从外部访问路由器（NAT）后面的不同机器上安装的应用程序的特定实例
问题： 有没有办法可以从Internet上安全地到达机器上的插座，而无需显式配置路由器和防火墙，了解路由器外部IP，专用网络内部IP和端口？鉴于专用网络上的许多机器都运行了目标应用程序，并且只会接受已验证和加密的请求。
我探索的内容：
- 孔冲，SSH，代理/VPN：它们似乎都需要配置路由器以向前端口。
- UPNP：看起来像是解决方案，但是Google告诉我，它已被恶意软件显示，所以也许不是一个长期解决方案？
上下文： 我正在设计一个带有程序（迷你服务器）的系统，该系统从安装的计算机中收集本地数据，并等待已知外部程序（大客户）的请求，该请求安装在云中的某个地方，以发送仅在要求时收集数据。我希望将许多这些迷你服务器安装在客户的私人网络中的许多物理机器上，在其路由器和防火墙后面，他们将将其发送给他们的外部IP（Internet暴露），本地IP（在本地IP上）网络）和启动后面的端口。这些迷你服务器可以在网络上相互交流以解决端口冲突等等，但是我希望能够动态添加新的冲突而无需在路由器配置中再次返回新的端口，因为这是不可扩展的。
我了解难以做到这一点的安全性，但是当我考虑TeamViewer和其他远程桌面应用程序之类的软件时，它们似乎能够在路由器后面的许多机器上行动而没有任何冲突，并且应根据要求外部。
Question:
Is there a way to safely reach an opened socket on a machine from the internet, knowing the routers external ip, the private network internal ip and the port, without having to explicitly configure the router and the firewall? Given that many machines on the private network run the targeted application and will only accept authentified and encrypted requests.
Things I've explored:
- Hole punching, ssh, proxy/vpn: They all seem like they need to configure the router to forward the port.
- UPnP: Would seem like the solution, but Google tells me it's been shown to be used by malicious softwares, so maybe not a long term solution?
Context:
I'm designing a system with a program (mini-server) that collects local data from the computer it is installed on and waits for a request from a known outside program (big-client), installed somewhere in the cloud, to send the collected data only when requested. I expect to have many of these mini-servers installed on many physical machines within a customer's private network, behind its router and firewall, where they would send to the big-client their external ip (internet exposed), local ip (on the local network) and port upon behind booted. These mini-servers can talk to each other on the network to resolve port conflicts and such, but I want to be able to dynamically add new ones without having to go back again in the router config, as this isn't scalable.
I understand the security necessity for this to be difficult to do, but when I think about software like Teamviewer and other remote desktop applications, they seem to be able to act on many machines behind a router without any conflict, and that upon request from the outside.
如果你对这篇内容有疑问，欢迎到本站社区发帖提问 参与讨论，获取更多帮助，或者扫码二维码加入 Web 技术交流群。
绑定邮箱获取回复消息
由于您还没有绑定你的真实邮箱，如果其他用户或者作者回复了您的评论，将不能在第一时间通知您！
发布评论