218 lines
3.7 KiB
Markdown
218 lines
3.7 KiB
Markdown
# 公网访问配置文档
|
||
|
||
## 🌐 访问地址
|
||
|
||
**公网访问地址：** http://180.97.221.140:2320
|
||
|
||
**内网访问地址：** http://192.168.58.20:4320
|
||
|
||
---
|
||
|
||
## 🔒 安全配置
|
||
|
||
### 公网服务器（180.97.221.140）
|
||
|
||
#### 开放端口
|
||
- **22** - SSH（仅限管理使用）
|
||
- **7000** - FRP服务端口（内网穿透通信）
|
||
- **2320** - 3D素材项目公网访问端口
|
||
|
||
#### 已关闭/限制的端口
|
||
- ~~111~~ - rpcbind（已停用）
|
||
- ~~7500~~ - FRP Dashboard（仅本地127.0.0.1访问）
|
||
|
||
#### 防火墙配置
|
||
```bash
|
||
# 查看防火墙规则
|
||
firewall-cmd --list-all
|
||
|
||
# 只允许的端口
|
||
- SSH (22)
|
||
- FRP服务 (7000)
|
||
- 3D素材项目 (2320)
|
||
```
|
||
|
||
---
|
||
|
||
## 🛠️ 技术架构
|
||
|
||
### 内网穿透方案
|
||
- **技术：** FRP (Fast Reverse Proxy)
|
||
- **服务端：** 公网服务器 180.97.221.140
|
||
- **客户端：** NAS 192.168.58.20
|
||
|
||
### 端口映射
|
||
```
|
||
公网 180.97.221.140:2320 → NAS 192.168.58.20:4320 → Docker Container 3000
|
||
```
|
||
|
||
### FRP配置
|
||
|
||
**服务端配置（/etc/frp/frps.ini）：**
|
||
```ini
|
||
[common]
|
||
bind_addr = 0.0.0.0
|
||
bind_port = 7000
|
||
dashboard_addr = 127.0.0.1 # 仅本地访问
|
||
dashboard_port = 7500
|
||
dashboard_user = admin
|
||
dashboard_pwd = Admin@frp2024
|
||
authentication_method = token
|
||
token = LiuYunKu_NAS_2024_SecureToken
|
||
log_file = /var/log/frps.log
|
||
allow_ports = 2320
|
||
```
|
||
|
||
**客户端配置（/mnt/tank/apps/frp/frpc.toml）：**
|
||
```toml
|
||
serverAddr = "180.97.221.140"
|
||
serverPort = 7000
|
||
|
||
[[proxies]]
|
||
name = "youyidian-3d"
|
||
type = "tcp"
|
||
localIP = "127.0.0.1"
|
||
localPort = 4320
|
||
remotePort = 2320
|
||
|
||
[auth]
|
||
method = "token"
|
||
token = "LiuYunKu_NAS_2024_SecureToken"
|
||
```
|
||
|
||
---
|
||
|
||
## 🐳 Docker容器信息
|
||
|
||
### NAS上的容器
|
||
|
||
**3D素材项目容器：**
|
||
```bash
|
||
docker ps | grep youyidian-3d-material
|
||
# 端口：0.0.0.0:4320->3000/tcp
|
||
```
|
||
|
||
**FRP客户端容器：**
|
||
```bash
|
||
docker ps | grep frpc-youyidian
|
||
# 使用host网络模式
|
||
```
|
||
|
||
---
|
||
|
||
## 📋 管理命令
|
||
|
||
### 查看FRP状态
|
||
|
||
**在NAS上：**
|
||
```bash
|
||
# 查看frpc容器状态
|
||
docker ps | grep frpc-youyidian
|
||
|
||
# 查看frpc日志
|
||
docker logs frpc-youyidian
|
||
|
||
# 重启frpc
|
||
docker restart frpc-youyidian
|
||
```
|
||
|
||
**在公网服务器上：**
|
||
```bash
|
||
# 查看frps进程
|
||
ps aux | grep frps
|
||
|
||
# 查看frps日志
|
||
tail -f /var/log/frps.log
|
||
|
||
# 重启frps
|
||
killall frps && nohup /usr/local/bin/frps -c /etc/frp/frps.ini &
|
||
```
|
||
|
||
### 查看防火墙规则
|
||
|
||
```bash
|
||
# 在公网服务器
|
||
firewall-cmd --list-all
|
||
|
||
# 添加新端口
|
||
firewall-cmd --permanent --add-port=端口号/tcp
|
||
firewall-cmd --reload
|
||
```
|
||
|
||
---
|
||
|
||
## 🔐 安全建议
|
||
|
||
1. ✅ **已实施**
|
||
- FRP Dashboard仅本地访问
|
||
- 防火墙仅开放必要端口
|
||
- 停用了rpcbind服务
|
||
- 使用Token认证
|
||
|
||
2. 🔄 **建议进一步优化**
|
||
- 考虑为公网访问配置SSL证书（HTTPS）
|
||
- 定期更新FRP Token
|
||
- 配置fail2ban防止SSH暴力破解
|
||
- 启用SSH密钥认证，禁用密码登录
|
||
|
||
---
|
||
|
||
## 📊 存储位置
|
||
|
||
- **预览图片：** S3对象存储（https://s3.1080p.hk/jsxiangche）
|
||
- **ZIP文件：** NAS本地（/mnt/tank/apps/youyidian-3d/uploads）
|
||
- **数据库：** 云端PostgreSQL（149.88.95.87:5432）
|
||
|
||
---
|
||
|
||
## 🚀 访问测试
|
||
|
||
```bash
|
||
# 测试公网访问
|
||
curl http://180.97.221.140:2320/login
|
||
|
||
# 测试内网访问
|
||
curl http://192.168.58.20:4320/login
|
||
```
|
||
|
||
---
|
||
|
||
## 📞 故障排查
|
||
|
||
### 公网无法访问
|
||
|
||
1. 检查FRP客户端状态
|
||
```bash
|
||
docker logs frpc-youyidian
|
||
```
|
||
|
||
2. 检查FRP服务端状态
|
||
```bash
|
||
ssh root@180.97.221.140
|
||
tail -f /var/log/frps.log
|
||
```
|
||
|
||
3. 检查防火墙
|
||
```bash
|
||
firewall-cmd --list-all
|
||
```
|
||
|
||
### 内网可访问但公网不行
|
||
|
||
1. 检查端口映射
|
||
```bash
|
||
netstat -tlnp | grep 2320
|
||
```
|
||
|
||
2. 检查FRP连接状态
|
||
```bash
|
||
docker logs frpc-youyidian | grep connected
|
||
```
|
||
|
||
---
|
||
|
||
**部署日期：** 2025-10-16
|
||
**维护人员：** 系统管理员
|
||
**最后更新：** 2025-10-16 21:10
|
||
|