_port = 8000
use_encryption = false
use_compression = false
subdomain = web01
custom_domains = web02.yourdomain.com
# if not empty, frpc will use proxy protocol to transfer connection info to your local service
# v1 or v2 or empty
proxy_protocol_version = v2

[plugin_unix_domain_socket]
type = tcp
remote_port = 6003
# if plugin is defined, local_ip and local_port is useless
# plugin will handle connections got from frps
plugin = unix_domain_socket
# params with prefix "plugin_" that plugin needed
plugin_unix_path = /var/run/docker.sock

[plugin_http_proxy]
type = tcp
remote_port = 6004
plugin = http_proxy
plugin_http_user = abc
plugin_http_passwd = abc

[plugin_socks5]
type = tcp
remote_port = 6005
plugin = socks5
plugin_user = abc
plugin_passwd = abc

[plugin_static_file]
type = tcp
remote_port = 6006
plugin = static_file
plugin_local_path = /var/www/blog
plugin_strip_prefix = static
plugin_http_user = abc
plugin_http_passwd = abc

[plugin_https2http]
type = https
custom_domains = test.yourdomain.com
plugin = https2http
plugin_local_addr = 127.0.0.1:80
plugin_crt_path = ./server.crt
plugin_key_path = ./server.key
plugin_host_header_rewrite = 127.0.0.1
plugin_header_X-From-Where = frp

[plugin_http2https]
type = http
custom_domains = test.yourdomain.com
plugin = http2https
plugin_local_addr = 127.0.0.1:443
plugin_host_header_rewrite = 127.0.0.1
plugin_header_X-From-Where = frp

[secret_tcp]
# If the type is secret tcp, remote_port is useless
# Who want to connect local port should deploy another frpc with stcp proxy and role is visitor
type = stcp
# sk used for authentication for visitors
sk = abcdefg
local_ip = 127.0.0.1
local_port = 22
use_encryption = false
use_compression = false

# user of frpc should be same in both stcp server and stcp visitor
[secret_tcp_visitor]
# frpc role visitor -> frps -> frpc role server
role = visitor
type = stcp
# the server name you want to visitor
server_name = secret_tcp
sk = abcdefg
# connect this address to visitor stcp server
bind_addr = 127.0.0.1
bind_port = 9000
use_encryption = false
use_compression = false

[p2p_tcp]
type = xtcp
sk = abcdefg
local_ip = 127.0.0.1
local_port = 22
use_encryption = false
use_compression = false

[p2p_tcp_visitor]
role = visitor
type = xtcp
server_name = p2p_tcp
sk = abcdefg
bind_addr = 127.0.0.1
bind_port = 9001
use_encryption = false
use_compression = false

[tcpmuxhttpconnect]
type = tcpmux
multiplexer = httpconnect
local_ip = 127.0.0.1
local_port = 10701
custom_domains = tunnel1

小白 web 穿透教程:

搭好 frp 服务后,服务端(即 frps.ini)修改文件:

#往里填

[common]
bind_port = 7000
vhost_http_port = 8080 
//这是内网穿透对外端口,可以自己修改,如果需要80或443端口(方便),卸载nginx或apache

#仪表盘配置
dashboard_port = 7500//端口可以修改
dashboard_user = admin//用户名和密码可以自己修改
dashboard_pwd = admin


#以下是需要添加的内容
#添加web穿透

[web]
type = http
custom_domains = text.rosmontis.com #穿透域名

客户端(即 frpc.ini)修改文件:

#添加web穿透

[web01]
type = http
local_ip = 127.0.0.1
local_port = 81 #端口,非常重要,必须填对
custom_domains = text.rosmontis.com

我们可以在客户端宝塔修改网站端口:

img

启动 frp 服务,客户端 81 端口即可映射到服务端 8080 端口,访问服务端公网 ip+8080 即可访问到内网资源

若是需要使用 80 端口,需要卸载 web 服务!

更多服务端口的穿透示例:

“[xxx]”表示一个规则名称,自己定义,便于查询即可。
“type”表示转发的协议类型,有TCP和UDP等选项可以选择,如有需要请自行查询frp手册。
“local_port”是本地应用的端口号,按照实际应用工作在本机的端口号填写即可。
“remote_port”是该条规则在服务端开放的端口号,自己填写并记录即可。
#ssh服务穿透
#通过tcp来连接SSH

#frps.ini
#empty

#frpc.ini
[ssh]
type = tcp
local_ip = 127.0.0.1
local_port = 22
remote_port = 6000
#mysql服务穿透
#通过tcp来连接mysql

#frps.ini
#empty

#frpc.ini
[mysql]
type = tcp
local_port = 3306
remote_port = 3306
#use_encryption = true
#use_compression = true
#tomcat服务穿透

#frps.ini
#empty

#frpc.ini
type = http
local_port = 8083
custom_domains = tomcat.xxxx1.com
remote_port =

一点点高级玩法

1.token 验证

防止别的服务器使用你的 frp 服务,相当于密码

在 frps.ini 和 frpc.ini 添加:

token = 123456789 #密码自己改

2. 开机自启

    [Unit]
    Description=Frp Server Service
    After=network.target

    [Service]
    User=root
    Restart=on-failure
    RestartSec=5s
    ExecStart=frps文件夹路径 -c frps.ini路径/frps.ini

    [Install]
    WantedBy=multi-user.target
#ssh执行
开机启动frps:
systemctl enable frps
启动frps:
systemctl start frps
停止frps:
systemctl stop frps
重启frps:
systemctl restart frps
查看frps状态:
systemctl status frps

删除服务的命令:
systemctl stop frps

3. 多 server

多台内网服务器同时使用一个外网服务端:

将 frpc.ini 改成 frpc2.ini 或 frpc3.ini,依次递增即可

./frpc -c frpc2.ini

4. 自定义规则

“[xxx]”表示一个规则名称,自己定义,便于查询即可。
“type”表示转发的协议类型,有TCP和UDP等选项可以选择,如有需要请自行查询frp手册。
“local_port”是本地应用的端口号,按照实际应用工作在本机的端口号填写即可。
“remote_port”是该条规则在服务端开放的端口号,自己填写并记录即可。

tcp,udp,http 的穿透可自己玩,参数含义如上

0
  1. 支付宝打赏

    qrcode alipay
  2. 微信打赏

    qrcode weixin
  3. QQ打赏

    qrcode qq

评论区