Simple steps to achieve intranet penetration

Scenes

In order to avoid expounding too much theory, let’s start directly from the demand scenario to understand why intranet penetration is required?

Xiao Ming is a minority author of Gugu. He has written half of a manuscript at home on the computer. When he arrives at the company, he plans to continue the manuscript. What should I do? He forgot to submit even if he could use it)?

At this time, Xiao Ming wanted to download the half of the manuscript at home through ssh and other remote access device files, but his home network was not assigned a public IP and could not be directly connected through the Internet. This is where intranet penetration comes in handy.

Therefore, in layman’s terms, intranet penetration is to penetrate traffic from the public network to the intranet, so that intranet devices can also be accessed through the public network, and help Xiaoming access files on his home computer in the company.

facility

The core idea of ​​intranet penetration is “mapping” and “forwarding”, which maps the port of the intranet device to the port of the public network device for traffic forwarding.

1

Simply draw a schematic diagram as above, the infrastructure consists of two core devices:

Server: A device with a public network IP, that is, the “public network server” in the above figure, with two ports 7000 and 6000 open for public network communication.

Client: One intranet device to be accessed, that is, “Intranet home computer” in the picture above, open the port required for the actual application service (such as ssh service, default 22 port), and inform the configured public network mapping port 6000 Server. So the port 6000 opened by the server is actually what the client told it.

(The above ports except 22 are all custom ports and have no special meaning.)

After the infrastructure is built, Xiao Ming’s command to remotely access his own computer through ssh in the company is as follows:

 # 假定服务器公网IP是119.23.141.248,内网家用电脑用户名是test ssh -oPort=6000 [email protected]

This is what we want to achieve the expected effect of intranet penetration – on the surface, the computer on the home intranet is exposed to the Internet as if it has a public IP.

accomplish

To achieve this kind of basic intranet penetration, a server with a public network IP is generally used as a relay (not discussing point-to-point for the time being). There are already many mature tools in the open source world. Next, we will directly take frp as an example. It can be done in a few simple steps!

Install

First download the corresponding package in the official release warehouse, several common architectures:

If GitHub is difficult to access, you can download it from my network disk: frp-v0.4.2

After decompression , you will find that there are both frps and frpc (the executable program of Windows version is exe), the former means Server (server), the latter means Client (client), corresponding to the configuration files frps.ini and frpc.ini of the same name, Only one set of programs will be used for one end.

configure

Here, refer to the official documentation to introduce two more practical configurations, ssh service and file access service.

1. Access intranet machines through SSH

Unzip the package of the corresponding architecture to the server, and modify the frps.ini file to set the port to 7000. Of course, you can customize it to any port, as long as it does not conflict with the existing port on the system:

 [common] bind_port = 7000

Start the server frp (-c parameter means config):

 ./frps -c ./frps.ini

In the same way, unzip the package to the client, and modify the frpc.ini file, and fill in the IP and port of the public network server (corresponding to the port set by the server) under the common label. Then set the remote port 6000 of the ssh service (local_ip and port generally do not need to be changed).

 [common] server_addr = xxxx server_port = 7000 [ssh] type = tcp local_ip = 127.0.0.1 local_port = 22 remote_port = 6000

Start client frp:

 ./frpc -c ./frpc.ini

If nothing else, the client terminal will prompt you to log in to the server successfully.

Then on any device, you can access the intranet device (that is, the one where the client frp is located) through the public network:

 ssh -oPort=6000 你的系统登录用户名@xxxx

2. Provide simple file access services to the outside world

If we want to directly access the files on the intranet device through the browser, configure the client like this (here, take Windows as an example), without changing the server:

 [common] server_addr = xxxx server_port = 7000 [ssh] type = tcp local_ip = 127.0.0.1 local_port = 22 remote_port = 6000 [c_static_file] type = tcp remote_port = 6001 plugin = static_file plugin_local_path = C: plugin_strip_prefix = driver_c plugin_http_user = 自定义名称,这个和系统登录的用户名不是一个东西,随便写就行plugin_http_passwd = 自定义密码[d_static_file] type = tcp remote_port = 6002 plugin = static_file plugin_local_path = D: plugin_strip_prefix = driver_d plugin_http_user = 自定义名称,同上plugin_http_passwd = 自定义密码

Based on the ssh configured above, we add two file access configurations c_static_file and d_static_file. These two label names are also customized; static_file is the name of the client plugin for the file access service, which is fixed; plugin_local_path = C: Indicates that the entire C drive can be accessed, corresponding to the D drive below; the two prefixes driver_c and driver_d are also customized, which is convenient to access in the browser later.

After modifying the configuration file, restart the client frp:

 frpc.exe -c frpc.ini

After the startup is successful, you can directly access it in the browser: https://ift.tt/PN74gHa . When accessing, you are prompted to enter the username and password, which are the plugin_http_user and passwd configured above.

(small pits that are not easy to notice: the slash/must be filled in at the end of the address, otherwise it cannot be accessed)

the end

During the test, my public network server is on Tencent Cloud, and there are firewall rules by default, so remember to open the corresponding port access in the background configuration (such as the above 7000 and 6000). In addition, there is a small easter egg in the text, I don’t know if anyone has found it haha!

This article is reproduced from: https://sspai.com/post/73283
This site is for inclusion only, and the copyright belongs to the original author.

Leave a Comment