经过 Cloudflare 映射的公共服务器无法连接，请教是什么原因？ #368

xezzon · 2024-09-26T03:05:31Z

xezzon
Sep 26, 2024

复现步骤

启动公共服务器。

easytier-core --relay-network-whitelist --relay-all-peer-rpc -m server --file-log-level info --file-log-dir=.

局域网内测试连接。

sudo easytier-core -d --network-name default -p tcp://192.168.9.3:11010 --no-listener --file-log-level info --file-log-dir=.

服务端输出：

2024-09-26 10:20:13: new connection accepted. local: tcp://0.0.0.0:11010, remote: tcp://192.168.9.1:64830

将端口通过 Cloudflare 映射到域名：11010端口映射到ettcp.***.***:443，11011端口映射到etws.***.***:443。
使用 WebSocket 连接。

new WebSocket('wss://etws.***.***:443/')

服务端输出：

2024-09-26 10:46:44: new connection accepted. local: ws://0.0.0.0:11011/, remote: ws://192.168.9.3:46348/
2024-09-26 10:46:49: connection error. local: ws://0.0.0.0:11011/, remote: ws://192.168.9.3:46348/, err: wait resp error: wait handshake timeout: Elapsed(())

使用 easytier-core 连接。

sudo easytier-core -d --network-name default -p wss://etws.***.***:443 --no-listener --file-log-level info --file-log-dir=.

服务端控制台、日志均无输出。

客户端日志：

2024-09-26T10:54:51.1335355+08:00  INFO easytier::instance::instance: [INIT] instance creating. config: instance_name = "default"
instance_id = "a6bb104c-988b-416a-9c33-5d12a84c6d67"
dhcp = true
listeners = []
rpc_portal = "127.0.0.1:0"

[network_identity]
network_name = "default"
network_secret = ""

[[peer]]
uri = "wss://etws.***.***/"

2024-09-26T10:54:51.1336782+08:00  INFO easytier::peers::peer_rpc: [PEER RPC MGR] register service 1 succeed, my_node_id 425427663
2024-09-26T10:54:51.1337035+08:00  WARN easytier::connector::manual: conn_mgr_routine started
2024-09-26T10:54:51.1346126+08:00  WARN easytier::instance::listeners: run listener: Listener { inner: Mutex { data: TunnelListener { local_url: Url { scheme: "ring", cannot_be_a_base: false, username: "", password: None, host: Some(Domain("a6bb104c-988b-416a-9c33-5d12a84c6d67")), port: None, path: "", query: None, fragment: None } } }, must_succ: true }
2024-09-26T10:54:51.1346364+08:00  INFO easytier::tunnel::ring: listen new conn of key: ring://a6bb104c-988b-416a-9c33-5d12a84c6d67
2024-09-26T10:54:51.1346603+08:00  WARN easytier::instance::listeners: run listener: Listener { inner: Mutex { data: TunnelListener { local_url: Url { scheme: "udp", cannot_be_a_base: false, username: "", password: None, host: Some(Ipv6(::)), port: Some(0), path: "", query: None, fragment: None } } }, must_succ: false }
2024-09-26T10:54:51.1347075+08:00  INFO run_listener{listener=Mutex { data: TunnelListener { local_url: Url { scheme: "ring", cannot_be_a_base: false, username: "", password: None, host: Some(Domain("a6bb104c-988b-416a-9c33-5d12a84c6d67")), port: None, path: "", query: None, fragment: None } } } peer_manager=PeerManager { my_peer_id: 425427663, instance_name: "default", net_ns: None } global_ctx=GlobalCtx { inst_name: "default", id: a6bb104c-988b-416a-9c33-5d12a84c6d67, net_ns: None, event_bus: "EventBus", ipv4: AtomicCell { value: None } }}: easytier::tunnel::ring: waiting accept new conn of key: ring://a6bb104c-988b-416a-9c33-5d12a84c6d67
2024-09-26T10:54:51.1349351+08:00  INFO easytier::peers::peer_rpc: [PEER RPC MGR] register service 7 succeed, my_node_id 425427663
2024-09-26T10:54:51.1349606+08:00  INFO run_listener{listener=Mutex { data: TunnelListener { local_url: Url { scheme: "udp", cannot_be_a_base: false, username: "", password: None, host: Some(Ipv6(::)), port: Some(60575), path: "", query: None, fragment: None } } } peer_manager=PeerManager { my_peer_id: 425427663, instance_name: "default", net_ns: None } global_ctx=GlobalCtx { inst_name: "default", id: a6bb104c-988b-416a-9c33-5d12a84c6d67, net_ns: None, event_bus: "EventBus", ipv4: AtomicCell { value: None } }}: easytier::tunnel::udp: start udp accept: Url { scheme: "udp", cannot_be_a_base: false, username: "", password: None, host: Some(Ipv6(::)), port: Some(60575), path: "", query: None, fragment: None }
2024-09-26T10:54:51.1349782+08:00  INFO easytier::peers::peer_rpc: [PEER RPC MGR] register service 1 succeed, my_node_id 425427663
2024-09-26T10:54:51.1352014+08:00  INFO easytier::peers::peer_rpc: [PEER RPC MGR] register service 2 succeed, my_node_id 425427663
2024-09-26T10:54:51.1352151+08:00  INFO easytier::peers::peer_rpc: [PEER RPC MGR] register service 50 succeed, my_node_id 425427663
2024-09-26T10:54:51.144466+08:00  INFO easytier::connector::manual: add_connector: wss://etws.***.***/
2024-09-26T10:54:51.2301937+08:00  INFO detect_nat_type_with_socket{udp=PollEvented { io: Some(UdpSocket { addr: 0.0.0.0:60574, socket: 1652 }) }}:stun_packet_listener: easytier::common::stun: start stun packet listener
2024-09-26T10:54:52.1456148+08:00  INFO easytier::connector::manual: reconn_interval tick, done
2024-09-26T10:54:52.1456653+08:00  INFO easytier::connector::manual: reconnect: wss://etws.***.***/
2024-09-26T10:54:52.1461109+08:00  INFO easytier::connector::manual: get ip from url done addrs=[104.21.50.189:443, 172.67.209.98:443] dead_url="wss://etws.***.***/"
2024-09-26T10:54:52.1461443+08:00  INFO easytier::connector::manual: reconnect try connect... conn: Mutex { data: TunnelConnector { remote_url: Url { scheme: "wss", cannot_be_a_base: false, username: "", password: None, host: Some(Domain("etws.***.***")), port: None, path: "/", query: None, fragment: None } } }
2024-09-26T10:54:52.1463709+08:00  INFO easytier::tunnel::websocket: bind addr bind_addr=172.27.208.1:0 addr=104.21.50.189:443
2024-09-26T10:54:52.174761+08:00  INFO easytier::tunnel::websocket: bind addr bind_addr=192.168.2.22:0 addr=104.21.50.189:443
2024-09-26T10:54:52.2022989+08:00  INFO easytier::tunnel::websocket: bind addr bind_addr=192.168.122.1:0 addr=104.21.50.189:443
2024-09-26T10:54:52.230169+08:00  INFO easytier::tunnel::websocket: bind addr bind_addr=192.168.201.1:0 addr=104.21.50.189:443
2024-09-26T10:54:52.2563411+08:00  INFO easytier::tunnel::websocket: bind addr bind_addr=172.18.0.224:0 addr=104.21.50.189:443
2024-09-26T10:54:52.2840826+08:00  INFO update_my_peer_info_routine{service_impl=PeerRouteServiceImpl { my_peer_id: 425427663, sessions: {}, route_table: RouteTable { peer_infos: {}, next_hop_map: {}, ipv4_peer_id_map: {}, cidr_peer_id_map: {} }, route_table_with_cost: RouteTable { peer_infos: {}, next_hop_map: {}, ipv4_peer_id_map: {}, cidr_peer_id_map: {} }, synced_route_info: SyncedRouteInfo { peer_infos: {}, conn_map: {} }, cached_local_conn_map: RouteConnBitmap { peer_ids: [], bitmap: [] } }}: easytier::peers::peer_ospf_route: global event received in update_my_peer_info_routine ev=Ok(Connecting(Url { scheme: "wss", cannot_be_a_base: false, username: "", password: None, host: Some(Domain("etws.***.***")), port: None, path: "/", query: None, fragment: None }))
2024-09-26T10:54:52.7148826+08:00  INFO easytier::connector::manual: reconnect: wss://etws.***.***/ done, ret: Ok(Err(TunnelError(IOError(Custom { kind: InvalidData, error: AlertReceived(HandshakeFailure) }))))
2024-09-26T10:54:52.7149545+08:00  WARN easytier::connector::manual: reconn_tasks done, reconn result: Some(Err(TunnelError(IOError(Custom { kind: InvalidData, error: AlertReceived(HandshakeFailure) }))))
2024-09-26T10:54:52.7149772+08:00  INFO update_my_peer_info_routine{service_impl=PeerRouteServiceImpl { my_peer_id: 425427663, sessions: {}, route_table: RouteTable { peer_infos: {}, next_hop_map: {}, ipv4_peer_id_map: {}, cidr_peer_id_map: {} }, route_table_with_cost: RouteTable { peer_infos: {}, next_hop_map: {}, ipv4_peer_id_map: {}, cidr_peer_id_map: {} }, synced_route_info: SyncedRouteInfo { peer_infos: {}, conn_map: {} }, cached_local_conn_map: RouteConnBitmap { peer_ids: [], bitmap: [] } }}: easytier::peers::peer_ospf_route: global event received in update_my_peer_info_routine ev=Ok(ConnectError("wss://etws.***.***/", "V4", "Err(TunnelError(IOError(Custom { kind: InvalidData, error: AlertReceived(HandshakeFailure) })))"))

原因猜测

是不是因为不支持TLS？或者说哪里的配置有问题。

KKRainbow · 2024-09-26T03:15:55Z

KKRainbow
Sep 26, 2024
Maintainer

将端口通过 Cloudflare 映射到域名：11010端口映射到ettcp..:443，11011端口映射到etws..:443。

11011 是 ws
11012 是 wss

是不是映射端口写错了

1 reply

xezzon Sep 26, 2024
Author

应该不是这个原因。反向代理的时候会把wss转成ws，在控制台用 WebSocket 连的时候，服务端是可以监听到的，并且确实是 11011 端口收到了 ws 的数据包。

2024-09-26 10:46:44: new connection accepted. local: ws://0.0.0.0:11011/, remote: ws://192.168.9.3:46348/
2024-09-26 10:46:49: connection error. local: ws://0.0.0.0:11011/, remote: ws://192.168.9.3:46348/, err: wait resp error: wait handshake timeout: Elapsed(())

xezzon · 2024-09-26T05:50:43Z

xezzon
Sep 26, 2024
Author

TCP连接也失败，不过日志与 ws 连接不太一样。日志在疯狂输出TunnelError(InvalidPacket("body too long"))。

2024-09-26T13:42:51.6123993+08:00  INFO easytier_core::instance::instance: [INIT] instance creating. config: instance_name = "default"
instance_id = "5f702375-20cf-410d-9ad0-a5d7f9b0e409"
dhcp = true
listeners = []
exit_nodes = []
rpc_portal = "127.0.0.1:15888"

[network_identity]
network_name = "default"
network_secret = ""

[[peer]]
uri = "tcp://ettcp.***.***:443"

[file_logger]
level = "info"
file = "easytier-default"
dir = "."

[flags]
default_protocol = "tcp"
dev_name = ""
enable_encryption = true
enable_ipv6 = true
mtu = 1380
latency_first = false
enable_exit_node = false
no_tun = false
use_smoltcp = false
foreign_network_whitelist = "*"
disable_p2p = false
relay_all_peer_rpc = false

2024-09-26T13:42:51.612699+08:00  INFO easytier_core::peers::peer_rpc: [PEER RPC MGR] register service 1 succeed, my_node_id 663996417
2024-09-26T13:42:51.6137647+08:00  WARN easytier_core::instance::listeners: run listener: Listener { inner: Mutex { data: TunnelListener { local_url: Url { scheme: "ring", cannot_be_a_base: false, username: "", password: None, host: Some(Domain("5f702375-20cf-410d-9ad0-a5d7f9b0e409")), port: None, path: "", query: None, fragment: None } } }, must_succ: true }
2024-09-26T13:42:51.6138241+08:00  INFO easytier_core::tunnel::ring: listen new conn of key: ring://5f702375-20cf-410d-9ad0-a5d7f9b0e409
2024-09-26T13:42:51.6138455+08:00  WARN easytier_core::instance::listeners: run listener: Listener { inner: Mutex { data: TunnelListener { local_url: Url { scheme: "udp", cannot_be_a_base: false, username: "", password: None, host: Some(Ipv6(::)), port: Some(0), path: "", query: None, fragment: None } } }, must_succ: false }
2024-09-26T13:42:51.6143715+08:00  INFO easytier_core::peers::peer_rpc: [PEER RPC MGR] register service 7 succeed, my_node_id 663996417
2024-09-26T13:42:51.6144275+08:00  INFO easytier_core::peers::peer_rpc: [PEER RPC MGR] register service 1 succeed, my_node_id 663996417
2024-09-26T13:42:51.6146181+08:00  INFO easytier_core::peers::peer_rpc: [PEER RPC MGR] register service 2 succeed, my_node_id 663996417
2024-09-26T13:42:51.6146277+08:00  INFO easytier_core::peers::peer_rpc: [PEER RPC MGR] register service 50 succeed, my_node_id 663996417
2024-09-26T13:42:51.8532349+08:00  INFO easytier_core::connector::manual: add_connector: tcp://ettcp.***.***:443
2024-09-26T13:42:51.8534939+08:00  WARN easytier_core::connector::manual: conn_mgr_routine started
2024-09-26T13:42:51.8536164+08:00  INFO run_listener{listener=Mutex { data: TunnelListener { local_url: Url { scheme: "ring", cannot_be_a_base: false, username: "", password: None, host: Some(Domain("5f702375-20cf-410d-9ad0-a5d7f9b0e409")), port: None, path: "", query: None, fragment: None } } } peer_manager=PeerManager { my_peer_id: 663996417, instance_name: "default", net_ns: None } global_ctx=GlobalCtx { inst_name: "default", id: 5f702375-20cf-410d-9ad0-a5d7f9b0e409, net_ns: None, event_bus: "EventBus", ipv4: AtomicCell { value: None } }}: easytier_core::tunnel::ring: waiting accept new conn of key: ring://5f702375-20cf-410d-9ad0-a5d7f9b0e409
2024-09-26T13:42:51.8536776+08:00  INFO run_listener{listener=Mutex { data: TunnelListener { local_url: Url { scheme: "udp", cannot_be_a_base: false, username: "", password: None, host: Some(Ipv6(::)), port: Some(55870), path: "", query: None, fragment: None } } } peer_manager=PeerManager { my_peer_id: 663996417, instance_name: "default", net_ns: None } global_ctx=GlobalCtx { inst_name: "default", id: 5f702375-20cf-410d-9ad0-a5d7f9b0e409, net_ns: None, event_bus: "EventBus", ipv4: AtomicCell { value: None } }}: easytier_core::tunnel::udp: start udp accept: Url { scheme: "udp", cannot_be_a_base: false, username: "", password: None, host: Some(Ipv6(::)), port: Some(55870), path: "", query: None, fragment: None }
2024-09-26T13:42:51.8611764+08:00  INFO easytier_core::connector::manual: reconn_interval tick, done
2024-09-26T13:42:51.8612148+08:00  INFO easytier_core::connector::manual: reconnect: tcp://ettcp.***.***:443
2024-09-26T13:42:51.8614234+08:00  INFO easytier_core::connector::manual: get ip from url done addrs=[172.67.209.98:443, 104.21.50.189:443] dead_url="tcp://ettcp.***.***:443"
2024-09-26T13:42:51.8615209+08:00  INFO easytier_core::connector::manual: reconnect try connect... conn: Mutex { data: TunnelConnector { remote_url: Url { scheme: "tcp", cannot_be_a_base: false, username: "", password: None, host: Some(Domain("ettcp.***.***")), port: Some(443), path: "", query: None, fragment: None } } }
2024-09-26T13:42:51.8617801+08:00  INFO easytier_core::tunnel::tcp: bind addr bind_addr=172.27.208.1:0 addr=172.67.209.98:443
2024-09-26T13:42:51.8842163+08:00  INFO easytier_core::tunnel::tcp: bind addr bind_addr=192.168.2.22:0 addr=172.67.209.98:443
2024-09-26T13:42:51.9073689+08:00  INFO easytier_core::tunnel::tcp: bind addr bind_addr=192.168.122.1:0 addr=172.67.209.98:443
2024-09-26T13:42:51.928436+08:00  INFO easytier_core::tunnel::tcp: bind addr bind_addr=192.168.201.1:0 addr=172.67.209.98:443
2024-09-26T13:42:51.9491306+08:00  INFO easytier_core::tunnel::tcp: bind addr bind_addr=172.18.0.224:0 addr=172.67.209.98:443
2024-09-26T13:42:51.9722285+08:00  INFO update_my_peer_info_routine{service_impl=PeerRouteServiceImpl { my_peer_id: 663996417, sessions: {}, route_table: RouteTable { peer_infos: {}, next_hop_map: {}, ipv4_peer_id_map: {}, cidr_peer_id_map: {} }, route_table_with_cost: RouteTable { peer_infos: {}, next_hop_map: {}, ipv4_peer_id_map: {}, cidr_peer_id_map: {} }, synced_route_info: SyncedRouteInfo { peer_infos: {}, conn_map: {} }, cached_local_conn_map: RouteConnBitmap { peer_ids: [], bitmap: [] } }}: easytier_core::peers::peer_ospf_route: global event received in update_my_peer_info_routine ev=Ok(Connecting(Url { scheme: "tcp", cannot_be_a_base: false, username: "", password: None, host: Some(Domain("ettcp.***.***")), port: Some(443), path: "", query: None, fragment: None }))
2024-09-26T13:42:52.0486643+08:00  INFO detect_nat_type_with_socket{udp=PollEvented { io: Some(UdpSocket { addr: 0.0.0.0:55974, socket: 752 }) }}:stun_packet_listener: easytier_core::common::stun: start stun packet listener
2024-09-26T13:42:52.2102999+08:00  INFO easytier_core::connector::manual: reconnect get tunnel succ: Tunnel { info: Some(TunnelInfo { tunnel_type: "tcp", local_addr: "tcp://192.168.2.22:59503", remote_addr: "tcp://ettcp.***.***:443" }) }
2024-09-26T13:42:52.2103917+08:00  INFO do_handshake_as_client{self=PeerConn { conn_id: 51e12102-dbf9-4b7c-b3cd-f10e115b6610, my_peer_id: 663996417, info: None }}: easytier_core::peers::peer_conn: waiting for handshake request from server
2024-09-26T13:42:52.4461909+08:00  WARN do_handshake_as_client{self=PeerConn { conn_id: 51e12102-dbf9-4b7c-b3cd-f10e115b6610, my_peer_id: 663996417, info: None }}: easytier_core::peers::peer_conn: wait handshake error: TunnelError(InvalidPacket("body too long"))
2024-09-26T13:42:52.4462407+08:00  WARN do_handshake_as_client{self=PeerConn { conn_id: 51e12102-dbf9-4b7c-b3cd-f10e115b6610, my_peer_id: 663996417, info: None }}: easytier_core::peers::peer_conn: wait handshake error: TunnelError(InvalidPacket("body too long"))
2024-09-26T13:42:52.4462553+08:00  WARN do_handshake_as_client{self=PeerConn { conn_id: 51e12102-dbf9-4b7c-b3cd-f10e115b6610, my_peer_id: 663996417, info: None }}: easytier_core::peers::peer_conn: wait handshake error: TunnelError(InvalidPacket("body too long"))

0 replies

wjcroom · 2024-09-27T21:21:22Z

wjcroom
Sep 27, 2024

cloudflare,端口转发的协议细节我不太清楚. 虽然我也用了. 在cloudflare，规则中有个 Origin Rules，
如果你用它的443.,转发,在域名DNS中解析,要打开,代理,
因为我的转发不开代理是过不来的. 而打开后, 会自动转为htts,也就是带证书的加密访问. 在这种情况下, 也就就cloudflare作为中间层, 为原本无证书的服务器加入了ssl..
我的建议1,打开cloudflare的代理.为你这次使用的域名.
2, 若有条件,测试不使用cloudflare映射的,带加密证书的, 两个Node是否可以通信. 比如使用host解析, server绑定自己ssl证书对.然后查看本软件对于, 加密的支持程度.
3,提醒注意, 从被映射的服务端来看, 他全程无证书加密. 从客户端看, 要把服务端当成域名是带加密的. 所以客户端链接的时候要使用证书方案.和原来的不能一样了.

https://nps.ezdial.cn 这是我一个未经加密的服务,加密后的效果,就是通过coudfalre Origin Rules，完成的,

0 replies

wjcroom · 2024-09-28T22:38:25Z

wjcroom
Sep 28, 2024

https://www.afrp.net/
所以如果你只是需要公网转发本地服务.可以开启frpc.
这是目前可用的,,而且我发现一个C的客户端https://github.com/liudf0716/xfrpc
可以的微小设备用.
虽然这样建议,经过测试, 转发以后也是提示, timeout ,无法建立连接.所以不一定是证书的问题