使用frp让内网能够被外网访问

使用frp让内网能够被外网访问

在进行以下操作之前，请确保自己有一台能被外网访问的机器

最近想要在本地启动一个服务并且能够被远程访问到。

• frp是一个反向代理应用，简单来说，通过frp的服务端和客户端建立通信之后，通过可被外网访问的IP来代理内网中的IP，再通过不同的端口号指向不同的服务。从以下的配置文件可以看到一个是ssh服务，一个web服务。
  点击下载frp
  

• 查看系统版本
  我的云服务器和本地服务器用的都是linux系统，因此我下载的版本0.391_linux_386

uname -a
Linux wq 3.10.0-514.26.2.el7.x86_64 #1 SMP Tue Jul 4 15:04:05 UTC 2017 x86_64 x86_64 x86_64 GNU/Linux
Linux wq2 3.10.0-1062.el7.x86_64 #1 SMP Wed Aug 7 18:08:02 UTC 2019 x86_64 x86_64 x86_64 GNU/Linux

• 下载好后解压
  因为都是Linux系统，服务端和客户端用同一个frp版本

-rwxr-xr-x 1 1001 121 12075008 Feb  9 16:23 frps
-rw-r--r-- 1 1001 121     5155 Feb  9 16:27 frps_full.ini
-rw-r--r-- 1 1001 121       70 Feb 28 16:10 frps.ini
-rwxr-xr-x 1 1001 121 12075008 Feb  9 16:23 frpc
-rw-r--r-- 1 1001 121     5155 Feb  9 16:27 frpc_full.ini
-rw-r--r-- 1 1001 121       70 Feb 28 16:10 frpc.ini
-rw-r--r-- 1 1001 121    11358 Feb  9 16:27 LICENSE
drwxr-xr-x 2 1001 121     4096 Feb  9 16:27 systemd

frp分为两部分，frps服务端和frpc客户端，服务端配置在能对外提供访问的云服务器上，客户端配置在内网机器上

• 服务端配置
  服务端启动后，客户端会访问这个7000端口连接，使用的云服务器，在安全规则里添加下面对外提供服务的端口，以免不能访问。

[common]
bind_port = 7000
vhost_http_port = 7777
token = specialwu666

启动命令 ./frps -c frps.ini

[root@wq frp_0.39.1_linux_386]# ./frps -c frps.ini
2022/02/28 16:13:10 [I] [root.go:200] frps uses config file: frps.ini
2022/02/28 16:13:10 [I] [service.go:193] frps tcp listen on 0.0.0.0:7000
2022/02/28 16:13:10 [I] [service.go:236] http service listen on 0.0.0.0:7777
2022/02/28 16:13:10 [I] [root.go:209] frps started successfully

• 客户端配置
  server_addr 公网IP 47.*.*.*，token 除了端口一致外还需这密令一致才能连接上

[common]
server_addr = 47.*.*.*
server_port = 7000
token = specialwu666
[ssh]
type = tcp
local_ip = 192.168.21.25
local_port = 4141
remote_port = 4141
[web]
type = http
local_port = 50070
custom_domains = 47.*.*.*

设置好如上信息后如何访问

• vhost_http_port 我设置为7777，已知在本地启动了hdfs，
• 那么HDFS网页访问地址为192.168.1.25:50070
• frp客户端启动后可通过 公网IP:vhost_http_port来访问
  

启动命令及显示信息 ./frpc -c frpc.ini

[root@wq2 frp_0.39.1_linux_386]# ./frpc -c ./frpc.ini
2022/02/28 16:13:40 [I] [service.go:327] [e6ce4371fe9e6de7] login to server success, get run id [e6ce4371fe9e6de7], server udp port [0]
2022/02/28 16:13:40 [I] [proxy_manager.go:144] [e6ce4371fe9e6de7] proxy added: [ssh web]
2022/02/28 16:13:40 [I] [control.go:181] [e6ce4371fe9e6de7] [ssh] start proxy success
2022/02/28 16:13:40 [I] [control.go:181] [e6ce4371fe9e6de7] [web] start proxy success

如果客户端和服务端的token不一致那么就会出现如下报错

[root@wq2 frp_0.39.1_linux_386]# ./frpc -c frpc.ini 
2022/03/01 10:19:08 [E] [service.go:318] token in login doesn't match token from configuration
2022/03/01 10:19:08 [W] [service.go:105] login to server failed: token in login doesn't match token from configuration
token in login doesn't match token from configuration

NAT模式

[root@wq2 ~]# cat /etc/sysconfig/network-scripts/ifcfg-ens33 
TYPE=Ethernet
PROXY_METHOD=none
BROWSER_ONLY=no
BOOTPROTO=none
DEFROUTE=yes
IPV4_FAILURE_FATAL=no
IPV6INIT=no
IPV6_AUTOCONF=yes
IPV6_DEFROUTE=yes
IPV6_FAILURE_FATAL=no
IPV6_ADDR_GEN_MODE=stable-privacy
NAME=ens33
UUID=1337141d-6fdf-4567-a581-bc4ec621052f
DEVICE=ens33
ONBOOT=yes
ETHTOOL_OPTS="autoneg on"
IPADDR=192.168.236.237
PREFIX=24
GATEWAY=192.168.236.2
DNS1=192.168.236.2

桥接模式

service network restart

[root@wq2 ~]# cat /etc/sysconfig/network-scripts/ifcfg-ens33 
TYPE=Ethernet
PROXY_METHOD=none
BROWSER_ONLY=no
BOOTPROTO=none
DEFROUTE=yes
IPV4_FAILURE_FATAL=no
IPV6INIT=no
IPV6_AUTOCONF=yes
IPV6_DEFROUTE=yes
IPV6_FAILURE_FATAL=no
IPV6_ADDR_GEN_MODE=stable-privacy
NAME=ens33
UUID=1337141d-6fdf-4567-a581-bc4ec621052f
DEVICE=ens33
ONBOOT=yes
ETHTOOL_OPTS="autoneg on"
IPADDR=192.168.1.26
PREFIX=24
GATEWAY=192.168.1.1
DNS1=192.168.1.1

让内网地址暴露在外有一定的风险，使用过程中请考虑到这个问题

nginx后台访问日志，这段日志说明有人注入文件破解后台登录密码，所以内网暴露出来的时候能有这方面的考虑(具体怎么操作尚不可知)

[root@specialwu logs]# tail -n20 access.log 
184.168.97.210 - - [01/Mar/2022:11:21:30 +0800] "POST /xmlrpc.php HTTP/1.1" 200 412 "-" "Mozilla/5.0 (X11; Ubuntu; Linux x86_64; rv:62.0) Gecko/20100101 Firefox/62.0" "-"
45.76.81.26 - - [01/Mar/2022:11:23:24 +0800] "POST /wp-login.php HTTP/1.1" 200 3147 "-" "Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/51.0.2704.106 Safari/537.36" "-"
220.248.17.34 - - [01/Mar/2022:11:24:26 +0800] "GET /wp-includes/wlwmanifest.xml HTTP/1.1" 200 1045 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/98.0.4758.102 Safari/537.36" "-"
220.248.17.34 - - [01/Mar/2022:11:24:26 +0800] "GET /favicon.ico HTTP/1.1" 404 187 "http://specialwu.com/wp-includes/wlwmanifest.xml" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/98.0.4758.102 Safari/537.36" "-"
220.248.17.34 - - [01/Mar/2022:11:26:11 +0800] "GET /wp-json/wp/v2/users/ HTTP/1.1" 404 187 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/98.0.4758.102 Safari/537.36" "-"
220.248.17.34 - - [01/Mar/2022:11:26:16 +0800] "GET /wp-json/wp/v2/users/ HTTP/1.1" 404 187 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/98.0.4758.102 Safari/537.36" "-"
166.62.122.244 - - [01/Mar/2022:11:27:57 +0800] "POST /xmlrpc.php HTTP/1.1" 200 412 "-" "Mozilla/5.0 (X11; Ubuntu; Linux x86_64; rv:62.0) Gecko/20100101 Firefox/62.0" "-"
170.130.187.2 - - [01/Mar/2022:11:34:59 +0800] "GET / HTTP/1.0" 200 43513 "-" "https://gdnplus.com:Gather Analyze Provide." "-"
184.168.99.48 - - [01/Mar/2022:11:35:24 +0800] "POST /xmlrpc.php HTTP/1.1" 200 412 "-" "Mozilla/5.0 (X11; Ubuntu; Linux x86_64; rv:62.0) Gecko/20100101 Firefox/62.0" "-"
159.203.176.82 - - [01/Mar/2022:11:42:33 +0800] "POST /xmlrpc.php HTTP/1.1" 200 412 "-" "Mozilla/5.0 (X11; Ubuntu; Linux x86_64; rv:62.0) Gecko/20100101 Firefox/62.0" "-"
92.118.234.202 - - [01/Mar/2022:11:47:53 +0800] "GET http://azenv.net/ HTTP/1.1" 200 9452 "-" "Go-http-client/1.1" "-"
124.158.12.202 - - [01/Mar/2022:11:49:08 +0800] "POST /xmlrpc.php HTTP/1.1" 200 412 "-" "Mozilla/5.0 (X11; Ubuntu; Linux x86_64; rv:62.0) Gecko/20100101 Firefox/62.0" "-"
162.144.49.214 - - [01/Mar/2022:11:56:38 +0800] "POST /xmlrpc.php HTTP/1.1" 200 412 "-" "Mozilla/5.0 (X11; Ubuntu; Linux x86_64; rv:62.0) Gecko/20100101 Firefox/62.0" "-"
66.23.238.6 - - [01/Mar/2022:11:58:28 +0800] "GET http://azenv.net/ HTTP/1.1" 200 9452 "-" "Go-http-client/1.1" "-"
66.23.238.6 - - [01/Mar/2022:12:08:39 +0800] "GET http://azenv.net/ HTTP/1.1" 200 9452 "-" "Go-http-client/1.1" "-"

查看这个文件被请求的次数

[root@specialwu logs]# grep "xmlrpc.php" access.log | wc -l
165264