经过 Cloudflare 映射的公共服务器无法连接，请教是什么原因？

[xezzon]

复现步骤

1. 启动公共服务器。

easytier-core --relay-network-whitelist --relay-all-peer-rpc -m server --file-log-level info --file-log-dir=.

2. 局域网内测试连接。

sudo easytier-core -d --network-name default -p tcp://192.168.9.3:11010 --no-listener --file-log-level info --file-log-dir=.

服务端输出：

2024-09-26 10:20:13: new connection accepted. local: tcp://0.0.0.0:11010, remote: tcp://192.168.9.1:64830

3. 将端口通过 Cloudflare 映射到域名：11010端口映射到ettcp.***.***:443，11011端口映射到etws.***.***:443。

4. 使用 WebSocket 连接。

new WebSocket('wss://etws.***.***:443/') 

服务端输出：

2024-09-26 10:46:44: new connection accepted. local: ws://0.0.0.0:11011/, remote: ws://192.168.9.3:46348/
2024-09-26 10:46:49: connection error. local: ws://0.0.0.0:11011/, remote: ws://192.168.9.3:46348/, err: wait resp error: wait handshake timeout: Elapsed(())

5. 使用 easytier-core 连接。

sudo easytier-core -d --network-name default -p wss://etws.***.***:443 --no-listener --file-log-level info --file-log-dir=.

服务端控制台、日志均无输出。

客户端日志：

2024-09-26T10:54:51.1335355+08:00  INFO easytier::instance::instance: [INIT] instance creating. config: instance_name = "default"
instance_id = "a6bb104c-988b-416a-9c33-5d12a84c6d67"
dhcp = true
listeners = []
rpc_portal = "127.0.0.1:0"

[network_identity]
network_name = "default"
network_secret = ""

[[peer]]
uri = "wss://etws.***.***/"

2024-09-26T10:54:51.1336782+08:00  INFO easytier::peers::peer_rpc: [PEER RPC MGR] register service 1 succeed, my_node_id 425427663
2024-09-26T10:54:51.1337035+08:00  WARN easytier::connector::manual: conn_mgr_routine started
2024-09-26T10:54:51.1346126+08:00  WARN easytier::instance::listeners: run listener: Listener { inner: Mutex { data: TunnelListener { local_url: Url { scheme: "ring", cannot_be_a_base: false, username: "", password: None, host: Some(Domain("a6bb104c-988b-416a-9c33-5d12a84c6d67")), port: None, path: "", query: None, fragment: None } } }, must_succ: true }
2024-09-26T10:54:51.1346364+08:00  INFO easytier::tunnel::ring: listen new conn of key: ring://a6bb104c-988b-416a-9c33-5d12a84c6d67
2024-09-26T10:54:51.1346603+08:00  WARN easytier::instance::listeners: run listener: Listener { inner: Mutex { data: TunnelListener { local_url: Url { scheme: "udp", cannot_be_a_base: false, username: "", password: None, host: Some(Ipv6(::)), port: Some(0), path: "", query: None, fragment: None } } }, must_succ: false }
2024-09-26T10:54:51.1347075+08:00  INFO run_listener{listener=Mutex { data: TunnelListener { local_url: Url { scheme: "ring", cannot_be_a_base: false, username: "", password: None, host: Some(Domain("a6bb104c-988b-416a-9c33-5d12a84c6d67")), port: None, path: "", query: None, fragment: None } } } peer_manager=PeerManager { my_peer_id: 425427663, instance_name: "default", net_ns: None } global_ctx=GlobalCtx { inst_name: "default", id: a6bb104c-988b-416a-9c33-5d12a84c6d67, net_ns: None, event_bus: "EventBus", ipv4: AtomicCell { value: None } }}: easytier::tunnel::ring: waiting accept new conn of key: ring://a6bb104c-988b-416a-9c33-5d12a84c6d67
2024-09-26T10:54:51.1349351+08:00  INFO easytier::peers::peer_rpc: [PEER RPC MGR] register service 7 succeed, my_node_id 425427663
2024-09-26T10:54:51.1349606+08:00  INFO run_listener{listener=Mutex { data: TunnelListener { local_url: Url { scheme: "udp", cannot_be_a_base: false, username: "", password: None, host: Some(Ipv6(::)), port: Some(60575), path: "", query: None, fragment: None } } } peer_manager=PeerManager { my_peer_id: 425427663, instance_name: "default", net_ns: None } global_ctx=GlobalCtx { inst_name: "default", id: a6bb104c-988b-416a-9c33-5d12a84c6d67, net_ns: None, event_bus: "EventBus", ipv4: AtomicCell { value: None } }}: easytier::tunnel::udp: start udp accept: Url { scheme: "udp", cannot_be_a_base: false, username: "", password: None, host: Some(Ipv6(::)), port: Some(60575), path: "", query: None, fragment: None }
2024-09-26T10:54:51.1349782+08:00  INFO easytier::peers::peer_rpc: [PEER RPC MGR] register service 1 succeed, my_node_id 425427663
2024-09-26T10:54:51.1352014+08:00  INFO easytier::peers::peer_rpc: [PEER RPC MGR] register service 2 succeed, my_node_id 425427663
2024-09-26T10:54:51.1352151+08:00  INFO easytier::peers::peer_rpc: [PEER RPC MGR] register service 50 succeed, my_node_id 425427663
2024-09-26T10:54:51.144466+08:00  INFO easytier::connector::manual: add_connector: wss://etws.***.***/
2024-09-26T10:54:51.2301937+08:00  INFO detect_nat_type_with_socket{udp=PollEvented { io: Some(UdpSocket { addr: 0.0.0.0:60574, socket: 1652 }) }}:stun_packet_listener: easytier::common::stun: start stun packet listener
2024-09-26T10:54:52.1456148+08:00  INFO easytier::connector::manual: reconn_interval tick, done
2024-09-26T10:54:52.1456653+08:00  INFO easytier::connector::manual: reconnect: wss://etws.***.***/
2024-09-26T10:54:52.1461109+08:00  INFO easytier::connector::manual: get ip from url done addrs=[104.21.50.189:443, 172.67.209.98:443] dead_url="wss://etws.***.***/"
2024-09-26T10:54:52.1461443+08:00  INFO easytier::connector::manual: reconnect try connect... conn: Mutex { data: TunnelConnector { remote_url: Url { scheme: "wss", cannot_be_a_base: false, username: "", password: None, host: Some(Domain("etws.***.***")), port: None, path: "/", query: None, fragment: None } } }
2024-09-26T10:54:52.1463709+08:00  INFO easytier::tunnel::websocket: bind addr bind_addr=172.27.208.1:0 addr=104.21.50.189:443
2024-09-26T10:54:52.174761+08:00  INFO easytier::tunnel::websocket: bind addr bind_addr=192.168.2.22:0 addr=104.21.50.189:443
2024-09-26T10:54:52.2022989+08:00  INFO easytier::tunnel::websocket: bind addr bind_addr=192.168.122.1:0 addr=104.21.50.189:443
2024-09-26T10:54:52.230169+08:00  INFO easytier::tunnel::websocket: bind addr bind_addr=192.168.201.1:0 addr=104.21.50.189:443
2024-09-26T10:54:52.2563411+08:00  INFO easytier::tunnel::websocket: bind addr bind_addr=172.18.0.224:0 addr=104.21.50.189:443
2024-09-26T10:54:52.2840826+08:00  INFO update_my_peer_info_routine{service_impl=PeerRouteServiceImpl { my_peer_id: 425427663, sessions: {}, route_table: RouteTable { peer_infos: {}, next_hop_map: {}, ipv4_peer_id_map: {}, cidr_peer_id_map: {} }, route_table_with_cost: RouteTable { peer_infos: {}, next_hop_map: {}, ipv4_peer_id_map: {}, cidr_peer_id_map: {} }, synced_route_info: SyncedRouteInfo { peer_infos: {}, conn_map: {} }, cached_local_conn_map: RouteConnBitmap { peer_ids: [], bitmap: [] } }}: easytier::peers::peer_ospf_route: global event received in update_my_peer_info_routine ev=Ok(Connecting(Url { scheme: "wss", cannot_be_a_base: false, username: "", password: None, host: Some(Domain("etws.***.***")), port: None, path: "/", query: None, fragment: None }))
2024-09-26T10:54:52.7148826+08:00  INFO easytier::connector::manual: reconnect: wss://etws.***.***/ done, ret: Ok(Err(TunnelError(IOError(Custom { kind: InvalidData, error: AlertReceived(HandshakeFailure) }))))
2024-09-26T10:54:52.7149545+08:00  WARN easytier::connector::manual: reconn_tasks done, reconn result: Some(Err(TunnelError(IOError(Custom { kind: InvalidData, error: AlertReceived(HandshakeFailure) }))))
2024-09-26T10:54:52.7149772+08:00  INFO update_my_peer_info_routine{service_impl=PeerRouteServiceImpl { my_peer_id: 425427663, sessions: {}, route_table: RouteTable { peer_infos: {}, next_hop_map: {}, ipv4_peer_id_map: {}, cidr_peer_id_map: {} }, route_table_with_cost: RouteTable { peer_infos: {}, next_hop_map: {}, ipv4_peer_id_map: {}, cidr_peer_id_map: {} }, synced_route_info: SyncedRouteInfo { peer_infos: {}, conn_map: {} }, cached_local_conn_map: RouteConnBitmap { peer_ids: [], bitmap: [] } }}: easytier::peers::peer_ospf_route: global event received in update_my_peer_info_routine ev=Ok(ConnectError("wss://etws.***.***/", "V4", "Err(TunnelError(IOError(Custom { kind: InvalidData, error: AlertReceived(HandshakeFailure) })))"))

原因猜测

是不是因为不支持TLS？或者说哪里的配置有问题。

[KKRainbow]

将端口通过 Cloudflare 映射到域名：11010端口映射到ettcp..:443，11011端口映射到etws..:443。

11011 是 ws
11012 是 wss

是不是映射端口写错了

[xezzon]

应该不是这个原因。反向代理的时候会把wss转成ws，在控制台用 WebSocket 连的时候，服务端是可以监听到的，并且确实是 11011 端口收到了 ws 的数据包。

2024-09-26 10:46:44: new connection accepted. local: ws://0.0.0.0:11011/, remote: ws://192.168.9.3:46348/
2024-09-26 10:46:49: connection error. local: ws://0.0.0.0:11011/, remote: ws://192.168.9.3:46348/, err: wait resp error: wait handshake timeout: Elapsed(())

[xezzon]

TCP连接也失败，不过日志与 ws 连接不太一样。日志在疯狂输出TunnelError(InvalidPacket("body too long"))。

2024-09-26T13:42:51.6123993+08:00  INFO easytier_core::instance::instance: [INIT] instance creating. config: instance_name = "default"
instance_id = "5f702375-20cf-410d-9ad0-a5d7f9b0e409"
dhcp = true
listeners = []
exit_nodes = []
rpc_portal = "127.0.0.1:15888"

[network_identity]
network_name = "default"
network_secret = ""

[[peer]]
uri = "tcp://ettcp.***.***:443"

[file_logger]
level = "info"
file = "easytier-default"
dir = "."

[flags]
default_protocol = "tcp"
dev_name = ""
enable_encryption = true
enable_ipv6 = true
mtu = 1380
latency_first = false
enable_exit_node = false
no_tun = false
use_smoltcp = false
foreign_network_whitelist = "*"
disable_p2p = false
relay_all_peer_rpc = false

2024-09-26T13:42:51.612699+08:00  INFO easytier_core::peers::peer_rpc: [PEER RPC MGR] register service 1 succeed, my_node_id 663996417
2024-09-26T13:42:51.6137647+08:00  WARN easytier_core::instance::listeners: run listener: Listener { inner: Mutex { data: TunnelListener { local_url: Url { scheme: "ring", cannot_be_a_base: false, username: "", password: None, host: Some(Domain("5f702375-20cf-410d-9ad0-a5d7f9b0e409")), port: None, path: "", query: None, fragment: None } } }, must_succ: true }
2024-09-26T13:42:51.6138241+08:00  INFO easytier_core::tunnel::ring: listen new conn of key: ring://5f702375-20cf-410d-9ad0-a5d7f9b0e409
2024-09-26T13:42:51.6138455+08:00  WARN easytier_core::instance::listeners: run listener: Listener { inner: Mutex { data: TunnelListener { local_url: Url { scheme: "udp", cannot_be_a_base: false, username: "", password: None, host: Some(Ipv6(::)), port: Some(0), path: "", query: None, fragment: None } } }, must_succ: false }
2024-09-26T13:42:51.6143715+08:00  INFO easytier_core::peers::peer_rpc: [PEER RPC MGR] register service 7 succeed, my_node_id 663996417
2024-09-26T13:42:51.6144275+08:00  INFO easytier_core::peers::peer_rpc: [PEER RPC MGR] register service 1 succeed, my_node_id 663996417
2024-09-26T13:42:51.6146181+08:00  INFO easytier_core::peers::peer_rpc: [PEER RPC MGR] register service 2 succeed, my_node_id 663996417
2024-09-26T13:42:51.6146277+08:00  INFO easytier_core::peers::peer_rpc: [PEER RPC MGR] register service 50 succeed, my_node_id 663996417
2024-09-26T13:42:51.8532349+08:00  INFO easytier_core::connector::manual: add_connector: tcp://ettcp.***.***:443
2024-09-26T13:42:51.8534939+08:00  WARN easytier_core::connector::manual: conn_mgr_routine started
2024-09-26T13:42:51.8536164+08:00  INFO run_listener{listener=Mutex { data: TunnelListener { local_url: Url { scheme: "ring", cannot_be_a_base: false, username: "", password: None, host: Some(Domain("5f702375-20cf-410d-9ad0-a5d7f9b0e409")), port: None, path: "", query: None, fragment: None } } } peer_manager=PeerManager { my_peer_id: 663996417, instance_name: "default", net_ns: None } global_ctx=GlobalCtx { inst_name: "default", id: 5f702375-20cf-410d-9ad0-a5d7f9b0e409, net_ns: None, event_bus: "EventBus", ipv4: AtomicCell { value: None } }}: easytier_core::tunnel::ring: waiting accept new conn of key: ring://5f702375-20cf-410d-9ad0-a5d7f9b0e409
2024-09-26T13:42:51.8536776+08:00  INFO run_listener{listener=Mutex { data: TunnelListener { local_url: Url { scheme: "udp", cannot_be_a_base: false, username: "", password: None, host: Some(Ipv6(::)), port: Some(55870), path: "", query: None, fragment: None } } } peer_manager=PeerManager { my_peer_id: 663996417, instance_name: "default", net_ns: None } global_ctx=GlobalCtx { inst_name: "default", id: 5f702375-20cf-410d-9ad0-a5d7f9b0e409, net_ns: None, event_bus: "EventBus", ipv4: AtomicCell { value: None } }}: easytier_core::tunnel::udp: start udp accept: Url { scheme: "udp", cannot_be_a_base: false, username: "", password: None, host: Some(Ipv6(::)), port: Some(55870), path: "", query: None, fragment: None }
2024-09-26T13:42:51.8611764+08:00  INFO easytier_core::connector::manual: reconn_interval tick, done
2024-09-26T13:42:51.8612148+08:00  INFO easytier_core::connector::manual: reconnect: tcp://ettcp.***.***:443
2024-09-26T13:42:51.8614234+08:00  INFO easytier_core::connector::manual: get ip from url done addrs=[172.67.209.98:443, 104.21.50.189:443] dead_url="tcp://ettcp.***.***:443"
2024-09-26T13:42:51.8615209+08:00  INFO easytier_core::connector::manual: reconnect try connect... conn: Mutex { data: TunnelConnector { remote_url: Url { scheme: "tcp", cannot_be_a_base: false, username: "", password: None, host: Some(Domain("ettcp.***.***")), port: Some(443), path: "", query: None, fragment: None } } }
2024-09-26T13:42:51.8617801+08:00  INFO easytier_core::tunnel::tcp: bind addr bind_addr=172.27.208.1:0 addr=172.67.209.98:443
2024-09-26T13:42:51.8842163+08:00  INFO easytier_core::tunnel::tcp: bind addr bind_addr=192.168.2.22:0 addr=172.67.209.98:443
2024-09-26T13:42:51.9073689+08:00  INFO easytier_core::tunnel::tcp: bind addr bind_addr=192.168.122.1:0 addr=172.67.209.98:443
2024-09-26T13:42:51.928436+08:00  INFO easytier_core::tunnel::tcp: bind addr bind_addr=192.168.201.1:0 addr=172.67.209.98:443
2024-09-26T13:42:51.9491306+08:00  INFO easytier_core::tunnel::tcp: bind addr bind_addr=172.18.0.224:0 addr=172.67.209.98:443
2024-09-26T13:42:51.9722285+08:00  INFO update_my_peer_info_routine{service_impl=PeerRouteServiceImpl { my_peer_id: 663996417, sessions: {}, route_table: RouteTable { peer_infos: {}, next_hop_map: {}, ipv4_peer_id_map: {}, cidr_peer_id_map: {} }, route_table_with_cost: RouteTable { peer_infos: {}, next_hop_map: {}, ipv4_peer_id_map: {}, cidr_peer_id_map: {} }, synced_route_info: SyncedRouteInfo { peer_infos: {}, conn_map: {} }, cached_local_conn_map: RouteConnBitmap { peer_ids: [], bitmap: [] } }}: easytier_core::peers::peer_ospf_route: global event received in update_my_peer_info_routine ev=Ok(Connecting(Url { scheme: "tcp", cannot_be_a_base: false, username: "", password: None, host: Some(Domain("ettcp.***.***")), port: Some(443), path: "", query: None, fragment: None }))
2024-09-26T13:42:52.0486643+08:00  INFO detect_nat_type_with_socket{udp=PollEvented { io: Some(UdpSocket { addr: 0.0.0.0:55974, socket: 752 }) }}:stun_packet_listener: easytier_core::common::stun: start stun packet listener
2024-09-26T13:42:52.2102999+08:00  INFO easytier_core::connector::manual: reconnect get tunnel succ: Tunnel { info: Some(TunnelInfo { tunnel_type: "tcp", local_addr: "tcp://192.168.2.22:59503", remote_addr: "tcp://ettcp.***.***:443" }) }
2024-09-26T13:42:52.2103917+08:00  INFO do_handshake_as_client{self=PeerConn { conn_id: 51e12102-dbf9-4b7c-b3cd-f10e115b6610, my_peer_id: 663996417, info: None }}: easytier_core::peers::peer_conn: waiting for handshake request from server
2024-09-26T13:42:52.4461909+08:00  WARN do_handshake_as_client{self=PeerConn { conn_id: 51e12102-dbf9-4b7c-b3cd-f10e115b6610, my_peer_id: 663996417, info: None }}: easytier_core::peers::peer_conn: wait handshake error: TunnelError(InvalidPacket("body too long"))
2024-09-26T13:42:52.4462407+08:00  WARN do_handshake_as_client{self=PeerConn { conn_id: 51e12102-dbf9-4b7c-b3cd-f10e115b6610, my_peer_id: 663996417, info: None }}: easytier_core::peers::peer_conn: wait handshake error: TunnelError(InvalidPacket("body too long"))
2024-09-26T13:42:52.4462553+08:00  WARN do_handshake_as_client{self=PeerConn { conn_id: 51e12102-dbf9-4b7c-b3cd-f10e115b6610, my_peer_id: 663996417, info: None }}: easytier_core::peers::peer_conn: wait handshake error: TunnelError(InvalidPacket("body too long"))

[wjcroom]

cloudflare,端口转发的协议细节我不太清楚. 虽然我也用了. 在cloudflare，规则中有个 Origin Rules，
如果你用它的443.,转发,在域名DNS中解析,要打开,代理,
因为我的转发不开代理是过不来的. 而打开后, 会自动转为htts,也就是带证书的加密访问. 在这种情况下, 也就就cloudflare作为中间层, 为原本无证书的服务器加入了ssl..
我的建议1,打开cloudflare的代理.为你这次使用的域名.
2, 若有条件,测试不使用cloudflare映射的,带加密证书的, 两个Node是否可以通信. 比如使用host解析, server绑定自己ssl证书对.然后查看本软件对于, 加密的支持程度.
3,提醒注意, 从被映射的服务端来看, 他全程无证书加密. 从客户端看, 要把服务端当成域名是带加密的. 所以客户端链接的时候要使用证书方案.和原来的不能一样了.

https://nps.ezdial.cn 这是我一个未经加密的服务,加密后的效果,就是通过coudfalre Origin Rules， 完成的,

[wjcroom]

https://www.afrp.net/
所以如果你只是需要公网转发 本地服务.可以开启frpc.
这是目前可用的,,而且我发现一个C的客户端https://github.com/liudf0716/xfrpc
可以的微小设备用.
虽然这样建议,经过测试, 转发以后也是提示, timeout ,无法建立连接.所以不一定是证书的问题