mirror of
https://gitee.com/xmz7891/ykxmz.git
synced 2026-10-19 13:00:44 +00:00
ykxmz 1.5.0锛氫慨澶嶆墜琛ㄧ TLS 璇佷功鏍￠獙 + MTU 淇缃戠粶绋冲畾鎬?
琚帶绔?- 淇 MTU 闂锛氬す MSS + 璺緞 MTU 鎺㈡祴锛堝叕缃戝彲鐢ㄧ巼 48% -> 100%锛?- 澶嶇敤 HTTP 杩炴帴锛堝厤鎺夋瘡娆℃柊寤?TLS 鐨?30% 鎻℃墜澶辫触锛?- 姣忓垎閽熷洖澶存壘灞€鍩熺綉锛岃嚜鍔ㄥ垏鍥炲揩 400 鍊嶇殑璺緞 - 鐢婚潰蹇冭烦甯э細闈欐鏃剁渷娴侀噺锛屽鎴风浠嶇煡閬撴祦鏄椿鐨?- 閿佸睆鏃剁粰鍑哄彲鎿嶄綔鐨勬彁绀? 鎵嬭〃绔?- 鍐呯疆 GTS Root R4 / GlobalSign Root CA锛屼慨 SSLHandshakeException - 杩炴帴閿欒缈昏瘧鎴愪汉璇濓紙璇佷功/鏃堕棿/瑙ｆ瀽/瓒呮椂鍒嗗埆鎻愮ず锛?- 缁忎腑杞繛涓婂悗鐢ㄦ湇鍔″櫒鎶ョ殑鍦板潃鍒锋柊宸查厤瀵硅褰?- 鏂板灞€鍩熺綉杩炴帴椤甸潰銆佹湇鍔″櫒寤惰繜妫€娴? 鏈嶅姟鍣ㄧ - 鏀寔 chunked 璇锋眰浣擄紙淇瘡 16 绉掍竴娆＄殑杩炴帴閿欎贡涓庡ぇ闈㈢Н 502锛?- 缃戠粶璋冧紭鑴氭湰 net-tune.sh锛堝紑鏈鸿嚜鍔ㄥ簲鐢級 - 绠＄悊椤碉細鎵归噺鍒犻櫎銆佺綉缁滀綋妫€銆佷笅杞藉尯 - 闅ч亾鏀?HTTP/2 + 鍙岃繛鎺? 鏂囨。 - 璁稿彲鍗忚 / 瀹夎鍓嶅繀璇?/ 瀹夎鍚庨』鐭ワ紙浣滆€咃細灏忛害瀛愶級
This commit is contained in:
xmz7891
@@ -0,0 +1,169 @@
|
||||
#!/bin/bash
|
||||
# 建具名隧道（固定域名），替换掉会变地址的匿名隧道。
|
||||
#
|
||||
# 前提：已经 cloudflared tunnel login 授权过（/root/.cloudflared/cert.pem 存在）
|
||||
#
|
||||
# 做的事：
|
||||
# 1. 建一个叫 lanremote 的隧道
|
||||
# 2. 把 relay.<域名> 指到它
|
||||
# 3. 写隧道配置（指向本机 8080）
|
||||
# 4. 改 systemd 服务，改成跑具名隧道
|
||||
# 5. 重启并验证
|
||||
#
|
||||
# 具名隧道的好处（对比匿名）：
|
||||
# * 地址固定，不用每次重启都改客户端配置
|
||||
# * 不受匿名隧道限流（实测匿名隧道经常 context deadline exceeded）
|
||||
# * Cloudflare 官方支持的生产用法
|
||||
set -u
|
||||
|
||||
DOMAIN="${1:-xxmxxs.top}"
|
||||
HOSTNAME_FULL="${2:-relay.${DOMAIN}}"
|
||||
TUNNEL_NAME=lanremote
|
||||
CF_DIR=/root/.cloudflared
|
||||
RELAY_DIR=/root/lanremote-relay
|
||||
CONF="$CF_DIR/config.yml"
|
||||
|
||||
echo "============================================================"
|
||||
echo " 建具名隧道：$TUNNEL_NAME 域名：$HOSTNAME_FULL"
|
||||
echo "============================================================"
|
||||
echo
|
||||
|
||||
# ---------- 0. 检查授权 ----------
|
||||
echo "[0/6] 检查授权"
|
||||
if [ ! -f "$CF_DIR/cert.pem" ]; then
|
||||
echo " ✗ 还没有 cert.pem —— 请先在浏览器里完成授权"
|
||||
echo " 链接： $(cat /root/cf_login_url.txt 2>/dev/null)"
|
||||
exit 1
|
||||
fi
|
||||
echo " ✓ cert.pem 存在"
|
||||
|
||||
# ---------- 1. 建隧道 ----------
|
||||
echo
|
||||
echo "[1/6] 创建隧道"
|
||||
EXISTING=$(cloudflared tunnel list 2>/dev/null | awk -v n="$TUNNEL_NAME" '$2 == n {print $1}')
|
||||
if [ -n "$EXISTING" ]; then
|
||||
TUNNEL_ID="$EXISTING"
|
||||
echo " 已存在，ID: $TUNNEL_ID"
|
||||
else
|
||||
OUT=$(cloudflared tunnel create "$TUNNEL_NAME" 2>&1)
|
||||
echo "$OUT" | sed 's/^/ /'
|
||||
TUNNEL_ID=$(echo "$OUT" | grep -oE '[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}' | head -1)
|
||||
if [ -z "$TUNNEL_ID" ]; then
|
||||
TUNNEL_ID=$(cloudflared tunnel list 2>/dev/null | awk -v n="$TUNNEL_NAME" '$2 == n {print $1}')
|
||||
fi
|
||||
fi
|
||||
if [ -z "$TUNNEL_ID" ]; then
|
||||
echo " ✗ 拿不到隧道 ID"
|
||||
exit 1
|
||||
fi
|
||||
echo " 隧道 ID: $TUNNEL_ID"
|
||||
|
||||
# ---------- 2. 凭据文件 ----------
|
||||
echo
|
||||
echo "[2/6] 检查凭据文件"
|
||||
CRED="$CF_DIR/${TUNNEL_ID}.json"
|
||||
if [ ! -f "$CRED" ]; then
|
||||
echo " ✗ 找不到凭据 $CRED"
|
||||
ls -la "$CF_DIR"
|
||||
exit 1
|
||||
fi
|
||||
echo " ✓ $CRED"
|
||||
|
||||
# ---------- 3. 配 DNS ----------
|
||||
echo
|
||||
echo "[3/6] 把 $HOSTNAME_FULL 指向这个隧道"
|
||||
DNS_OUT=$(cloudflared tunnel route dns "$TUNNEL_NAME" "$HOSTNAME_FULL" 2>&1)
|
||||
echo "$DNS_OUT" | sed 's/^/ /'
|
||||
if echo "$DNS_OUT" | grep -qi 'already exists'; then
|
||||
echo " (DNS 记录已存在，跳过)"
|
||||
fi
|
||||
|
||||
# ---------- 4. 写配置 ----------
|
||||
echo
|
||||
echo "[4/6] 写隧道配置"
|
||||
cat > "$CONF" <<EOF
|
||||
# 局域网遥控 · 具名隧道配置
|
||||
tunnel: $TUNNEL_ID
|
||||
credentials-file: $CRED
|
||||
|
||||
ingress:
|
||||
- hostname: $HOSTNAME_FULL
|
||||
service: http://127.0.0.1:8080
|
||||
originRequest:
|
||||
# 长轮询每个请求挂 25 秒，超时要给够
|
||||
connectTimeout: 30s
|
||||
# 中转是流式响应，关掉缓冲
|
||||
noTLSVerify: false
|
||||
disableChunkedEncoding: false
|
||||
- service: http_status:404
|
||||
EOF
|
||||
echo " 已写 $CONF"
|
||||
cat "$CONF" | sed 's/^/ /'
|
||||
|
||||
# ---------- 5. 改 systemd ----------
|
||||
echo
|
||||
echo "[5/6] 改 systemd 服务为具名隧道"
|
||||
cat > /etc/systemd/system/lanremote-tunnel.service <<EOF
|
||||
[Unit]
|
||||
Description=LanRemote Cloudflare 具名隧道
|
||||
After=network-online.target lanremote-relay.service
|
||||
Wants=network-online.target
|
||||
Requires=lanremote-relay.service
|
||||
|
||||
[Service]
|
||||
Type=simple
|
||||
# 具名隧道：地址固定为 $HOSTNAME_FULL
|
||||
# 仍然强制 IPv4 —— 这条 4G 线路有 IPv6 地址但实际不通
|
||||
ExecStart=/usr/local/bin/cloudflared tunnel --no-autoupdate --edge-ip-version 4 --config $CONF run $TUNNEL_NAME
|
||||
Restart=always
|
||||
RestartSec=5
|
||||
MemoryMax=128M
|
||||
StandardOutput=append:$RELAY_DIR/tunnel.log
|
||||
StandardError=append:$RELAY_DIR/tunnel.log
|
||||
|
||||
[Install]
|
||||
WantedBy=multi-user.target
|
||||
EOF
|
||||
systemctl daemon-reload
|
||||
systemctl stop lanremote-tunnel 2>/dev/null || true
|
||||
pkill -f 'cloudflared tunnel --no-autoupdate' 2>/dev/null || true
|
||||
sleep 2
|
||||
rm -f "$RELAY_DIR/tunnel.log"
|
||||
systemctl start lanremote-tunnel
|
||||
echo " 已启动"
|
||||
|
||||
# ---------- 6. 验证 ----------
|
||||
echo
|
||||
echo "[6/6] 等着并验证"
|
||||
# 一定要带 https:// —— public_url() 只认以 http 开头的，
|
||||
# 少了协议头 /url 接口会显示"还没有地址"。
|
||||
echo "https://$HOSTNAME_FULL" > "$RELAY_DIR/public_url.txt"
|
||||
sleep 12
|
||||
|
||||
for i in 1 2 3 4 5 6; do
|
||||
CODE=$(curl -s -o /dev/null -w '%{http_code}' --max-time 15 \
|
||||
"https://$HOSTNAME_FULL/v1/health")
|
||||
if [ "$CODE" = "200" ]; then
|
||||
echo " 第 $i 次: ✓ 通了"
|
||||
break
|
||||
fi
|
||||
echo " 第 $i 次: HTTP $CODE（隧道可能还在建）"
|
||||
sleep 8
|
||||
done
|
||||
|
||||
echo
|
||||
echo " 服务状态: $(systemctl is-active lanremote-tunnel)"
|
||||
echo " 隧道日志尾部:"
|
||||
tail -5 "$RELAY_DIR/tunnel.log" | sed 's/^/ /'
|
||||
|
||||
echo
|
||||
echo "============================================================"
|
||||
echo " 公网地址（固定，不会再变）："
|
||||
echo " https://$HOSTNAME_FULL"
|
||||
echo " 管理页："
|
||||
echo " https://$HOSTNAME_FULL/?key=\$(cat $RELAY_DIR/data/admin_key.txt)"
|
||||
echo "============================================================"
|
||||
echo
|
||||
echo " 接下来在被控端执行一次："
|
||||
echo " LanRemote-Agent.exe --relay https://$HOSTNAME_FULL"
|
||||
echo " 手表首页「中转设置」里填同一个地址。"
|
||||
Reference in New Issue
Block a user