重定向 TCP 连接
我有一个类似代理服务器（用java编写）的东西在我的客户端和实际视频服务器（用c++编写）之间运行。客户端发送的所有内容都会经过此代理，然后重定向到服务器。
它工作正常，但我有一些问题，并且认为如果我能让这个代理服务器仅侦听客户端请求，然后以某种方式告诉服务器已从客户端发出请求，并且它会更好，那就更好了应该直接与客户端创建连接。
基本上在 TCP 级别，我想要发生的事情是这样的：
1-每当客户端向我的代理发送 SYN 时，代理只会向真实服务器发送一条消息，告诉客户端的 IP 和端口。
2- 服务器然后将相应的 SYN-ACK 发送到指定的客户端，在客户端和服务器之间创建直接连接。
然后，代理将仅将初始请求（而不是后来的数据传输）中继到实际服务器。我只是不知道这是否可能。
非常感谢
纳尔逊·佩雷斯
I have something like a proxy server (written in java) running between my clients and the actual video server (made in c++). Everything the clients send goes through this proxy and is then redirected to the server.
It is working fine, but I have some issues and think it would be better if I could make this proxy server only to listen to the clients requests and then somehow tell the server that a request has been made from the client side, and that it is supposed to create a connection with the client directly.
Basically in the TCP level what I want to happen is something like this:
1- whenever a client sends a SYN to my proxy, the proxy just sends a message to the real server telling the ip and port of the client.
2- The server would then send the corresponding SYN-ACK to the specified client creating a direct connection between client and server.
The proxy would then be just relaying the initial requests (but not the later data transfer) to the actual server. I just don't know if that is possible.
Thank you very much
Nelson R. Perez
如果你对这篇内容有疑问，欢迎到本站社区发帖提问 参与讨论，获取更多帮助，或者扫码二维码加入 Web 技术交流群。
绑定邮箱获取回复消息
由于您还没有绑定你的真实邮箱，如果其他用户或者作者回复了您的评论，将不能在第一时间通知您！
发布评论
评论（3）
这就是一些游戏（和 Fog Creek CoPilot）的做法，但它需要服务器和客户端的支持。基本上，代理必须对客户端和服务器说“尝试直接在这个 IP 和这个端口上进行通信”，如果它们无法通过（因为一个或两个位于 NAT 或防火墙后面），它们就会回退到通过代理。
我在 http://www.p2pnat.org 上找到了关于“点对点 tcp 打洞”的很好的描述。 brynosaurus.com/pub/net/p2pnat/
That's very much the way some games (and Fog Creek CoPilot) do it, but it requires support on both the server and the client. Basically the proxy has to say to the client and server "try communicating with the directly on this ip and this port" and if they can't get through (because one or both is behind a NAT or firewall), they fall back to going through the proxy.
I found this good description of "peer to peer tcp hole punching" at http://www.brynosaurus.com/pub/net/p2pnat/
代理和服务器是否位于同一台计算机上？如果是这样，您可以使用套接字传输或文件描述符传递将连接传递到服务器。您可以在此处找到 C 语言示例，
http://www.wsinnovations.com/softeng/ articles/uds.html
如果它们位于不同的机器上，则无法将连接传递到服务器。但是，可以使用 VIP（虚拟 IP）将 IP 数据包代理到服务器。这是在套接字下方，因此您必须使用链接层接口，例如 DLPI。
Does the proxy and server lives on the same machine? If so, you can pass the connection to the server using Socket Transfer or File Descriptor Passing. You can find examples in C here,
http://www.wsinnovations.com/softeng/articles/uds.html
If they are on the different machines, there is no way to pass connection to the server. However, it's possible to proxy the IP packets to server using VIP (Virtual IP). This is below socket so you have to use Link layer interface, like DLPI.
您无法像这样控制用户态的 TCP 握手。这就是防火墙/路由器所做的事情，但这一切都发生在内核中。查看适合您平台的防火墙软件 - 您甚至可能不需要编写任何代码。
You don't have control of TCP handshake in userland like that. This is what firewalls/routers do but it all happens in the kernel. Take a look at the firewalling software for your platform - you might not even have to code anything.