🤔 学习，反思，与胡思乱想

一直以来我都是这么连上家里内网的。

graph LR
    A[My Domain Name] --> B[Cloudflare A Record]
    B --> C[Public IP Address]
    C --> D[Home Network]
    D --> E[Home Machine]

最近想，至少我得掩盖住自己的Public IP Address。

于是想到了用Cloudflare的Proxy模式。

经过一番尝试后发现SSH通不过，查了一下发现Cloudflare proxy模式不能proxy SSH连接。

When you connect by IP address the SSH connection goes directly to your server but if you use the domain name it goes through Cloudflare defenses. My suggestion would be to either use direct.pollnote.com (I think CloudFlare creates it automaticaly but people often remove it) or add your own alias like ssh.pollnote.com and disable CloudFlare protection on it.

Access my server through SSH with the domain (with Cloudflare)

I have this server (44.44.44.44, for instance) running a webserver. I have routed pollnote.com to the server to access my webserver. Everything works fine. To access the server, I added my Public…

https://serverfault.com

于是打算按照上面的建议进行配置。具体如下。

graph TB
    WebClient[Web Client] --> A[my-public.domain.com]
    A -->|HTTP Request| CloudflareProxy[Cloudflare A Record With Proxy]
    CloudflareProxy -->|Port 80/443| C[Public IP Address]
    C --> D[Home Network]
    D --> E[Home Machine]

    SSHClient[SSH Client] -.-> B[my-secret-ssh.domain.com]
    B -.->|SSH Connection| CloudflareNoProxy[Cloudflare A Record Without Proxy]
    CloudflareNoProxy -.-> |Port 22| C

由于无法通过 my-public.domain.com SSH到内网，通过私密的 my-secret-ssh.domain.com URL就可以安心进行SSH访问。具体而言，通过my-public.domain.com进行访问的用户

• 由于Cloudflare的 Proxy，不知道这个网站实际的Public IP
• 只要不暴露my-secret-ssh.domain.com给用户，他就无从知道Public IP

综上，利用分开公开URL和 SSH 用的非公开URL，可以实现Public IP的隐藏。