如何连接防火墙后面的两个客户端？
当使用 Live Messenger 等即时消息应用程序或 Google Talk 桌面客户端时，计算机可以在彼此之间传输文件。 我不能肯定地说，但我相当确定计算机之间传输的数据不会通过微软或谷歌的 IM 服务器，而是装有 IM 软件的两台计算机直接相互通信。 我想知道客户之间是否或如何建立这种直接连接，以及我自己如何实现类似的东西。
我有一些使用个人网络的经验，但我只了解客户端-服务器关系，其中服务器始终在侦听（并且端口不被防火墙阻止），并且客户端在需要数据时向服务器发出请求。
When using an instant messaging application like Live Messenger or the desktop client for Google Talk, computers can transfer files between one another. I can't say for sure, but I'm fairly certain that the data being transferred between computers does not go through Microsoft's or Google's IM servers, rather the two computers with the IM software communicate directly with each other. I'm wondering if or how this direct connection between the clients is established and how I would implement something similar myself.
I have some experience working with personal networks but I only understand a client-server relationship, where the server is always listening (and ports are not blocked by a firewall) and the client makes a request to the server whenever data is needed.
如果你对这篇内容有疑问，欢迎到本站社区发帖提问 参与讨论，获取更多帮助，或者扫码二维码加入 Web 技术交流群。
绑定邮箱获取回复消息
由于您还没有绑定你的真实邮箱，如果其他用户或者作者回复了您的评论，将不能在第一时间通知您！
发布评论
评论（5）
如果两个客户端都位于未打孔的防火墙后面且未使用 VPN 软件，则它们将通过第 3 方服务器进行通信。 时期。
If both clients are behind a firewall that hasn't been pinholed and no VPN software is being employed they are communicating through a 3rd party server. Period.
如果我要实现这个，我会考虑几个选项。
让防火墙将给定端口转发到网络内的 PC。 这将允许您从外部世界连接到服务器。
让防火墙后面的客户端连接到防火墙外部的可见服务器。
让
简而言之，对话中的至少一方需要对其他方可见（服务器），以便他们可以连接到它。 不管怎样，一旦建立连接，客户端和服务器将能够毫无问题地来回通信。
If I were implementing this, I'd look at a couple of options.
Have the firewall forward a given port to a PC inside the network. This will let you connect to a server from the outside world.
Have the client(s) behind the firewall connect to a visible server outside of the firewall.
In short, at least one party in the conversation needs to be visible (the server) to the other(s) so they can connect to it. Regardless of how, once a connection is made, the client and server will be able to communicate back and forth without any problems.
执行大多数木马的操作：
编辑：
Do what most trojans do:
EDIT:
我使用了一个名为 Hamachi 的程序，它有点像点对点-peer vpn（虚拟网络到网络）。 然后我按原样编写了客户端服务器应用程序。 这是一种获得互联网连接功能的快速方法，无需处理 NAT 路由器所需的技巧。
如果您需要“正确”地执行此操作，常用方法之一是udp 打洞。 当您发送网络请求时，您的防火墙知道需要返回数据作为响应。 诀窍是客户端 A 和客户端 B 都与 Internet 上的服务器联系。 服务器将客户端 A 发出的请求的详细信息传递给客户端 B，反之亦然。 一旦建立初始连接，即使主服务器不再存在，它们也可以继续通信。
I've used a program called Hamachi which is a bit like a peer-to-peer vpn (virtual network-to-network). Then I wrote the client server applications as is. It was a quick way to get the functionality of connecting over the Internet without the trickery needed for dealing with NAT routers.
If you need to do it 'properly', one of the common methods is udp hole punching. When you send a web request your firewall knows to expect back data in response. The trick is that both client A and client B contact a server on the Internet. The server passes details of the request client A made to client B and and vice versa. Once the initial connection is established they can continue communicate even if the main server is no longer there.
许多客户端使用一种称为“pin Holing”的方法：
我向您发送一个 UDP 数据包，这会在我的防火墙上戳一个洞（允许 UDP 数据包（假设是我的防火墙的响应）由您发送并由我）。 该数据包被防火墙丢弃。
你向我发送了一个 UDP 数据包，在你的防火墙上戳了一个洞。 该数据包应该会到达我，此时我可以发送另一个数据包来到达您，我们可以通过防火墙通过 UDP 进行通信。
There is a method used by many clients called "pin holing":
I send a UDP packet at you, which pokes a hole in my firewall (allowing UDP packets, assumed to be responses by my firewall, to be sent by you and received by me). That packet gets discarded by your firewall.
You send a UDP packet to me, poking a hole in your firewall. That packet should reach me, at which point I can send another one to reach you and we can communicate, through our firewalls, over UDP.