[{"data":1,"prerenderedAt":156},["ShallowReactive",2],{"content:\u002Ffiddling\u002Ffix-port-forward-in-bypass-router":3,"surround:\u002Ffiddling\u002Ffix-port-forward-in-bypass-router":146},{"id":4,"title":5,"body":6,"categories":121,"date":123,"description":124,"draft":125,"extension":126,"image":127,"meta":128,"navigation":130,"path":131,"permalink":127,"published":127,"readingTime":132,"recommend":127,"references":127,"seo":137,"sitemap":138,"stem":139,"tags":140,"type":144,"__hash__":145},"content\u002Fposts\u002Ffiddling\u002Ffix-port-forward-in-bypass-router.md","旁路由端口映射失效解决",{"type":7,"value":8,"toc":114},"minimark",[9,13,23,27,30,33,36,47,50,56,59,65,68,72,75,85,88,93,96,104,107],[10,11,12],"h3",{"id":12},"前言",[14,15,16,17,22],"p",{},"使用 ",[18,19,21],"a",{"href":20},"\u002Ffiddling\u002Fdebian-as-bypass-router","上篇文章的方案"," 配置完成后，如果你在主路由上配置了端口映射，且被映射端口的机器网关配置的是旁路由，那此时端口映射应当是失效了。其实并不是 Clash 分流导致的问题，只要是配置了旁路由网关，主路由配置的端口映射都会失效。",[10,24,26],{"id":25},"原理太长不看系列","原理（太长不看系列）",[14,28,29],{},"网关的作用其实就是 NAT 地址转换，用于将内部网络的流量转发到外部网络，内部流量只要传输到外部网络，就必须通过网关。所以每个内网机器都必须配置一个网关地址，以与外部通信。",[14,31,32],{},"网关在实现上，可以简单理解为一个自动的端口转发。网关对每一个活动连接（通过五元组唯一标识）都维护了一个端口对，一个端口对内一个端口对外。例如你的机器与 Google 服务器建立连接，网关维护的端口对是 (32384, 14122)，那么就表示你向 Google 发送的所有流量都要发送到网关的 32384 端口，网关转发流量包，通过 14122 端口送往 Google 的服务器，反之 Google 服务器向你发送数包也要经过这层转发。当然很多时候 NAT 不一定只有一层，如果你的宽带没有获取到公网 IP，那么你的家庭网关的上级网关也会做一次 NAT，最终与 Google 通信的网关一定是具有公网 IP 的网关（只有具有公网 IP 的机器才可以在互联网通信）",[14,34,35],{},"当我们配置了旁路由时，旁路由由于充当了网关，也会进行一次 NAT。那么在你的机器与外部通信时，实际上是经过两次 NAT 的：",[37,38,43],"pre",{"className":39,"code":41,"language":42},[40],"language-text","你的机器 \u003C——> 旁路由（NAT） \u003C——> 主路由（NAT） \u003C——> 外部机器\n","text",[44,45,41],"code",{"__ignoreMap":46},"",[14,48,49],{},"如果你在主路由配置端口映射，但是内部机器配置的网关却是旁路由，当你尝试通过公网 IP 访问内网时，入流量是这样的：",[37,51,54],{"className":52,"code":53,"language":42},[40],"外部机器 ----> 主路由网关 ----> 你的机器\n",[44,55,53],{"__ignoreMap":46},[14,57,58],{},"而出流量则是这样的：",[37,60,63],{"className":61,"code":62,"language":42},[40],"你的机器 ----> 旁路由 ----> 主路由 ----> 外部机器\n",[44,64,62],{"__ignoreMap":46},[14,66,67],{},"实际上，在外部机器发起连接的时候，你的机器只与主路由网关建立了连接，但是回程流量却被发到了旁路由网关，旁路由网关找不到连接对应的端口对就会直接将包丢弃，导致了端口映射失效",[10,69,71],{"id":70},"解决方案直接看这个","解决方案（直接看这个）",[14,73,74],{},"解决方案很简单，内网包含了两层 NAT，那也只需要将端口映射配置两次即可。",[76,77,78,82],"ol",{},[79,80,81],"li",{},"主路由配置端口映射，指向旁路由",[79,83,84],{},"旁路由配置端口映射，指向目标机器",[14,86,87],{},"这样，无论入程还是回程，流量都按如下模式路由，即可成功建立连接",[37,89,91],{"className":90,"code":41,"language":42},[40],[44,92,41],{"__ignoreMap":46},[14,94,95],{},"主路由和旁路由配置端口映射的方式因系统而异，iKuai 和 OpenWRT 都由图形化的方式配置，这里不再赘述了。上篇文章的方案中旁路由使用的是 Debian，实际上以下方法适用于所有使用 iptables 的系统。执行以下命令设置 iptables，以下为目标机器为\"内部\"，称呼网关机器为\"外部\"",[37,97,102],{"className":98,"code":100,"language":101,"meta":46},[99],"language-shell","iptables -t nat -I PREROUTING -p tcp -d \u003C外部 IP> --dport \u003C外部端口> -j DNAT --to-destination \u003C内部 IP>:\u003C内部端口>\niptables -t nat -I POSTROUTING -p tcp --dport \u003C内部端口> -d \u003C外部 IP> -j SNAT --to-source \u003C内部 IP>\n","shell",[44,103,100],{"__ignoreMap":46},[14,105,106],{},"执行完后即可设置 iptables",[14,108,109,110,113],{},"注意上篇文章中 clean.sh 中的 ",[44,111,112],{"code":112},"iptables -t nat -F"," 命令会清除所有用户自定义的路由规则，导致转发失效。所以在执行完后需要补充执行下上述命令。",{"title":46,"searchDepth":115,"depth":115,"links":116},4,[117,119,120],{"id":12,"depth":118,"text":12},3,{"id":25,"depth":118,"text":26},{"id":70,"depth":118,"text":71},[122],"折腾","2024-08-15 23:50:00","在使用旁路由配置的情况下，主路由上的端口映射往往会失效。这是因为旁路由网关的设置改变了流量的转发路径，使得原本依赖于主路由的端口映射无法正常工作。网关的主要功能是进行地址转换，将内网流量转发到外网，而每个内网设备都需要一个网关来实现与外部的通信。理解这一机制，有助于更好地解决端口映射失效的问题。",false,"md",null,{"slots":129},{},true,"\u002Ffiddling\u002Ffix-port-forward-in-bypass-router",{"text":133,"minutes":134,"time":135,"words":136},"5 min read",4.955,297300,991,{"title":5,"description":124},{"loc":131},"posts\u002Ffiddling\u002Ffix-port-forward-in-bypass-router",[122,141,142,143],"旁路由","NAT","端口映射","tech","eI3OLIuDCy1Vq2UBfy1mxvyho6X93X-By3Dw7pWSpLI",[147,151],{"title":148,"path":20,"stem":149,"date":150,"type":144,"children":-1},"debian 旁路由方案","posts\u002Ffiddling\u002Fdebian-as-bypass-router","2024-07-13 17:49:00",{"title":152,"path":153,"stem":154,"date":155,"type":144,"children":-1},"基于 FakeIP 的透明代理分流","\u002Ffiddling\u002Ffake-ip-based-transparent-proxy","posts\u002Ffiddling\u002Ffake-ip-based-transparent-proxy","2024-08-16 23:53:00",1787554444713]