[{"data":1,"prerenderedAt":466},["ShallowReactive",2],{"article-\u002Fblog\u002F10-技术专栏\u002F20-network\u002F15.关于NAT回流与内网域名直连的终极指南":3,"article-around-\u002Fblog\u002F10-技术专栏\u002F20-network\u002F15.关于NAT回流与内网域名直连的终极指南":248},{"id":4,"title":5,"author":6,"body":7,"category":231,"cover":232,"date":233,"description":5,"draft":234,"extension":235,"image":236,"license":232,"meta":237,"minutes":142,"navigation":132,"path":238,"pinned":234,"seo":239,"stem":240,"tags":241,"__hash__":247},"blog\u002Fblog\u002F10-技术专栏\u002F20-network\u002F15.关于NAT回流与内网域名直连的终极指南.md","关于 NAT 回流与内网域名直连的终极指南","张萌萌",{"type":8,"value":9,"toc":219},"minimark",[10,15,19,23,28,36,58,72,76,91,95,99,102,163,167,170,177,199,204,208,215],[11,12,14],"h2",{"id":13},"_1-序言","1 序言",[16,17,18],"p",{},"折腾 NAS 的小伙伴大都有 IPv4 公网，再不济 IPv6 肯定有的，也都配置了 DDNS 或者 Lucky 这样的域名解析，可以非常方便地在外访问家里的服务。但此时会出现一个奇怪的问题，内网使用域名访问服务时，大概率会失败，依然需要手动输入内网 IP。这种“内网体验不如外网”的逻辑阻塞了许多人的体验。这次和我深入探讨 NAT 回流的本质，并提供最优雅的解决方案。",[11,20,22],{"id":21},"_2-技术原理深度分析","2 技术原理深度分析",[24,25,27],"h3",{"id":26},"_21-nat-回流-nat-loopback-的底层逻辑","2.1 NAT 回流 (NAT Loopback) 的底层逻辑",[16,29,30,31,35],{},"对于家庭路由器来说，其实更应该被称为 ",[32,33,34],"strong",{},"NAT 网关","。它通过网络地址转换，让内网设备共享 WAN 口 IP 上网。我们通过三个场景来理清通讯逻辑：",[37,38,39,46,52],"ul",{},[40,41,42,45],"li",{},[32,43,44],{},"内网访问内网服务器","：通过交换机直接通讯，没有任何障碍。",[40,47,48,51],{},[32,49,50],{},"外网访问内网服务器","：必须通过 NAT（如端口映射、DMZ）才能进入内网。",[40,53,54,57],{},[32,55,56],{},"内网访问公网 IP 的内网服务器","：如果没有配置 NAT 回流，访问必然失败。",[16,59,60,63,64,67,68,71],{},[32,61,62],{},"失败原因解析：","\n内网用户通过出口公网 IP 访问内网服务器时，数据包到达出口设备（路由器），由于端口映射的存在，目的地址会被修改为内网服务器地址；服务器收到包后进行回复，源地址和目的地址对调，数据包直接通过交换机返回给了内网用户。然而，用户端发起请求时期待的是来自",[32,65,66],{},"公网 IP"," 的回包，结果收到的却是来自",[32,69,70],{},"内网服务器 IP"," 的回包。这种地址不匹配会导致解封失败，数据包被丢弃。开启 NAT 回流就是为了强制让路由器介入这个过程，修正地址。",[24,73,75],{"id":74},"_22-为什么-dns-劫持是更好的平替方案","2.2 为什么 DNS 劫持是更好的“平替”方案？",[37,77,78,81],{},[40,79,80],{},"虽然开启回流能解决问题，但它会让流量在路由器 CPU 里“绕路”，增加不必要的负载。",[40,82,83,86,87,90],{},[32,84,85],{},"DNS 劫持（DNS 重写）"," 的思路则是在 DNS 解析层面直接解决：当你在局域网内发起域名请求时，内网 DNS 服务器直接截获该请求，并返回服务器的",[32,88,89],{},"私有内网 IP","（如 192.168.3.1）。这样流量根本不会触发 NAT 转换，而是直接通过交换机进行线速传输。",[11,92,94],{"id":93},"_3-实战部署","3 实战部署",[24,96,98],{"id":97},"_31-组网方式","3.1 组网方式",[16,100,101],{},"我先介绍一下我的组网方式 iKuai 为主路由拨号，OpenWRT 旁路由，Lucky 就是安装在 OpenWRT上 的。",[103,104,109],"pre",{"className":105,"code":106,"language":107,"meta":108,"style":108},"language-yaml shiki shiki-themes github-light github-dark","# iKuai IP \n# 192.168.3.1\n\n# OpenWRT IP \n# 192.168.3.2\n\n# Adguard Home IP \n# 192.168.3.3\n","yaml","",[110,111,112,121,127,134,140,146,151,157],"code",{"__ignoreMap":108},[113,114,117],"span",{"class":115,"line":116},"line",1,[113,118,120],{"class":119},"sJ8bj","# iKuai IP \n",[113,122,124],{"class":115,"line":123},2,[113,125,126],{"class":119},"# 192.168.3.1\n",[113,128,130],{"class":115,"line":129},3,[113,131,133],{"emptyLinePlaceholder":132},true,"\n",[113,135,137],{"class":115,"line":136},4,[113,138,139],{"class":119},"# OpenWRT IP \n",[113,141,143],{"class":115,"line":142},5,[113,144,145],{"class":119},"# 192.168.3.2\n",[113,147,149],{"class":115,"line":148},6,[113,150,133],{"emptyLinePlaceholder":132},[113,152,154],{"class":115,"line":153},7,[113,155,156],{"class":119},"# Adguard Home IP \n",[113,158,160],{"class":115,"line":159},8,[113,161,162],{"class":119},"# 192.168.3.3\n",[24,164,166],{"id":165},"_32-adguard-home-配置-dns劫持","3.2 AdGuard Home 配置 (DNS劫持)",[16,168,169],{},"通常玩 NAS 和软路由的，基本上 Adguard Home 这样的服务也是搭建的，那么我就用 Adguard Home 来重写 DNS。",[16,171,172,173,176],{},"利用你现有的 AdGuard Home（192.168.3.3）作为内网 DNS 核心，手动为域名指派内网地址。进入 ",[32,174,175],{},"过滤器 -> 自定义过滤规则","，添加以下语法：",[103,178,180],{"className":105,"code":179,"language":107,"meta":108,"style":108},"||你的域名1.com^$dnsrewrite=192.168.3.2\n||你的域名2.com^$dnsrewrite=192.168.3.2\n",[110,181,182,192],{"__ignoreMap":108},[113,183,184,188],{"class":115,"line":116},[113,185,187],{"class":186},"szBVR","|",[113,189,191],{"class":190},"s7hpK","|你的域名1.com^$dnsrewrite=192.168.3.2\n",[113,193,194,196],{"class":115,"line":123},[113,195,187],{"class":186},[113,197,198],{"class":190},"|你的域名2.com^$dnsrewrite=192.168.3.2\n",[16,200,201],{},[32,202,203],{},"注：192.168.3.2 是 Lucky 所在的旁路接入点。这样做可以确保流量在内网直接准确找到 Lucky 的反向代理服务。",[11,205,207],{"id":206},"_4-总结","4 总结",[16,209,210,211,214],{},"解决内网域名访问问题的思路非常简单：",[32,212,213],{},"让内网走内网 IP，外网走公网 IP","。通过 DNS 劫持（静态指派）这种“不经过 NAT”的手段，我们不仅解决了 iKuai 界面菜单隐藏带来的不便，还实现了最低延迟、最高带宽的访问体验。这套由 AdGuard Home 负责指路、Lucky 负责转发、iKuai 负责拨号的架构，是目前 NAS 玩家最完美的网络闭环方案。",[216,217,218],"style",{},"html pre.shiki code .sJ8bj, html code.shiki .sJ8bj{--shiki-default:#6A737D;--shiki-dark:#6A737D}html .default .shiki span {color: var(--shiki-default);background: var(--shiki-default-bg);font-style: var(--shiki-default-font-style);font-weight: var(--shiki-default-font-weight);text-decoration: var(--shiki-default-text-decoration);}html .shiki span {color: var(--shiki-default);background: var(--shiki-default-bg);font-style: var(--shiki-default-font-style);font-weight: var(--shiki-default-font-weight);text-decoration: var(--shiki-default-text-decoration);}html .dark .shiki span {color: var(--shiki-dark);background: var(--shiki-dark-bg);font-style: var(--shiki-dark-font-style);font-weight: var(--shiki-dark-font-weight);text-decoration: var(--shiki-dark-text-decoration);}html.dark .shiki span {color: var(--shiki-dark);background: var(--shiki-dark-bg);font-style: var(--shiki-dark-font-style);font-weight: var(--shiki-dark-font-weight);text-decoration: var(--shiki-dark-text-decoration);}html pre.shiki code .szBVR, html code.shiki .szBVR{--shiki-default:#D73A49;--shiki-dark:#F97583}html pre.shiki code .s7hpK, html code.shiki .s7hpK{--shiki-default:#B31D28;--shiki-default-font-style:italic;--shiki-dark:#FDAEB7;--shiki-dark-font-style:italic}",{"title":108,"searchDepth":123,"depth":123,"links":220},[221,222,226,230],{"id":13,"depth":123,"text":14},{"id":21,"depth":123,"text":22,"children":223},[224,225],{"id":26,"depth":129,"text":27},{"id":74,"depth":129,"text":75},{"id":93,"depth":123,"text":94,"children":227},[228,229],{"id":97,"depth":129,"text":98},{"id":165,"depth":129,"text":166},{"id":206,"depth":123,"text":207},"软路由",null,"2026-05-13",false,"md","https:\u002F\u002Fimg.nw177.cn\u002Fblog\u002F2026\u002F06\u002F04\u002F1780564693079.avif",{"published":233},"\u002Fblog\u002F10-技术专栏\u002F20-network\u002F15.关于NAT回流与内网域名直连的终极指南",{"title":5,"description":5},"blog\u002F10-技术专栏\u002F20-network\u002F15.关于NAT回流与内网域名直连的终极指南",[242,243,244,245,246],"docker","DNS","Lucky","NAT 回流","远程访问","pCeaLz6zMUMeX17RTl41OaB5s3Cy3Cd6RyZb-4OXWHg",[249,253,257,261,264,267,271,274,278,282,286,290,294,298,302,306,310,311,315,318,322,326,330,334,337,341,345,349,353,357,361,365,369,373,377,381,385,388,392,396,400,404,408,411,414,417,420,423,426,429,432,435,438,441,444,447,450,453,456,459,462],{"path":250,"title":251,"date":252},"\u002Fblog\u002F10-技术专栏\u002F20-network\u002F16.IPv6与DNS的分手协议","IPv6 与 DNS 的分手协议","2026-10-02",{"path":254,"title":255,"date":256},"\u002Fblog\u002F10-技术专栏\u002F50-AI\u002F04.我的-AI-入坑记","我的 AI 入坑记","2026-09-24",{"path":258,"title":259,"date":260},"\u002Fblog\u002F10-技术专栏\u002F50-AI\u002F01.用-Docker-部署-Ollama-与-Open-WebUI-搭建本地大模型","用 Docker 部署 Ollama 与 Open WebUI 搭建本地大模型","2026-09-23",{"path":262,"title":263,"date":260},"\u002Fblog\u002F10-技术专栏\u002F50-AI\u002F02.用-New-API-搭建统一-LLM-网关与-Lucky-反代外网访问","用 New API 搭建统一 LLM 网关与 Lucky 反代外网访问",{"path":265,"title":266,"date":260},"\u002Fblog\u002F10-技术专栏\u002F50-AI\u002F03.用-Dify-搭建本地知识库让-AI-读懂你写的博客","用 Dify 搭建本地知识库，让 AI 读懂你写的博客",{"path":268,"title":269,"date":270},"\u002Fblog\u002F20-生活碎片\u002F03-2026年秋季计划","2026 年秋季计划","2026-09-19",{"path":272,"title":273,"date":270},"\u002Fblog\u002F30-学习笔记\u002F02.Python入门书单","Python 入门书单：从第一行代码到写出真正的程序",{"path":275,"title":276,"date":277},"\u002Fblog\u002F10-技术专栏\u002F40-WebsiteBuilding\u002F09-Cloudflare-低延迟接入方案","Cloudflare 低延迟接入方案","2026-07-22 03:17:28",{"path":279,"title":280,"date":281},"\u002Fblog\u002F10-技术专栏\u002F40-WebsiteBuilding\u002F08-Cloudflare-ImgBed-免费私有图床完整部署手册","Cloudflare ImgBed 免费私有图床完整部署手册","2026-07-19 02:09:08",{"path":283,"title":284,"date":285},"\u002Fblog\u002F10-技术专栏\u002F40-WebsiteBuilding\u002F07-腾讯云-EdgeOne-边缘函数实现七牛-S3-随机图床-API","腾讯云 EdgeOne 边缘函数实现七牛云 & S3 存储随机图床 API","2026-07-13 21:25:48",{"path":287,"title":288,"date":289},"\u002Fblog\u002F10-技术专栏\u002F40-WebsiteBuilding\u002F06-腾讯-EdgeOne-部署-Twikoo-评论系统指南","腾讯EdgeOne部署Twikoo评论系统指南","2026-06-14 17:41:11",{"path":291,"title":292,"date":293},"\u002Fblog\u002F10-技术专栏\u002F40-WebsiteBuilding\u002F05-OpenList-接入-S3-对象存储完整使用教程","OpenList 接入 S3 对象存储完整使用教程","2026-06-11 13:08:07",{"path":295,"title":296,"date":297},"\u002Fblog\u002F10-技术专栏\u002F40-WebsiteBuilding\u002F04-Cloudflare-R2-图床与全球加速方案","Cloudflare R2 图床与全球加速方案","2026-06-09 13:07:35",{"path":299,"title":300,"date":301},"\u002Fblog\u002F10-技术专栏\u002F40-WebsiteBuilding\u002F03-免费图床与CDN加速方案","免费图床与 CDN 加速方案","2026-06-09",{"path":303,"title":304,"date":305},"\u002Fblog\u002F10-技术专栏\u002F40-WebsiteBuilding\u002F02-零基础优雅搭建静态博客全教程","零基础优雅搭建静态博客全教程","2026-06-04",{"path":307,"title":308,"date":309},"\u002Fblog\u002F10-技术专栏\u002F40-WebsiteBuilding\u002F01-远古产物—博客","赛博空间的私人岛屿：博客架构与风格美学","2026-06-03",{"path":238,"title":5,"date":233},{"path":312,"title":313,"date":314},"\u002Fblog\u002F10-技术专栏\u002F20-network\u002F14.飞牛安全访问与Lucky反代雷池防护","飞牛安全访问与 Lucky 反代雷池防护","2026-02-03",{"path":316,"title":317,"date":314},"\u002Fblog\u002F10-技术专栏\u002F30-Linux\u002F18.一键DD纯净系统脚本","一键 DD 纯净系统脚本",{"path":319,"title":320,"date":321},"\u002Fblog\u002F10-技术专栏\u002F30-Linux\u002F17.Ventoy多系统启动盘制作与使用全指南","Ventoy 多系统启动盘制作与使用全指南","2026-02-02",{"path":323,"title":324,"date":325},"\u002Fblog\u002F10-技术专栏\u002F30-Linux\u002F16.Emby元数据匹配与中文命名规范","Emby 元数据匹配与中文命名规范","2026-02-01",{"path":327,"title":328,"date":329},"\u002Fblog\u002F10-技术专栏\u002F30-Linux\u002F15.基于PVE系统安装LXC-debian","基于 PVE 系统安装 LXC-debian","2026-01-19",{"path":331,"title":332,"date":333},"\u002Fblog\u002F10-技术专栏\u002F20-network\u002F13.Lucky反向代理终极指南","Lucky 反向代理终极指南","2026-01-16",{"path":335,"title":336,"date":333},"\u002Fblog\u002F10-技术专栏\u002F30-Linux\u002F14.OEC盒子Armbian刷机指南","OEC 盒子 Armbian 刷机指南",{"path":338,"title":339,"date":340},"\u002Fblog\u002F10-技术专栏\u002F30-Linux\u002F13.oec-fnOS安装","OEC-Turbo (RK3566) 安装飞牛 OS","2026-01-15",{"path":342,"title":343,"date":344},"\u002Fblog\u002F10-技术专栏\u002F30-Linux\u002F12.新的篇章，debian12的配置","新的篇章，debian12 的配置","2026-01-14",{"path":346,"title":347,"date":348},"\u002Fblog\u002F10-技术专栏\u002F30-Linux\u002F11.飞牛OS安装后必要配置","飞牛 OS 安装后必要配置","2026-01-06",{"path":350,"title":351,"date":352},"\u002Fblog\u002F10-技术专栏\u002F10-docker\u002F11.NAS-导航页的终极形态","告别繁琐配置：NAS 导航页的终极形态 —— 从 Sun-Panel 到 FlatNAS","2026-01-05",{"path":354,"title":355,"date":356},"\u002Fblog\u002F10-技术专栏\u002F10-docker\u002F10.LogVar-弹幕-API-部署指南","LogVar 弹幕 API  (纯本地缓存版) 部署指南","2025-12-30",{"path":358,"title":359,"date":360},"\u002Fblog\u002F10-技术专栏\u002F30-Linux\u002F10.基于Lucky与QMediaSync的飞牛远程媒体访问","基于 Lucky 与 QMediaSync 的飞牛远程媒体访问","2025-12-26",{"path":362,"title":363,"date":364},"\u002Fblog\u002F10-技术专栏\u002F30-Linux\u002F09.新的篇章，PVE虚拟机","新的篇章，PVE虚拟机","2025-12-21",{"path":366,"title":367,"date":368},"\u002Fblog\u002F10-技术专栏\u002F30-Linux\u002F08.Linux系统，音响有底噪","Linux 系统，音响有底噪怎么办？","2025-12-17",{"path":370,"title":371,"date":372},"\u002Fblog\u002F10-技术专栏\u002F30-Linux\u002F07.飞牛OS的安装","飞牛 OS 的安装","2025-12-14",{"path":374,"title":375,"date":376},"\u002Fblog\u002F10-技术专栏\u002F30-Linux\u002F06.Debian13换源","Debian13 换源","2025-11-29",{"path":378,"title":379,"date":380},"\u002Fblog\u002F10-技术专栏\u002F30-Linux\u002F05.Kodi-CoreELEC安装指南","Kodi & CoreELEC 安装指南","2025-11-21",{"path":382,"title":383,"date":384},"\u002Fblog\u002F10-技术专栏\u002F10-docker\u002F09.兰空图床和高清图标库","兰空图床和高清图标库","2025-11-15",{"path":386,"title":387,"date":384},"\u002Fblog\u002F10-技术专栏\u002F30-Linux\u002F04.N1盒子Armbian刷机与配置","N1 盒子 Armbian 刷机与配置",{"path":389,"title":390,"date":391},"\u002Fblog\u002F10-技术专栏\u002F10-docker\u002F08.你是否需要一个图床？","你是否需要一个图床？","2025-11-14",{"path":393,"title":394,"date":395},"\u002Fblog\u002F10-技术专栏\u002F30-Linux\u002F03.飞牛NAS第三方应用商店安装","飞牛 NAS 第三方应用商店 (FnDepot) 安装指南","2025-10-13",{"path":397,"title":398,"date":399},"\u002Fblog\u002F10-技术专栏\u002F30-Linux\u002F02.Hills播放器-Windows-安卓","Hills 播放器（Windows + 安卓）","2025-09-24",{"path":401,"title":402,"date":403},"\u002Fblog\u002F10-技术专栏\u002F30-Linux\u002F01.一行代码降低服务器功耗","一行代码降低服务器功耗","2025-08-19",{"path":405,"title":406,"date":407},"\u002Fblog\u002F10-技术专栏\u002F10-docker\u002F01.容器-docker-docker-compose","容器 & docker & docker-compose","2025-08-05",{"path":409,"title":410,"date":407},"\u002Fblog\u002F10-技术专栏\u002F10-docker\u002F02.容器项目-传输类","容器项目&传输类",{"path":412,"title":413,"date":407},"\u002Fblog\u002F10-技术专栏\u002F10-docker\u002F03.容器项目-相册类","容器项目&相册类",{"path":415,"title":416,"date":407},"\u002Fblog\u002F10-技术专栏\u002F10-docker\u002F04.容器项目-媒体类","容器项目&媒体类",{"path":418,"title":419,"date":407},"\u002Fblog\u002F10-技术专栏\u002F10-docker\u002F05.Emby自有授权媒体库（一）","Emby 自有授权媒体库（一）",{"path":421,"title":422,"date":407},"\u002Fblog\u002F10-技术专栏\u002F10-docker\u002F06.Emby自有授权媒体库（二）","Emby 自有授权媒体库（二）",{"path":424,"title":425,"date":407},"\u002Fblog\u002F10-技术专栏\u002F10-docker\u002F07.Adguard-Home去广告","Adguard Home 去广告",{"path":427,"title":428,"date":407},"\u002Fblog\u002F10-技术专栏\u002F20-network\u002F01.新的篇章，软路由","新的篇章，软路由",{"path":430,"title":431,"date":407},"\u002Fblog\u002F10-技术专栏\u002F20-network\u002F02.如何玩公网，怎么远程访问（一）","如何玩公网，怎么远程访问（一）",{"path":433,"title":434,"date":407},"\u002Fblog\u002F10-技术专栏\u002F20-network\u002F03.如何玩公网，怎么远程访问（二）","如何玩公网，怎么远程访问（二）",{"path":436,"title":437,"date":407},"\u002Fblog\u002F10-技术专栏\u002F20-network\u002F04.如何玩公网，怎么远程访问（三）","如何玩公网，怎么远程访问（三）",{"path":439,"title":440,"date":407},"\u002Fblog\u002F10-技术专栏\u002F20-network\u002F05.免费域名与远程访问","免费域名与远程访问",{"path":442,"title":443,"date":407},"\u002Fblog\u002F10-技术专栏\u002F20-network\u002F06.没有公网如何远程访问","没有公网如何远程访问",{"path":445,"title":446,"date":407},"\u002Fblog\u002F10-技术专栏\u002F20-network\u002F07.爱快与OpenWRT双软路由MAC地址重复问题修正","爱快与 OpenWRT 双软路由MAC地址重复问题修正",{"path":448,"title":449,"date":407},"\u002Fblog\u002F10-技术专栏\u002F20-network\u002F08.OpenWRT扩容","OpenWRT 扩容",{"path":451,"title":452,"date":407},"\u002Fblog\u002F10-技术专栏\u002F20-network\u002F09.OpenWRT旁路由一条龙教程","OpenWRT 旁路由一条龙教程",{"path":454,"title":455,"date":407},"\u002Fblog\u002F20-生活碎片\u002F02.在裂缝中种满阳光","让灵魂带着光行走：在裂缝中种满太阳",{"path":457,"title":458,"date":407},"\u002Fblog\u002F30-学习笔记\u002F01.Typora学习笔记","Typora学习笔记",{"path":460,"title":461,"date":407},"\u002Fblog\u002F30-学习笔记\u002F02.Markdown-拓展","Markdown 拓展",{"path":463,"title":464,"date":465},"\u002Fblog\u002F20-生活碎片\u002F01.拥抱生活中的光与热","拥抱生活中的光与热","2025-07-05",1791304408844]