diff --git a/docs/hardware/assets/NanoKVM/go/network/nanokvm_go_frp_frpc_success_log.png b/docs/hardware/assets/NanoKVM/go/network/nanokvm_go_frp_frpc_success_log.png new file mode 100644 index 00000000..8d22d50d Binary files /dev/null and b/docs/hardware/assets/NanoKVM/go/network/nanokvm_go_frp_frpc_success_log.png differ diff --git a/docs/hardware/assets/NanoKVM/go/network/nanokvm_go_frp_settings_entry.png b/docs/hardware/assets/NanoKVM/go/network/nanokvm_go_frp_settings_entry.png new file mode 100644 index 00000000..411c9896 Binary files /dev/null and b/docs/hardware/assets/NanoKVM/go/network/nanokvm_go_frp_settings_entry.png differ diff --git a/docs/hardware/assets/NanoKVM/go/network/nanokvm_go_frp_ssh_switch.png b/docs/hardware/assets/NanoKVM/go/network/nanokvm_go_frp_ssh_switch.png new file mode 100644 index 00000000..f2a7671a Binary files /dev/null and b/docs/hardware/assets/NanoKVM/go/network/nanokvm_go_frp_ssh_switch.png differ diff --git a/docs/hardware/assets/NanoKVM/go/network/nanokvm_go_settings_button.png b/docs/hardware/assets/NanoKVM/go/network/nanokvm_go_settings_button.png new file mode 100644 index 00000000..a9c528a4 Binary files /dev/null and b/docs/hardware/assets/NanoKVM/go/network/nanokvm_go_settings_button.png differ diff --git a/docs/hardware/assets/NanoKVM/go/network/nanokvm_go_tailscale_confirm_login.png b/docs/hardware/assets/NanoKVM/go/network/nanokvm_go_tailscale_confirm_login.png new file mode 100644 index 00000000..b60838b3 Binary files /dev/null and b/docs/hardware/assets/NanoKVM/go/network/nanokvm_go_tailscale_confirm_login.png differ diff --git a/docs/hardware/assets/NanoKVM/go/network/nanokvm_go_tailscale_device_info.png b/docs/hardware/assets/NanoKVM/go/network/nanokvm_go_tailscale_device_info.png new file mode 100644 index 00000000..eb994244 Binary files /dev/null and b/docs/hardware/assets/NanoKVM/go/network/nanokvm_go_tailscale_device_info.png differ diff --git a/docs/hardware/assets/NanoKVM/go/network/nanokvm_go_tailscale_ip.png b/docs/hardware/assets/NanoKVM/go/network/nanokvm_go_tailscale_ip.png new file mode 100644 index 00000000..958ec0b1 Binary files /dev/null and b/docs/hardware/assets/NanoKVM/go/network/nanokvm_go_tailscale_ip.png differ diff --git a/docs/hardware/assets/NanoKVM/go/network/nanokvm_go_tailscale_login.png b/docs/hardware/assets/NanoKVM/go/network/nanokvm_go_tailscale_login.png new file mode 100644 index 00000000..58b2b316 Binary files /dev/null and b/docs/hardware/assets/NanoKVM/go/network/nanokvm_go_tailscale_login.png differ diff --git a/docs/hardware/assets/NanoKVM/go/network/nanokvm_go_tailscale_start.png b/docs/hardware/assets/NanoKVM/go/network/nanokvm_go_tailscale_start.png new file mode 100644 index 00000000..3519e3a7 Binary files /dev/null and b/docs/hardware/assets/NanoKVM/go/network/nanokvm_go_tailscale_start.png differ diff --git a/docs/hardware/assets/NanoKVM/go/network/tailscale_admin_devices_connected.png b/docs/hardware/assets/NanoKVM/go/network/tailscale_admin_devices_connected.png new file mode 100644 index 00000000..c9582301 Binary files /dev/null and b/docs/hardware/assets/NanoKVM/go/network/tailscale_admin_devices_connected.png differ diff --git a/docs/hardware/assets/NanoKVM/go/network/tailscale_admin_machines.png b/docs/hardware/assets/NanoKVM/go/network/tailscale_admin_machines.png new file mode 100644 index 00000000..a7f239b7 Binary files /dev/null and b/docs/hardware/assets/NanoKVM/go/network/tailscale_admin_machines.png differ diff --git a/docs/hardware/assets/NanoKVM/go/network/tailscale_admin_nanokvm_connected.png b/docs/hardware/assets/NanoKVM/go/network/tailscale_admin_nanokvm_connected.png new file mode 100644 index 00000000..93aea189 Binary files /dev/null and b/docs/hardware/assets/NanoKVM/go/network/tailscale_admin_nanokvm_connected.png differ diff --git a/docs/hardware/assets/NanoKVM/go/network/tailscale_admin_nanokvm_ip.png b/docs/hardware/assets/NanoKVM/go/network/tailscale_admin_nanokvm_ip.png new file mode 100644 index 00000000..ec19fdd3 Binary files /dev/null and b/docs/hardware/assets/NanoKVM/go/network/tailscale_admin_nanokvm_ip.png differ diff --git a/docs/hardware/assets/NanoKVM/go/network/tailscale_connect_device.png b/docs/hardware/assets/NanoKVM/go/network/tailscale_connect_device.png new file mode 100644 index 00000000..13da0a7d Binary files /dev/null and b/docs/hardware/assets/NanoKVM/go/network/tailscale_connect_device.png differ diff --git a/docs/hardware/assets/NanoKVM/go/network/tailscale_homepage_get_started.png b/docs/hardware/assets/NanoKVM/go/network/tailscale_homepage_get_started.png new file mode 100644 index 00000000..8d59dee9 Binary files /dev/null and b/docs/hardware/assets/NanoKVM/go/network/tailscale_homepage_get_started.png differ diff --git a/docs/hardware/assets/NanoKVM/go/network/tailscale_login_methods.png b/docs/hardware/assets/NanoKVM/go/network/tailscale_login_methods.png new file mode 100644 index 00000000..6410758b Binary files /dev/null and b/docs/hardware/assets/NanoKVM/go/network/tailscale_login_methods.png differ diff --git a/docs/hardware/assets/NanoKVM/go/network/tailscale_login_success.png b/docs/hardware/assets/NanoKVM/go/network/tailscale_login_success.png new file mode 100644 index 00000000..9608349d Binary files /dev/null and b/docs/hardware/assets/NanoKVM/go/network/tailscale_login_success.png differ diff --git a/docs/hardware/en/kvm/NanoKVM_Go/network/Tailscale.md b/docs/hardware/en/kvm/NanoKVM_Go/network/Tailscale.md index 575f668a..9c51b6a5 100644 --- a/docs/hardware/en/kvm/NanoKVM_Go/network/Tailscale.md +++ b/docs/hardware/en/kvm/NanoKVM_Go/network/Tailscale.md @@ -2,14 +2,16 @@ title: Tailscale keywords: Tailscale, remote access, NAT traversal update: - - date: 2026-07-13 - version: v0.1 + - date: 2026-07-14 + version: v0.2 author: Liang Ziyue + content: + - Add NanoKVM Go Tailscale remote access guide --- # Tailscale -## 1. Introduction to Tailscale +## Introduction to Tailscale Tailscale is a WireGuard-based mesh networking tool. It can add NanoKVM Go, computers, phones, and other devices to the same virtual LAN, allowing you to access NanoKVM Go remotely without a public IP address or router port forwarding. @@ -21,134 +23,140 @@ NanoKVM Go -- Tailscale virtual network -- remote computer or phone > This guide focuses on configuring Tailscale through the web interface to access NanoKVM Go remotely. -## 2. Prerequisites +## Prerequisites Before starting, make sure that: - NanoKVM Go is connected to the Internet; - NanoKVM Go is accessible from the local network; -- the NanoKVM Go system and application versions support Tailscale; +- the NanoKVM Go system and application are updated to the latest versions; - the computer or phone used for remote access can install the Tailscale client. - -## 3. Register and Log In to Tailscale +> If the Tailscale option is not available on the settings page, check for and install the latest NanoKVM Go system and application updates. + +## Register and Log In to Tailscale NanoKVM Go and the computer or phone used for remote access must join the same Tailscale network (Tailnet). If this is your first time using Tailscale: 1. Visit the [Tailscale website](https://tailscale.com/); -2. Click `Get Started` or `Log in`; +2. Click `Get started` or `Log in`; + +![Registration and login entry on the Tailscale website](../../../../assets/NanoKVM/go/network/tailscale_homepage_get_started.png) + 3. Sign in using one of the supported account providers; 4. Follow the prompts to complete the initial authorization; -5. Open the Tailscale admin console and locate the `Machines` device list. +5. Open the Tailscale admin console and select the `Machines` device list. + +![Machines device list in the Tailscale admin console](../../../../assets/NanoKVM/go/network/tailscale_admin_machines.png) The `Machines` page is used to view and manage devices in the current Tailnet. After completing the following configuration, both NanoKVM Go and the client device will appear on this page. - - > Tailscale plans, organization management, and advanced network settings are not required for basic remote access and are not covered in this guide. -## 4. Enable Tailscale on NanoKVM Go +## Enable Tailscale on NanoKVM Go -### 4.1 Open the Tailscale Settings +### Open the Tailscale Settings - +Log in to the NanoKVM Go web interface and click the settings icon in the top toolbar. -### 4.2 Install or Start Tailscale +![Open the NanoKVM Go settings page](../../../../assets/NanoKVM/go/network/nanokvm_go_settings_button.png) - +### Install or Start Tailscale -### 4.3 Log In to Tailscale +Select `Tailscale` in the sidebar. If the page indicates that Tailscale is not running, click `Start` and wait for the service to start. - +![Start Tailscale on NanoKVM Go](../../../../assets/NanoKVM/go/network/nanokvm_go_tailscale_start.png) -### 4.4 Confirm That NanoKVM Go Is Online +### Log In to Tailscale - +1. After Tailscale starts, click `Log in`. The page generates a temporary authentication link and opens the Tailscale login page in the browser. -## 5. Install and Log In to Tailscale on the Client Device +![Click the Tailscale login button on NanoKVM Go](../../../../assets/NanoKVM/go/network/nanokvm_go_tailscale_login.png) -Install Tailscale on the computer or phone that will remotely access NanoKVM Go: +2. Select the same account or sign-in method used earlier and complete authentication. -1. Download and install the client from an official Tailscale channel; -2. Start Tailscale and click `Log in`; -3. Sign in with the same account used during registration; -4. Confirm that the client shows a connected status; -5. Check that NanoKVM Go appears in the device list. +![Select a Tailscale login method](../../../../assets/NanoKVM/go/network/tailscale_login_methods.png) -If you use a different account, make sure that account has been invited to the Tailnet containing NanoKVM Go. +3. Confirm that the device information is correct, then click `Connect` to add NanoKVM Go to the current Tailnet. + +![Confirm connecting NanoKVM Go to the Tailnet](../../../../assets/NanoKVM/go/network/tailscale_connect_device.png) + +4. When the page displays `Login successful`, the Tailscale account authorization is complete. + +![Tailscale login successful](../../../../assets/NanoKVM/go/network/tailscale_login_success.png) + +5. Return to the NanoKVM Go web interface and click `Login complete`. + +![Confirm the completed login on NanoKVM Go](../../../../assets/NanoKVM/go/network/nanokvm_go_tailscale_confirm_login.png) + +6. When the device name, device address, and account are displayed, NanoKVM Go has successfully joined the Tailnet. + +![Tailscale device address and account information on NanoKVM Go](../../../../assets/NanoKVM/go/network/nanokvm_go_tailscale_device_info.png) + +### Confirm That NanoKVM Go Is Online + +Open the `Machines` page in the Tailscale admin console and locate NanoKVM Go. A `Connected` status indicates that the device is online. + +![Confirm that NanoKVM Go is online in the Tailscale admin console](../../../../assets/NanoKVM/go/network/tailscale_admin_nanokvm_connected.png) + +## Install and Log In to Tailscale on the Client Device + +Install Tailscale on the computer or phone that will remotely access NanoKVM Go. Official installation guides for each platform are listed below: | Platform | Installation method | | --- | --- | -| Windows | Download the installer from the Tailscale website | -| macOS | Install from the Tailscale website or the App Store | -| Linux | Use the official installation script or package repository | -| Android | Install from Google Play or another official channel | -| iOS / iPadOS | Install from the App Store | +| Windows | Follow the [Tailscale for Windows installation guide](https://tailscale.com/docs/install/windows) to download and install the client | +| macOS | Follow the [Tailscale for macOS installation guide](https://tailscale.com/docs/install/mac) to install it from the website or App Store | +| Linux | Follow the [Tailscale for Linux installation guide](https://tailscale.com/docs/install/linux) to use the official installation script or package repository | +| Android | Follow the [Tailscale for Android installation guide](https://tailscale.com/docs/install/android) to install it from an official channel | +| iOS / iPadOS | Follow the [Tailscale for iOS installation guide](https://tailscale.com/docs/install/ios) to install it from the App Store | - +After installation, connect the client device to the Tailnet: -## 6. Find the Tailscale IP Address of NanoKVM Go +1. Start the Tailscale client and click `Log in`; +2. Sign in with the same Tailscale account used by NanoKVM Go; +3. Confirm that the client shows a connected status; +4. Open the `Machines` page and confirm that both the client device and NanoKVM Go are online. -After NanoKVM Go joins the Tailnet, it receives a Tailscale IP address in the `100.x.x.x` range. You can find this address on the NanoKVM Go settings page or in the Tailscale admin console. +> If the client device uses a different account, first invite that account to the Tailnet containing NanoKVM Go and grant it the required access permissions. - +## Find the Tailscale IP Address of NanoKVM Go -## 7. Access NanoKVM Go Remotely +After NanoKVM Go joins the Tailnet, it receives a Tailscale IP address in the `100.x.x.x` range. You can find this address in either of the following locations. -To ensure that the test uses an external network, disconnect the client device from the current LAN and use a phone hotspot or mobile network instead: +### Find the Address in NanoKVM Go Settings -1. Confirm that Tailscale is connected on the client device; -2. Enter the Tailscale IP address of NanoKVM Go in the browser address bar; -3. Log in to NanoKVM Go; +Open `Settings` > `Tailscale` on NanoKVM Go and find the Tailscale IP in the `Device Address` field. + +![Find the Tailscale IP in NanoKVM Go settings](../../../../assets/NanoKVM/go/network/nanokvm_go_tailscale_ip.png) + +### Find the Address in the Tailscale Admin Console + +Open the `Machines` page in the Tailscale admin console and find the Tailscale IP in the `ADDRESSES` column for NanoKVM Go. + +![Find the NanoKVM Go Tailscale IP in the Tailscale admin console](../../../../assets/NanoKVM/go/network/tailscale_admin_nanokvm_ip.png) + +## Access NanoKVM Go Remotely + +Before connecting, confirm that both NanoKVM Go and the client device show `Connected` on the `Machines` page. + +![Confirm that the client device and NanoKVM Go are connected to Tailscale](../../../../assets/NanoKVM/go/network/tailscale_admin_devices_connected.png) + +To ensure that the test uses an external network, disconnect the client device from the current LAN and use a phone hotspot or mobile network instead. Then follow these steps: + +1. Confirm that the Tailscale client is connected on the client device; +2. Enter the Tailscale IP address of NanoKVM Go in the browser address bar, for example, `http://100.x.x.x`; +3. Open the NanoKVM Go login page and sign in; 4. Test remote video, keyboard and mouse control, power control, and other features. - +> If the page cannot be opened, confirm that both devices use the same Tailnet and that NanoKVM Go and the client device are still online. -## 8. Everyday Use and Security Recommendations +## Everyday Use and Security Recommendations - Enable two-factor authentication for the Tailscale account; - set a strong password for NanoKVM Go and keep its own login authentication enabled; - do not expose additional NanoKVM Go ports on the router; - do not share Tailscale device authentication links with others; - regularly review the Tailscale admin console and remove unused devices; -- in multi-user environments, use ACLs or Grants to restrict device access. - -## 9. Troubleshooting - -### Tailscale Cannot Be Installed or Started - - - -### The Login Link Is Not Generated - - - -### NanoKVM Go Appears Offline - - - -### The Tailscale IP Is Visible but Cannot Be Accessed - - - -### The Connection Works but Video Is Choppy - - - -### Tailscale Does Not Reconnect After a Restart - - - -## 10. Advanced Configuration - -After completing the basic configuration, you can also learn how to: - -- use MagicDNS to access NanoKVM Go by device name; -- change the NanoKVM Go device name in the Tailnet; -- manage device key expiration policies; -- use ACLs or Grants for precise access control; -- determine whether the current connection is peer-to-peer or relayed through DERP; -- use commands such as `tailscale status` to check the connection; -- log out of the current account or move NanoKVM Go to another Tailnet. - -> Exit nodes and subnet routers are not required for remote access to NanoKVM Go. Most users only need to complete the first seven sections. +- in multi-user environments, use ACLs or Grants to restrict device access; +- regularly update NanoKVM Go and the Tailscale client to receive the latest features and security fixes. diff --git a/docs/hardware/en/kvm/NanoKVM_Go/network/frp.md b/docs/hardware/en/kvm/NanoKVM_Go/network/frp.md index 8ae95160..5b8a9d7e 100644 --- a/docs/hardware/en/kvm/NanoKVM_Go/network/frp.md +++ b/docs/hardware/en/kvm/NanoKVM_Go/network/frp.md @@ -1,4 +1,796 @@ --- title: frp -keywords: NanoKVM Go, frp, remote access +keywords: NanoKVM Go, frp, remote access, intranet penetration +update: + - date: 2026-07-14 + version: v0.2 + author: Liang Ziyue + content: + - Add NanoKVM Go frp remote access guide --- + +# Configure frp Remote Access + +frp is an intranet penetration tool. It can forward the NanoKVM Go service in a local network to a server with a public IP address. After configuration, you can remotely access NanoKVM Go through the public server even if the network where NanoKVM Go is located does not have a public IP address. + +frp consists of two components: + +- `frps`: the server, running on a server with a public IP address; +- `frpc`: the client, running on NanoKVM Go. + +```text +Remote PC or phone + | + | Access https://public IP:8080 + v +Public server (frps) <----- frpc active connection ----- NanoKVM Go +``` + +> The NanoKVM Go web interface currently does not provide an FRP entry. You need to enable SSH in the web interface first, then install and configure `frpc` manually through SSH. + +> Exposing NanoKVM Go to the public Internet increases the risk of scanning, password guessing, and attacks. Set a strong password for NanoKVM Go first. The basic TCP example in this document forwards NanoKVM Go's local HTTPS service, but the device certificate is usually self-signed, so the browser may report that the certificate is not trusted. If you have a domain name, you can configure a trusted certificate for it. If you do not want to expose public ports, you can use a virtual networking solution such as Tailscale instead. + +## Preparation + +Before you start, prepare: + +- a Linux server with a public IPv4 address; +- a NanoKVM Go connected to the Internet; +- administrator privileges on both NanoKVM Go and the public server; +- permission to modify the cloud security group and the server firewall; +- an frp authentication token that is hard to guess. + +This document uses the following example values: + +| Item | Example | Usage | +| --- | --- | --- | +| Public server IP | `203.0.113.10` | Runs `frps` | +| frps communication port | `7000` | Used by `frpc` to connect to `frps` | +| NanoKVM Go public access port | `8080` | Used by the browser to access NanoKVM Go | +| NanoKVM Go web address | `127.0.0.1:443` | Local HTTPS service forwarded by `frpc` | +| Token | `replace_with_a_strong_token` | Authenticates `frpc` | + +`203.0.113.10` is an example address and cannot be used directly. Replace the public IP address, ports, and token in this document with your actual values. + +## Install frps on the Public Server + +### Download frp + +Check the CPU architecture of the server: + +```bash +uname -m +``` + +Open [frp Releases](https://github.com/fatedier/frp/releases), and select the Linux package that matches your server architecture. Common architecture mappings are: + +| `uname -m` output | frp package architecture | +| --- | --- | +| `x86_64` | `linux_amd64` | +| `aarch64`, `arm64` | `linux_arm64` | +| `armv7l` | `linux_arm_hf` | +| Older ARM devices such as ARMv5 | `linux_arm` | +| `riscv64` | `linux_riscv64` | + +This document uses frp `0.70.0` as an example. You can download it from the release page: + +- [frp 0.70.0 release page](https://github.com/fatedier/frp/releases/tag/v0.70.0) +- [Linux AMD64 package](https://github.com/fatedier/frp/releases/download/v0.70.0/frp_0.70.0_linux_amd64.tar.gz) +- [Linux ARM64 package](https://github.com/fatedier/frp/releases/download/v0.70.0/frp_0.70.0_linux_arm64.tar.gz) +- [Linux ARMv7 hard-float package](https://github.com/fatedier/frp/releases/download/v0.70.0/frp_0.70.0_linux_arm_hf.tar.gz) +- [Linux RISC-V 64 package](https://github.com/fatedier/frp/releases/download/v0.70.0/frp_0.70.0_linux_riscv64.tar.gz) + +Most cloud servers use the `x86_64` architecture. If `uname -m` outputs `x86_64`, run the following commands to download and install `frps`: + +```bash +wget https://github.com/fatedier/frp/releases/download/v0.70.0/frp_0.70.0_linux_amd64.tar.gz +tar -xzf frp_0.70.0_linux_amd64.tar.gz +cd frp_0.70.0_linux_amd64 +sudo install -m 755 frps /usr/local/bin/frps +``` + +`sudo install -m 755 frps /usr/local/bin/frps` copies the `frps` program from the current directory to `/usr/local/bin/frps`, and sets its permission to `755`. This means all users can execute it, while only the file owner can modify it. + +If your server uses another architecture, download the matching package from the table above, and replace the package name and extracted directory in the commands with the actual names. The public server and NanoKVM Go should use the same frp version. + +Verify that `frps` can run: + +```bash +/usr/local/bin/frps --version +``` + +> It is recommended to install the same frp version on the public server and NanoKVM Go to avoid configuration incompatibilities caused by version differences. + +### Create the frps configuration + +Create the configuration directory: + +```bash +sudo mkdir -p /etc/frp +``` + +Create `/etc/frp/frps.toml`: + +```toml +bindPort = 7000 + +auth.method = "token" +auth.token = "replace_with_a_strong_token" +``` + +Replace `auth.token` with a randomly generated strong token. You can generate one on the public server with: + +```bash +openssl rand -hex 32 +``` + +The token in the `frps` and `frpc` configurations must be exactly the same. The token only authenticates `frpc`. It does not replace the NanoKVM Go login password, and it does not replace the HTTPS certificate used by the browser. + +### Start frps + +Start it in the foreground first, so you can see the logs directly: + +```bash +sudo /usr/local/bin/frps -c /etc/frp/frps.toml +``` + +If there is no error, press `Ctrl+C` to stop the test. Foreground mode works on all Linux systems, but `frps` stops when the terminal is closed. For long-term use, register it as a system service. + +#### Check the init system + +Run the following command to check the process used by PID 1: + +```bash +ps -p 1 -o comm= +``` + +Choose the startup method according to the output: + +| Example output | Startup method | +| --- | --- | +| `systemd` | Use systemd | +| `init`, `sysvinit`, and `/etc/init.d/` exists | Use SysV init | +| `openrc-init` | Use OpenRC | + +> Whether systemd can be used depends on whether PID 1 is `systemd`. Having the `systemctl` command installed does not mean the current system was booted with systemd. + +#### Start with systemd + +Use this section only when `ps -p 1 -o comm=` outputs `systemd`. + +Create `/etc/systemd/system/frps.service`: + +```ini +[Unit] +Description=frp server +After=network-online.target +Wants=network-online.target + +[Service] +Type=simple +ExecStart=/usr/local/bin/frps -c /etc/frp/frps.toml +Restart=on-failure +RestartSec=5s + +[Install] +WantedBy=multi-user.target +``` + +Load the service and enable it on boot: + +```bash +sudo systemctl daemon-reload +sudo systemctl enable --now frps +sudo systemctl status frps +``` + +If the status is `active (running)`, `frps` has started. View live logs with: + +```bash +sudo journalctl -u frps -f +``` + +#### Start with SysV init + +If the system uses SysV init and the `start-stop-daemon` command exists, create `/etc/init.d/frps`: + +```sh +#!/bin/sh + +DAEMON=/usr/local/bin/frps +CONFIG=/etc/frp/frps.toml +PIDFILE=/var/run/frps.pid + +case "$1" in + start) + if [ -f "$PIDFILE" ] && kill -0 "$(cat "$PIDFILE")" 2>/dev/null; then + echo "frps is already running" + exit 0 + fi + echo "Starting frps" + start-stop-daemon --start --background --make-pidfile \ + --pidfile "$PIDFILE" --exec "$DAEMON" -- -c "$CONFIG" + ;; + stop) + echo "Stopping frps" + start-stop-daemon --stop --pidfile "$PIDFILE" --retry TERM/5/KILL/5 + rm -f "$PIDFILE" + ;; + restart) + "$0" stop + "$0" start + ;; + status) + if [ -f "$PIDFILE" ] && kill -0 "$(cat "$PIDFILE")" 2>/dev/null; then + echo "frps is running" + else + echo "frps is not running" + exit 1 + fi + ;; + *) + echo "Usage: $0 {start|stop|restart|status}" + exit 1 + ;; +esac +``` + +Make the script executable: + +```bash +sudo chmod +x /etc/init.d/frps +``` + +On Debian, Ubuntu, and other SysV init systems that use `update-rc.d`, enable the service on boot and start it: + +```bash +sudo update-rc.d frps defaults +sudo service frps start +sudo service frps status +``` + +If the system does not have `update-rc.d`, use the SysV init service management command provided by your distribution. + +#### Systems without systemd + +If you see the following error: + +```text +System has not been booted with systemd as init system (PID 1). Can't operate. +Failed to connect to bus: Host is down +``` + +The current environment was not booted with systemd, so do not continue using `systemctl`. You can test `frps` in the foreground first: + +```bash +sudo /usr/local/bin/frps -c /etc/frp/frps.toml +``` + +For long-term use, add a service configuration according to the init system actually used by the distribution. + +### Open public server ports + +Allow the following ports in the cloud security group and the server firewall: + +- `7000/tcp`: used by `frpc` on NanoKVM Go to connect to `frps`; +- `8080/tcp`: used by remote browsers to access NanoKVM Go. + +Different Linux distributions may use different firewall tools. Check first: + +```bash +command -v ufw +command -v firewall-cmd +``` + +Choose the corresponding section according to the command output. Do not run commands for a firewall tool that is not installed. + +#### Use UFW + +If `command -v ufw` outputs the UFW path, run: + +```bash +sudo ufw allow 7000/tcp +sudo ufw allow 8080/tcp +sudo ufw status +``` + +If the terminal reports `ufw: command not found`, UFW is not installed on the current system. UFW is not required for running `frps`. Continue checking whether the system uses firewalld, another firewall, or only the cloud security group. + +#### Use firewalld + +If `command -v firewall-cmd` outputs the firewalld command path, run: + +```bash +sudo firewall-cmd --permanent --add-port=7000/tcp +sudo firewall-cmd --permanent --add-port=8080/tcp +sudo firewall-cmd --reload +sudo firewall-cmd --list-ports +``` + +#### Use a cloud security group + +Alibaba Cloud, Huawei Cloud, Tencent Cloud, AWS, and other cloud providers usually provide a security group that is independent of the Linux system. Even if UFW or firewalld is not installed inside the server, you must add inbound rules in the cloud server console: + +| Protocol | Port | Source | +| --- | --- | --- | +| TCP | `7000` | Public IP of the network where NanoKVM Go is located. If it cannot be fixed, you can temporarily allow any source for testing. | +| TCP | `8080` | Public IP that needs to access NanoKVM Go. If it cannot be fixed, you can temporarily allow any source for testing. | + +After testing, restrict the source range to the actual IPs you need. Do not keep these ports open to the entire Internet for a long time. + +Confirm that `frps` is listening on port `7000`: + +```bash +sudo ss -lntp | grep ':7000' +``` + +You can also confirm whether the remote access port is already listening: + +```bash +sudo ss -lntp | grep ':8080' +``` + +> Port `8080` appears only after `frpc` on NanoKVM Go connects successfully and registers the proxy. + +## Enable SSH in the NanoKVM Go Web Interface + +The NanoKVM Go web interface does not provide an FRP entry, so you need to enable SSH first, then install `frpc` from the command line. + +### Log in to NanoKVM Go + +1. Open the local network address of NanoKVM Go in a browser; +2. Enter the username and password to log in to the web console; +3. Confirm the current local network IP address of NanoKVM Go. + +### Open SSH settings + +1. Open the NanoKVM Go settings page; + +![NanoKVM Go settings entry](../../../../assets/NanoKVM/go/network/nanokvm_go_frp_settings_entry.png) + +2. Go to the settings item that contains the SSH switch, and enable SSH; + +![NanoKVM Go SSH switch](../../../../assets/NanoKVM/go/network/nanokvm_go_frp_ssh_switch.png) + +### Log in through SSH + +Open a terminal on a computer in the same local network as NanoKVM Go, and log in through SSH: + +```bash +ssh @ + +Example: ssh root@192.168.0.225 +``` + +> On the first connection, the terminal asks whether to trust the device fingerprint. After confirming that the IP address is correct, enter `yes`, then enter the SSH password. The username is `root`, and the password is `sipeed`. + +## Install frpc on NanoKVM Go + +Run the following commands in the NanoKVM Go SSH terminal. + +### Confirm the system architecture + +Run: + +```bash +uname -m +``` + +The output of `uname -m` on a real NanoKVM Go device is: + +```text +armv7l +``` + +Therefore, use the `linux_arm_hf` package of frp. This package is built for ARMv7 hard-float environments. Do not download `linux_arm64`. + +### Download and install frpc + +The `/tmp` directory on NanoKVM Go is usually mounted as an in-memory tmpfs and has limited space. Download the package to `/root` on the root filesystem instead. + +Run the following commands to download and install `frpc`: + +```bash +cd /root +wget https://github.com/fatedier/frp/releases/download/v0.70.0/frp_0.70.0_linux_arm_hf.tar.gz +tar -xzf frp_0.70.0_linux_arm_hf.tar.gz +cd frp_0.70.0_linux_arm_hf +mkdir -p /usr/local/bin +cp frpc /usr/local/bin/frpc +chmod +x /usr/local/bin/frpc +``` + +If the download or extraction fails, confirm that NanoKVM Go can access GitHub, and check whether the version number and file name match the Releases page. + +Verify the installation: + +```bash +/usr/local/bin/frpc --version +``` + +If NanoKVM Go cannot access GitHub directly, download the package on your computer first, then upload it to `/root` on the device with `scp`: + +```bash +scp frp_0.70.0_linux_arm_hf.tar.gz @:/root/ +``` + +### Create the frpc configuration + +Create the configuration directory: + +```bash +mkdir -p /etc/frp +``` + +Create `/etc/frp/frpc.toml`: + +```toml +serverAddr = "203.0.113.10" +serverPort = 7000 + +auth.method = "token" +auth.token = "replace_with_a_strong_token" + +[[proxies]] +name = "nanokvm-go-web" +type = "tcp" +localIP = "127.0.0.1" +localPort = 443 +remotePort = 8080 +``` + +Modify the following parameters: + +| Parameter | What to change | +| --- | --- | +| `serverAddr` | Actual IP address or domain name of the public server | +| `serverPort` | `bindPort` of `frps`, `7000` in this document | +| `auth.token` | The same token as in `frps.toml` | +| `localPort` | Actual NanoKVM Go web service port. This document uses HTTPS port `443` | +| `remotePort` | Public access port, `8080` in this document | + +Check whether the local web service is accessible: + +```bash +wget --no-check-certificate -S -O /dev/null https://127.0.0.1:443 +``` + +The HTTP port of NanoKVM Go may redirect to HTTPS. If directly accessing `http://127.0.0.1:80` returns `307 Temporary Redirect` and redirects to `https://127.0.0.1/`, this is normal. Because the device certificate is usually not a publicly trusted certificate, add `--no-check-certificate` when testing with `wget`. + +If the connection is refused, confirm the actual NanoKVM Go web service port, then modify `localPort`. + +### Test the frpc connection + +Start `frpc` in the foreground: + +```bash +/usr/local/bin/frpc -c /etc/frp/frpc.toml +``` + +If the logs show `login to server success` and `start proxy success`, `frpc` has connected to `frps` and registered the proxy. + +Keep this terminal running, and open the following address in a browser from an external network: + +```text +https://203.0.113.10:8080 +``` + +Replace the example IP address with the actual IP address of your public server. On first access, the browser may report that the certificate is not trusted. After confirming that you are accessing your own server, continue for testing. If the NanoKVM Go login page opens, the TCP forwarding configuration is correct. After testing, return to the SSH terminal and press `Ctrl+C` to stop `frpc`. + +![frpc connects to frps successfully](../../../../assets/NanoKVM/go/network/nanokvm_go_frp_frpc_success_log.png) + +### Enable frpc on boot + +NanoKVM Go uses systemd to manage system services. Create `/etc/systemd/system/frpc.service`: + +```ini +[Unit] +Description=frp client for NanoKVM Go +After=network-online.target +Wants=network-online.target + +[Service] +Type=simple +ExecStart=/usr/local/bin/frpc -c /etc/frp/frpc.toml +Restart=always +RestartSec=5s + +[Install] +WantedBy=multi-user.target +``` + +Load the service and enable it on boot: + +```bash +systemctl daemon-reload +systemctl enable --now frpc +systemctl status frpc +``` + +View live logs: + +```bash +journalctl -u frpc -f +``` + +After rebooting NanoKVM Go, run `systemctl status frpc` again to confirm that the service starts automatically and reconnects to `frps`. + +## Access NanoKVM Go from an External Network + +To confirm that the traffic really goes through the public server, switch your computer or phone to another network, such as a mobile hotspot or mobile data network, then: + +1. Open `https://:8080` in a browser; +2. Log in with the NanoKVM Go username and password; +3. Test the remote display, keyboard, mouse, and power control; +4. Refresh the page, and confirm that video and control features still work. + +The TCP proxy forwards HTTPS and WebSocket connections as-is, so WebSocket usually does not require extra configuration. If the page opens but video or control functions are abnormal, check the browser developer tools, `frpc` logs, and `frps` logs. + +## Configure a Domain Name and HTTPS (Optional) + +The basic example `https://:8080` uses the certificate provided by NanoKVM Go itself, so the browser may report that the certificate is not trusted. If you have an available domain name, you can point it to the `frps` server and use Nginx or Caddy to provide a trusted HTTPS reverse proxy. + +For example, with Nginx, let Nginx listen on `443`, then forward requests to port `8080` exposed by frp on the server itself: + +```nginx +server { + listen 443 ssl; + server_name kvm.example.com; + + ssl_certificate /path/to/fullchain.pem; + ssl_certificate_key /path/to/privkey.pem; + + location / { + proxy_pass https://127.0.0.1:8080; + proxy_http_version 1.1; + proxy_ssl_verify off; + proxy_set_header Host $host; + proxy_set_header X-Real-IP $remote_addr; + proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for; + proxy_set_header X-Forwarded-Proto $scheme; + proxy_set_header Upgrade $http_upgrade; + proxy_set_header Connection "upgrade"; + proxy_read_timeout 3600s; + } +} +``` + +The overall steps are: + +1. Point the domain A record to the public IP address of the `frps` server; +2. Install Nginx or Caddy on the server; +3. Issue a TLS certificate for the domain; +4. Reverse proxy HTTPS requests to `https://127.0.0.1:8080`; +5. Allow `443/tcp` in the security group and firewall; +6. After confirming that `https://kvm.example.com` works, close public inbound access to `8080/tcp`. + +After configuring HTTPS, use the cloud security group and server firewall to deny public inbound traffic to `8080/tcp`, and allow only the local Nginx process on the server to access that port. Do not keep the HTTP test port publicly exposed after HTTPS is configured. + +## FAQ + +### frpc cannot connect to frps + +Check the following: + +- whether `serverAddr` and `serverPort` are correct; +- whether `frps` is `active (running)`; +- whether `7000/tcp` is allowed in the cloud security group and server firewall; +- whether the tokens in `frps` and `frpc` are exactly the same; +- whether the frp versions on the public server and NanoKVM Go are compatible; +- whether NanoKVM Go can access the Internet and the public server. + +You can test port connectivity on NanoKVM Go: + +```bash +nc -vz 7000 +``` + +If `nc` is not available, observe the `frpc` connection logs directly. + +### frpc is connected, but the public port cannot be accessed + +Check: + +- whether `remotePort` is occupied by another program or another frp proxy; +- whether `8080/tcp` is allowed in the cloud security group and server firewall; +- whether the `frpc` log shows that the proxy started successfully; +- whether the `frps` log contains `nanokvm-go-web`; +- whether the browser is using `https://`, not `http://`. + +Confirm on the public server whether the port is listening: + +```bash +sudo ss -lntp | grep ':8080' +``` + +### The page cannot be opened or returns connection refused + +Run the following command on NanoKVM Go: + +```bash +wget --no-check-certificate -S -O /dev/null https://127.0.0.1:443 +``` + +If local access also fails, `localIP` or `localPort` is incorrect, or the NanoKVM Go web service is not running. + +### Local test reports that the certificate is not trusted + +If running `wget -S -O /dev/null http://127.0.0.1:80` returns `307 Temporary Redirect` and redirects to `https://127.0.0.1/`, NanoKVM Go is automatically using HTTPS. The following certificate errors are usually normal: + +```text +ERROR: The certificate of '127.0.0.1' is not trusted. +ERROR: The certificate's owner does not match hostname '127.0.0.1' +``` + +This happens because the NanoKVM Go certificate is not a publicly trusted certificate issued for `127.0.0.1`. To test the local HTTPS service, use: + +```bash +wget --no-check-certificate -S -O /dev/null https://127.0.0.1:443 +``` + +The `frpc` configuration should also forward `localPort = 443`. + +### The page opens, but video or control features are abnormal + +Check: + +- whether the browser developer tools show WebSocket connection errors; +- whether `frpc` and `frps` disconnect or reconnect frequently; +- whether Nginx or Caddy forwards WebSocket Upgrade requests correctly; +- whether an HTTPS page loads HTTP resources; +- whether the public server bandwidth and the uplink bandwidth of the NanoKVM Go network are sufficient. + +### frpc does not start automatically after reboot + +Run the following commands on NanoKVM Go: + +```bash +systemctl status frpc +journalctl -u frpc -b +``` + +Check whether the service is enabled, whether the configuration file path is correct, and whether `frpc` can connect to `frps` after the network is ready. + +## Disable frp + +### Temporarily disable + +If you only want to stop using frp temporarily and may use it again later, stop the service and disable auto-start while keeping the program and configuration files. + +Stop and disable `frpc` on NanoKVM Go: + +```bash +systemctl disable --now frpc +``` + +If the public server uses systemd, stop and disable `frps`: + +```bash +sudo systemctl disable --now frps +``` + +If the public server uses SysV init, stop `frps` and remove it from auto-start: + +```bash +sudo service frps stop +sudo update-rc.d -f frps remove +``` + +To restore the systemd service on NanoKVM Go, run: + +```bash +systemctl enable --now frpc +``` + +To restore the systemd service on the public server, run: + +```bash +sudo systemctl enable --now frps +``` + +To restore the SysV init service on the public server, run: + +```bash +sudo update-rc.d frps defaults +sudo service frps start +``` + +> Only run the commands that match the current init system. If the public server uses another service manager, use the corresponding stop and disable commands. + +### Completely uninstall + +frp was installed by manually copying binaries, so it is not managed by package managers such as `apt` or `dnf`. To completely uninstall it, manually delete the service, program, and configuration files. + +On NanoKVM Go, stop `frpc` and remove the systemd service file: + +```bash +systemctl disable --now frpc +rm -f /etc/systemd/system/frpc.service +systemctl daemon-reload +``` + +Then delete the `frpc` program and configuration on NanoKVM Go: + +```bash +rm -f /usr/local/bin/frpc +rm -f /etc/frp/frpc.toml +rmdir /etc/frp 2>/dev/null || true +``` + +Delete the package and extracted directory created during installation on NanoKVM Go: + +```bash +rm -f /root/frp_0.70.0_linux_arm_hf.tar.gz +rm -rf /root/frp_0.70.0_linux_arm_hf +``` + +If you downloaded another version or architecture, replace the file names with the actual names. + +If the public server uses systemd, remove the `frps` service first: + +```bash +sudo systemctl disable --now frps +sudo rm -f /etc/systemd/system/frps.service +sudo systemctl daemon-reload +``` + +If the public server uses SysV init, remove the `frps` service first: + +```bash +sudo service frps stop +sudo update-rc.d -f frps remove +sudo rm -f /etc/init.d/frps +``` + +After cleaning up the corresponding service, delete the `frps` program and configuration: + +```bash +sudo rm -f /usr/local/bin/frps +sudo rm -f /etc/frp/frps.toml +sudo rmdir /etc/frp 2>/dev/null || true +``` + +The frp package and extracted directory on the public server are located in the directory where you ran the download commands. After confirming the directory and file names, you can delete them. + +### Clean up firewall and other configuration + +If UFW was installed and used, delete the allow rules added in this document: + +```bash +sudo ufw delete allow 7000/tcp +sudo ufw delete allow 8080/tcp +``` + +If firewalld was installed and used, run: + +```bash +sudo firewall-cmd --permanent --remove-port=7000/tcp +sudo firewall-cmd --permanent --remove-port=8080/tcp +sudo firewall-cmd --reload +``` + +Finally, check and clean up: + +- `7000/tcp`, `8080/tcp`, and other frp ports in the cloud security group; +- Nginx or Caddy configuration created specifically for NanoKVM Go; +- TLS certificates that are no longer used; +- DNS records that are no longer used. + +> If the corresponding firewall command does not exist, skip that group of commands. If a port, reverse proxy, or certificate is still used by another service, do not delete the corresponding configuration directly. + +## Security Recommendations + +- Set a separate strong password for NanoKVM Go; +- Use a randomly generated strong token, and do not use the example value in this document; +- Do not expose the frps Dashboard to the public Internet; +- Open only the ports that are actually needed, and restrict source IPs through the firewall whenever possible; +- If you have a domain name, you can configure a trusted HTTPS reverse proxy; +- Regularly update NanoKVM Go, frp, and the public server system; +- Regularly check `frpc`, `frps`, and reverse proxy logs; +- Stop the service and close public ports immediately when you no longer use it. + +## References + +- [frp official documentation](https://gofrp.org/) +- [frp GitHub repository](https://github.com/fatedier/frp) +- [frp Releases](https://github.com/fatedier/frp/releases) diff --git a/docs/hardware/zh/kvm/NanoKVM_Go/network/Tailscale.md b/docs/hardware/zh/kvm/NanoKVM_Go/network/Tailscale.md index 4cbe85ec..9c9aeead 100644 --- a/docs/hardware/zh/kvm/NanoKVM_Go/network/Tailscale.md +++ b/docs/hardware/zh/kvm/NanoKVM_Go/network/Tailscale.md @@ -2,14 +2,16 @@ title: Tailscale keywords: Tailscale，远程控制，内网穿透 update: - - date: 2026-07-13 - version: v0.1 + - date: 2026-07-14 + version: v0.2 author: Liang Ziyue + content: + - 新增 NanoKVM Go Tailscale 远程访问教程 --- # Tailscale -## 一、Tailscale简介 +## Tailscale 简介 Tailscale 是一款基于 WireGuard 的异地组网工具。它可以将 NanoKVM Go 与电脑、手机等设备加入同一个虚拟局域网，使用户无需公网 IP，也无需在路由器上配置端口转发，即可从外网访问 NanoKVM Go。 @@ -21,137 +23,142 @@ NanoKVM Go ── Tailscale 虚拟网络 ── 外网电脑或手机 > 本文将以网页配置方式为主，介绍如何使用 Tailscale 从外网访问 NanoKVM Go。 -## 二、使用前准备 +## 使用前准备 开始配置前，请确认： - NanoKVM Go 已连接互联网； - 可以在局域网内正常访问 NanoKVM Go； -- NanoKVM Go 的系统和应用版本支持 Tailscale； +- NanoKVM Go 的系统和应用已更新至最新版本； - 用于外网访问的电脑或手机可以安装 Tailscale 客户端。 - -## 三、注册并登录 Tailscale +> 如果设置页面中没有 Tailscale 选项，请先检查并更新 NanoKVM Go 的系统和应用版本。 -NanoKVM Go 和用于远程访问的电脑或手机需要加入同一个 Tailscale 网络（Tailnet）。首次使用时，需要先注册并登录 Tailscale： +## 注册并登录 Tailscale + +NanoKVM Go 和用于远程访问的电脑或手机需要加入同一个 Tailscale 网络（Tailnet）。首次使用时，请先注册并登录 Tailscale： 1. 访问 [Tailscale 官网](https://tailscale.com/)； +2. 点击 `Get started` 或 `Log in`； +![Tailscale 官网注册和登录入口](../../../../assets/NanoKVM/go/network/tailscale_homepage_get_started.png) -2. 点击 `Get Started` 或 `Log in`； 3. 使用页面支持的账号完成登录； 4. 按照页面提示完成首次授权； -5. 进入 Tailscale 管理后台，并找到 `Machines` 设备列表。 +5. 进入 Tailscale 管理后台，打开 `Machines` 设备列表。 + +![Tailscale 管理后台的 Machines 设备列表](../../../../assets/NanoKVM/go/network/tailscale_admin_machines.png) `Machines` 页面用于查看和管理已经加入当前 Tailnet 的设备。完成后续配置后，NanoKVM Go 和访问端都会出现在该页面中。 - - > Tailscale 的套餐、组织管理和高级网络设置并非基础远程访问的必需内容，本文不作展开。 -## 四、在 NanoKVM Go 上启用 Tailscale +## 在 NanoKVM Go 上启用 Tailscale -### 1. 打开 Tailscale 设置 +### 打开 Tailscale 设置 - +登录 NanoKVM Go 网页控制端，点击顶部工具栏中的设置图标。 -### 2. 安装或启动 Tailscale +![打开 NanoKVM Go 设置页面](../../../../assets/NanoKVM/go/network/nanokvm_go_settings_button.png) - +### 安装或启动 Tailscale -### 3. 登录 Tailscale +在设置页面左侧选择 `Tailscale`。如果页面提示 Tailscale 尚未运行，请点击 `启动`，等待服务启动完成。 - +![在 NanoKVM Go 中启动 Tailscale](../../../../assets/NanoKVM/go/network/nanokvm_go_tailscale_start.png) -### 4. 确认 NanoKVM Go 已上线 +### 登录 Tailscale - +1. Tailscale 启动后，点击 `登录`。页面会生成一个临时认证链接，并在浏览器中打开 Tailscale 登录页面。 -## 五、在访问端安装并登录 Tailscale +![点击 NanoKVM Go 的 Tailscale 登录按钮](../../../../assets/NanoKVM/go/network/nanokvm_go_tailscale_login.png) -在需要远程访问 NanoKVM Go 的电脑或手机上安装 Tailscale： +2. 选择与前文相同的账号或登录方式，完成身份验证。 -1. 从 Tailscale 官方渠道下载并安装客户端； -2. 启动 Tailscale，并点击 `Log in`； -3. 使用注册时的同一账号登录； -4. 确认客户端显示已连接； -5. 检查设备列表中是否可以看到 NanoKVM Go。 +![选择 Tailscale 登录方式](../../../../assets/NanoKVM/go/network/tailscale_login_methods.png) -如果使用不同账号，需要确保该账号已经被邀请加入 NanoKVM Go 所在的 Tailnet。 +3. 确认页面显示的设备信息无误，然后点击 `Connect`，将 NanoKVM Go 加入当前 Tailnet。 + +![确认将 NanoKVM Go 连接到 Tailnet](../../../../assets/NanoKVM/go/network/tailscale_connect_device.png) + +4. 页面显示 `Login successful` 后，表示 Tailscale 账号授权成功。 + +![Tailscale 登录成功](../../../../assets/NanoKVM/go/network/tailscale_login_success.png) + +5. 返回 NanoKVM Go 网页控制端，点击 `登录完成`。 + +![在 NanoKVM Go 页面确认登录完成](../../../../assets/NanoKVM/go/network/nanokvm_go_tailscale_confirm_login.png) + +6. 页面显示设备名称、设备地址和账号后，表示 NanoKVM Go 已成功加入 Tailnet。 + +![NanoKVM Go 的 Tailscale 设备地址和账号信息](../../../../assets/NanoKVM/go/network/nanokvm_go_tailscale_device_info.png) + +### 确认 NanoKVM Go 已上线 + +打开 Tailscale 管理后台的 `Machines` 页面，找到 NanoKVM Go。设备状态显示为 `Connected` 时，表示设备已经上线。 + +![在 Tailscale 管理后台确认 NanoKVM Go 已上线](../../../../assets/NanoKVM/go/network/tailscale_admin_nanokvm_connected.png) + +## 在访问端安装并登录 Tailscale + +在需要远程访问 NanoKVM Go 的电脑或手机上安装 Tailscale。各平台的官方安装指南如下： | 平台 | 安装方式 | | --- | --- | -| Windows | 从 Tailscale 官网下载安装程序 | -| macOS | 从 Tailscale 官网或 App Store 安装 | -| Linux | 使用官方安装脚本或软件源安装 | -| Android | 从 Google Play 或其他官方渠道安装 | -| iOS / iPadOS | 从 App Store 安装 | +| Windows | 参考 [Tailscale Windows 安装指南](https://tailscale.com/docs/install/windows) 下载安装程序 | +| macOS | 参考 [Tailscale macOS 安装指南](https://tailscale.com/docs/install/mac) 从官网或 App Store 安装 | +| Linux | 参考 [Tailscale Linux 安装指南](https://tailscale.com/docs/install/linux) 使用官方安装脚本或软件源安装 | +| Android | 参考 [Tailscale Android 安装指南](https://tailscale.com/docs/install/android) 从官方渠道安装 | +| iOS / iPadOS | 参考 [Tailscale iOS 安装指南](https://tailscale.com/docs/install/ios) 从 App Store 安装 | - +安装完成后，按照以下步骤连接到 Tailnet： -## 六、查看 NanoKVM Go 的 Tailscale IP +1. 启动 Tailscale 客户端，并点击 `Log in`； +2. 使用与 NanoKVM Go 相同的 Tailscale 账号登录； +3. 确认客户端状态显示为已连接； +4. 打开 `Machines` 页面，确认访问端和 NanoKVM Go 均已上线。 -NanoKVM Go 加入 Tailnet 后，会获得一个 `100.x.x.x` 格式的 Tailscale IP。可以通过 NanoKVM Go 的设置页面或 Tailscale 管理后台查看该地址。 +> 如果访问端使用其他账号，需要先将该账号邀请到 NanoKVM Go 所在的 Tailnet，并为其配置相应的访问权限。 - +## 查看 NanoKVM Go 的 Tailscale IP -## 七、从外网访问 NanoKVM Go +NanoKVM Go 加入 Tailnet 后，会获得一个 `100.x.x.x` 格式的 Tailscale IP。可以通过以下两种方式查看该地址。 -为确保测试使用的是外网连接，建议断开访问端当前的局域网，改用手机热点或移动网络： +### 在 NanoKVM Go 设置中查看 -1. 确认访问端的 Tailscale 客户端已连接； -2. 在浏览器地址栏输入 NanoKVM Go 的 Tailscale IP； -3. 登录 NanoKVM Go； +打开 NanoKVM Go 的 `设置` > `Tailscale`，在 `设备地址` 一栏中查看 Tailscale IP。 + +![在 NanoKVM Go 设置中查看 Tailscale IP](../../../../assets/NanoKVM/go/network/nanokvm_go_tailscale_ip.png) + +### 在 Tailscale 管理后台中查看 + +打开 Tailscale 管理后台的 `Machines` 页面，在 NanoKVM Go 对应行的 `ADDRESSES` 一栏中查看 Tailscale IP。 + +![在 Tailscale 管理后台中查看 NanoKVM Go 的 Tailscale IP](../../../../assets/NanoKVM/go/network/tailscale_admin_nanokvm_ip.png) + + +## 从外网访问 NanoKVM Go + +开始访问前，请先确认 NanoKVM Go 和访问端在 `Machines` 页面中均显示为 `Connected`。 + +![确认访问端和 NanoKVM Go 均已连接到 Tailscale](../../../../assets/NanoKVM/go/network/tailscale_admin_devices_connected.png) + +为确保测试使用的是外网连接，建议断开访问端当前的局域网，改用手机热点或移动网络。然后按照以下步骤访问： + +1. 确认访问端的 Tailscale 客户端处于已连接状态； +2. 在浏览器地址栏中输入 NanoKVM Go 的 Tailscale IP，例如 `http://100.x.x.x`； +3. 打开 NanoKVM Go 登录页面并完成登录； 4. 测试远程画面、键鼠控制和电源控制等功能。 - +> 如果无法打开页面，请先确认两台设备使用同一个 Tailnet，并检查 NanoKVM Go 和访问端是否仍处于在线状态。 -## 八、日常使用与安全建议 +## 日常使用与安全建议 - 为 Tailscale 账号启用双重验证； - 为 NanoKVM Go 设置强密码，并保留设备自身的登录认证； - 不要在路由器上额外开放 NanoKVM Go 的访问端口； - 不要将 Tailscale 设备认证链接分享给他人； - 定期检查 Tailscale 管理后台，移除不再使用的设备； -- 多用户环境建议使用 ACL 或 Grants 限制设备访问权限。 - -## 九、常见问题 - -### Tailscale 无法安装或启动 - - - -### 登录链接没有生成 - - - -### NanoKVM Go 显示离线 - - - -### 可以看到 Tailscale IP，但无法访问 - - - -### 连接成功但画面卡顿 - - - -### 重启后没有自动连接 - - - -## 十、进阶配置 - -完成基础配置后，可以根据需要进一步了解： - -- 使用 MagicDNS 通过设备名称访问 NanoKVM Go； -- 修改 NanoKVM Go 在 Tailnet 中的设备名称； -- 管理设备密钥过期策略； -- 使用 ACL 或 Grants 精确控制访问权限； -- 判断当前连接是点对点直连还是 DERP 中继； -- 使用 `tailscale status` 等命令检查连接状态； -- 退出当前账号或将 NanoKVM Go 更换到其他 Tailnet。 - -> 出口节点和子网路由器不是远程访问 NanoKVM Go 的必需配置，普通用户完成前七节即可正常使用。 +- 多用户环境建议使用 ACL 或 Grants 限制设备访问权限； +- 定期更新 NanoKVM Go 和 Tailscale 客户端，以获得最新的功能和安全修复。 diff --git a/docs/hardware/zh/kvm/NanoKVM_Go/network/frp.md b/docs/hardware/zh/kvm/NanoKVM_Go/network/frp.md index 20f4c265..a3fdcb0c 100644 --- a/docs/hardware/zh/kvm/NanoKVM_Go/network/frp.md +++ b/docs/hardware/zh/kvm/NanoKVM_Go/network/frp.md @@ -1,4 +1,799 @@ --- title: frp -keywords: NanoKVM Go, frp, 远程访问 +keywords: NanoKVM Go, frp, 远程访问, 内网穿透 +update: + - date: 2026-07-14 + version: v0.2 + author: Liang Ziyue + content: + - 新增 NanoKVM Go frp 远程访问教程 --- + +# 配置 frp 远程访问 + +frp 是一款内网穿透工具，可以将局域网内的 NanoKVM Go 服务转发到具有公网 IP 的服务器。配置完成后，即使 NanoKVM Go 所在网络没有公网 IP，也可以通过公网服务器远程访问它。 + +frp 由两个组件组成： + +- `frps`：服务端，运行在具有公网 IP 的服务器上； +- `frpc`：客户端，运行在 NanoKVM Go 上。 + +```text +远程电脑或手机 + | + | 访问 https://公网 IP:8080 + v +公网服务器（frps） <----- frpc 主动连接 ----- NanoKVM Go +``` + +> NanoKVM Go 网页端目前没有 FRP 配置入口，需要先在网页端开启 SSH，再通过 SSH 手动安装和配置 `frpc`。 + +> 将 NanoKVM Go 暴露到公网会增加被扫描、撞库和攻击的风险。请先为 NanoKVM Go 设置强密码。本文的基础 TCP 示例会转发 NanoKVM Go 本机的 HTTPS 服务，但设备证书通常是自签名证书，浏览器可能提示证书不受信任。有域名时可以配置可信域名证书；如果不希望暴露公网端口，也可以改用 Tailscale 等虚拟组网方案。 + +## 准备工作 + +开始配置前，请准备： + +- 一台具有公网 IPv4 地址的 Linux 服务器； +- 已连接互联网的 NanoKVM Go； +- NanoKVM Go 和公网服务器的管理员权限； +- 公网服务器云安全组和系统防火墙的修改权限； +- 一个不容易被猜到的 frp 身份验证 Token。 + +本文使用以下示例参数： + +| 项目 | 示例值 | 用途 | +| --- | --- | --- | +| 公网服务器 IP | `203.0.113.10` | 运行 `frps` | +| frps 通信端口 | `7000` | `frpc` 连接 `frps` | +| NanoKVM Go 公网访问端口 | `8080` | 浏览器访问 NanoKVM Go | +| NanoKVM Go Web 地址 | `127.0.0.1:443` | `frpc` 转发的本地 HTTPS 服务 | +| Token | `replace_with_a_strong_token` | 验证 `frpc` 身份 | + +`203.0.113.10` 是文档示例地址，不能直接使用。请将本文中的公网 IP、端口和 Token 替换为自己的实际参数。 + +## 在公网服务器上安装 frps + +### 下载 frp + +先查看服务器的 CPU 架构： + +```bash +uname -m +``` + +打开 [frp Releases](https://github.com/fatedier/frp/releases)，选择与服务器架构匹配的 Linux 安装包。常见架构对应关系如下： + +| `uname -m` 输出 | frp 安装包架构 | +| --- | --- | +| `x86_64` | `linux_amd64` | +| `aarch64`、`arm64` | `linux_arm64` | +| `armv7l` | `linux_arm_hf` | +| ARMv5 等较旧 ARM 设备 | `linux_arm` | +| `riscv64` | `linux_riscv64` | + +本文以 frp `0.70.0` 为例，可以在发布页面中直接下载： + +- [frp 0.70.0 发布页面](https://github.com/fatedier/frp/releases/tag/v0.70.0) +- [Linux AMD64 安装包](https://github.com/fatedier/frp/releases/download/v0.70.0/frp_0.70.0_linux_amd64.tar.gz) +- [Linux ARM64 安装包](https://github.com/fatedier/frp/releases/download/v0.70.0/frp_0.70.0_linux_arm64.tar.gz) +- [Linux ARMv7 硬浮点安装包](https://github.com/fatedier/frp/releases/download/v0.70.0/frp_0.70.0_linux_arm_hf.tar.gz) +- [Linux RISC-V 64 安装包](https://github.com/fatedier/frp/releases/download/v0.70.0/frp_0.70.0_linux_riscv64.tar.gz) + +大多数云服务器的架构为 `x86_64`。如果 `uname -m` 输出为 `x86_64`，执行以下命令下载并安装： + +```bash +wget https://github.com/fatedier/frp/releases/download/v0.70.0/frp_0.70.0_linux_amd64.tar.gz +tar -xzf frp_0.70.0_linux_amd64.tar.gz +cd frp_0.70.0_linux_amd64 +sudo install -m 755 frps /usr/local/bin/frps +``` + +`sudo install -m 755 frps /usr/local/bin/frps` 的作用是将当前目录下的 `frps` 程序复制到 `/usr/local/bin/frps`，并把权限设置为 `755`，也就是所有用户都可以执行，只有文件所有者可以修改。 + +如果服务器是其他架构，请下载表格中对应的安装包，并将命令中的压缩包名称和解压目录替换为实际名称。公网服务器与 NanoKVM Go 应使用同一个 frp 版本。 + +确认 `frps` 可以运行： + +```bash +/usr/local/bin/frps --version +``` + +> 建议在公网服务器和 NanoKVM Go 上安装同一版本的 frp，避免因版本差异造成配置不兼容。 + +### 创建 frps 配置 + +创建配置目录： + +```bash +sudo mkdir -p /etc/frp +``` + +创建 `/etc/frp/frps.toml`： + +```toml +bindPort = 7000 + +auth.method = "token" +auth.token = "replace_with_a_strong_token" +``` + +请将 `auth.token` 替换为随机生成的强 Token。可以在公网服务器上使用以下命令生成： + +```bash +openssl rand -hex 32 +``` + +frps 和 frpc 配置中的 Token 必须完全一致。Token 只用于验证 frpc，不能代替 NanoKVM Go 自身的登录密码，也不能代替浏览器访问时使用的 HTTPS 证书。 + +### 启动 frps + +先在前台启动，以便直接观察日志： + +```bash +sudo /usr/local/bin/frps -c /etc/frp/frps.toml +``` + +没有报错时，按 `Ctrl+C` 停止测试。前台运行方式适用于所有 Linux 系统，但关闭终端后 frps 也会停止，因此长期使用时还需要将其注册为系统服务。 + +#### 确认 init 系统 + +执行以下命令查看 PID 1 对应的程序： + +```bash +ps -p 1 -o comm= +``` + +根据输出选择启动方式： + +| 输出示例 | 启动方式 | +| --- | --- | +| `systemd` | 使用 systemd | +| `init`、`sysvinit`，并且存在 `/etc/init.d/` | 使用 SysV init | +| `openrc-init` | 使用 OpenRC | + +> 是否可以使用 systemd，应以 PID 1 是否为 `systemd` 为准。系统中存在 `systemctl` 命令，并不表示当前系统已经通过 systemd 启动。 + +#### 使用 systemd 启动 + +仅当 `ps -p 1 -o comm=` 输出为 `systemd` 时，才使用本节命令。 + +创建 `/etc/systemd/system/frps.service`： + +```ini +[Unit] +Description=frp server +After=network-online.target +Wants=network-online.target + +[Service] +Type=simple +ExecStart=/usr/local/bin/frps -c /etc/frp/frps.toml +Restart=on-failure +RestartSec=5s + +[Install] +WantedBy=multi-user.target +``` + +加载服务并设置开机自启： + +```bash +sudo systemctl daemon-reload +sudo systemctl enable --now frps +sudo systemctl status frps +``` + +如果状态为 `active (running)`，表示 frps 已经启动。使用以下命令查看实时日志： + +```bash +sudo journalctl -u frps -f +``` + +#### 使用 SysV init 启动 + +如果系统使用 SysV init，并且存在 `start-stop-daemon` 命令，可以创建 `/etc/init.d/frps`： + +```sh +#!/bin/sh + +DAEMON=/usr/local/bin/frps +CONFIG=/etc/frp/frps.toml +PIDFILE=/var/run/frps.pid + +case "$1" in + start) + if [ -f "$PIDFILE" ] && kill -0 "$(cat "$PIDFILE")" 2>/dev/null; then + echo "frps is already running" + exit 0 + fi + echo "Starting frps" + start-stop-daemon --start --background --make-pidfile \ + --pidfile "$PIDFILE" --exec "$DAEMON" -- -c "$CONFIG" + ;; + stop) + echo "Stopping frps" + start-stop-daemon --stop --pidfile "$PIDFILE" --retry TERM/5/KILL/5 + rm -f "$PIDFILE" + ;; + restart) + "$0" stop + "$0" start + ;; + status) + if [ -f "$PIDFILE" ] && kill -0 "$(cat "$PIDFILE")" 2>/dev/null; then + echo "frps is running" + else + echo "frps is not running" + exit 1 + fi + ;; + *) + echo "Usage: $0 {start|stop|restart|status}" + exit 1 + ;; +esac +``` + +为脚本添加执行权限： + +```bash +sudo chmod +x /etc/init.d/frps +``` + +在 Debian、Ubuntu 等使用 `update-rc.d` 的 SysV init 系统中，设置开机自启并启动服务： + +```bash +sudo update-rc.d frps defaults +sudo service frps start +sudo service frps status +``` + +如果系统没有 `update-rc.d`，请使用当前发行版提供的 SysV init 服务管理命令。 + +#### 没有 systemd 的环境 + +如果出现以下错误： + +```text +System has not been booted with systemd as init system (PID 1). Can't operate. +Failed to connect to bus: Host is down +``` + +说明当前环境不是通过 systemd 启动的，不能继续使用 `systemctl`。可以先使用前台命令测试 frps： + +```bash +sudo /usr/local/bin/frps -c /etc/frp/frps.toml +``` + +如果需要长期运行，请根据当前发行版实际使用的 init 系统添加服务配置。 + +### 放行公网服务器端口 + +在云服务器安全组和系统防火墙中放行： + +- `7000/tcp`：NanoKVM Go 上的 frpc 连接 frps； +- `8080/tcp`：远程浏览器访问 NanoKVM Go。 + +不同 Linux 发行版使用的防火墙工具可能不同。先执行： + +```bash +command -v ufw +command -v firewall-cmd +``` + +根据命令输出选择对应的小节。不要在没有安装相关工具的系统中直接执行命令。 + +#### 使用 UFW + +如果 `command -v ufw` 输出了 UFW 的路径，执行： + +```bash +sudo ufw allow 7000/tcp +sudo ufw allow 8080/tcp +sudo ufw status +``` + +如果终端提示 `ufw: command not found`，说明当前系统没有安装 UFW。UFW 不是运行 frps 的必要组件，请继续检查系统是否使用 firewalld、其他防火墙，或者只使用云服务器安全组。 + +#### 使用 firewalld + +如果 `command -v firewall-cmd` 输出了 firewalld 的命令路径，执行： + +```bash +sudo firewall-cmd --permanent --add-port=7000/tcp +sudo firewall-cmd --permanent --add-port=8080/tcp +sudo firewall-cmd --reload +sudo firewall-cmd --list-ports +``` + +#### 使用云服务器安全组 + +阿里云、华为云、腾讯云、AWS 等云服务器通常还有独立于 Linux 系统的安全组。即使服务器内部没有安装 UFW 或 firewalld，也必须在云服务器管理页面中添加入站规则： + +| 协议 | 端口 | 来源 | +| --- | --- | --- | +| TCP | `7000` | NanoKVM Go 所在网络的公网 IP；无法固定时可临时使用任意来源进行测试 | +| TCP | `8080` | 需要访问 NanoKVM Go 的公网 IP；无法固定时可临时使用任意来源进行测试 | + +测试完成后，建议将来源范围缩小到实际需要的 IP，不要长期允许所有公网地址访问。 + +确认 frps 正在监听 `7000` 端口： + +```bash +sudo ss -lntp | grep ':7000' +``` + +还可以确认远程访问端口是否已由 frps 监听： + +```bash +sudo ss -lntp | grep ':8080' +``` + +> `8080` 端口需要在 NanoKVM Go 上的 frpc 成功连接并注册代理后才会出现。 + +## 在 NanoKVM Go 网页端开启 SSH + +NanoKVM Go 网页端没有 FRP 入口，因此需要先开启 SSH，再通过命令行安装 frpc。 + +### 登录 NanoKVM Go + +1. 在浏览器中打开 NanoKVM Go 的局域网地址； +2. 输入账号和密码，登录网页控制端； +3. 确认 NanoKVM Go 当前的局域网 IP 地址。 + +### 打开 SSH 设置 + +1. 打开 NanoKVM Go 的设置页面； + +![NanoKVM Go 设置页面入口](../../../../assets/NanoKVM/go/network/nanokvm_go_frp_settings_entry.png) + +2. 进入包含 SSH 开关的设置项；开启 SSH 服务； + +![NanoKVM Go SSH 开关页面](../../../../assets/NanoKVM/go/network/nanokvm_go_frp_ssh_switch.png) + +### 通过 SSH 登录 + +在与 NanoKVM Go 位于同一局域网的电脑上打开终端，通过 SSH 登录： + +```bash +ssh @ + +例如: ssh root@192.168.0.225 +``` + +> 首次连接时，终端会询问是否信任设备指纹。确认 IP 地址无误后输入 `yes`，再输入 SSH 密码。用户名是 `root`，密码是 `sipeed` + +## 在 NanoKVM Go 上安装 frpc + +后续命令均在 NanoKVM Go 的 SSH 终端中执行。 + +### 确认系统架构 + +执行： + +```bash +uname -m +``` + +NanoKVM Go 实机执行 `uname -m` 的输出为： + +```text +armv7l +``` + +因此应使用 frp 的 `linux_arm_hf` 安装包。该安装包针对 ARMv7 硬浮点环境构建，不要下载 `linux_arm64`。 + +### 下载并安装 frpc + +NanoKVM Go 的 `/tmp` 通常挂载在内存中的 tmpfs 上，空间较小。建议将安装包下载到根分区中的 `/root` 目录。 + +执行以下命令下载并安装 frpc： + +```bash +cd /root +wget https://github.com/fatedier/frp/releases/download/v0.70.0/frp_0.70.0_linux_arm_hf.tar.gz +tar -xzf frp_0.70.0_linux_arm_hf.tar.gz +cd frp_0.70.0_linux_arm_hf +mkdir -p /usr/local/bin +cp frpc /usr/local/bin/frpc +chmod +x /usr/local/bin/frpc +``` + +下载或解压失败时，请先确认 NanoKVM Go 可以访问 GitHub，并检查命令中的版本号和文件名是否与 Releases 页面一致。 + +确认安装结果： + +```bash +/usr/local/bin/frpc --version +``` + +如果 NanoKVM Go 无法直接访问 GitHub，也可以先在电脑上下载安装包，再使用 `scp` 上传到设备的 `/root` 目录： + +```bash +scp frp_0.70.0_linux_arm_hf.tar.gz @:/root/ +``` + +### 创建 frpc 配置 + +创建配置目录： + +```bash +mkdir -p /etc/frp +``` + +创建 `/etc/frp/frpc.toml`： + +```toml +serverAddr = "203.0.113.10" +serverPort = 7000 + +auth.method = "token" +auth.token = "replace_with_a_strong_token" + +[[proxies]] +name = "nanokvm-go-web" +type = "tcp" +localIP = "127.0.0.1" +localPort = 443 +remotePort = 8080 +``` + +需要修改的参数如下： + +| 参数 | 修改内容 | +| --- | --- | +| `serverAddr` | 公网服务器的实际 IP 或域名 | +| `serverPort` | frps 的 `bindPort`，本文为 `7000` | +| `auth.token` | 与 `frps.toml` 完全相同的 Token | +| `localPort` | NanoKVM Go Web 服务的实际监听端口，本文使用 HTTPS 端口 `443` | +| `remotePort` | 公网访问端口，本文为 `8080` | + +先检查本地 Web 服务是否可以访问： + +```bash +wget --no-check-certificate -S -O /dev/null https://127.0.0.1:443 +``` + +NanoKVM Go 的 HTTP 端口可能会重定向到 HTTPS。若直接访问 `http://127.0.0.1:80` 后看到 `307 Temporary Redirect`，并跳转到 `https://127.0.0.1/`，属于正常现象。由于设备使用的证书通常不是公网可信证书，使用 `wget` 测试时需要加上 `--no-check-certificate`。 + +如果连接被拒绝，请先确认 NanoKVM Go Web 服务的实际端口，再修改 `localPort`。 + +### 测试 frpc 连接 + +在前台启动 frpc： + +```bash +/usr/local/bin/frpc -c /etc/frp/frpc.toml +``` + +日志中出现 `login to server success` 和 `start proxy success` 等成功信息时，表示 frpc 已连接到 frps，并已注册代理。 + +保持该终端运行，在外部网络的浏览器中访问： + +```text +https://203.0.113.10:8080 +``` + +将示例 IP 替换为公网服务器的实际 IP。首次访问时，浏览器可能提示证书不受信任；确认访问的是自己的服务器后，可以继续访问测试。如果可以打开 NanoKVM Go 登录页面，说明 TCP 转发配置正确。完成测试后，返回 SSH 终端并按 `Ctrl+C` 停止 frpc。 + +![frpc 成功连接 frps](../../../../assets/NanoKVM/go/network/nanokvm_go_frp_frpc_success_log.png) + + +### 设置 frpc 开机自启 + +NanoKVM Go 使用 systemd 管理系统服务。创建 `/etc/systemd/system/frpc.service`： + +```ini +[Unit] +Description=frp client for NanoKVM Go +After=network-online.target +Wants=network-online.target + +[Service] +Type=simple +ExecStart=/usr/local/bin/frpc -c /etc/frp/frpc.toml +Restart=always +RestartSec=5s + +[Install] +WantedBy=multi-user.target +``` + +加载服务并设置开机自启： + +```bash +systemctl daemon-reload +systemctl enable --now frpc +systemctl status frpc +``` + +查看实时日志： + +```bash +journalctl -u frpc -f +``` + +重启 NanoKVM Go 后，再次执行 `systemctl status frpc`，确认服务可以自动启动并重新连接 frps。 + + +## 从外网访问 NanoKVM Go + +为了确认访问流量确实经过公网，请将电脑或手机切换到其他网络，例如手机热点或移动数据网络，然后： + +1. 在浏览器中访问 `https://<公网服务器IP>:8080`； +2. 使用 NanoKVM Go 的账号和密码登录； +3. 测试远程画面、键盘、鼠标和电源控制； +4. 刷新页面，确认视频和控制功能仍能正常工作。 + +TCP 代理会原样转发 HTTPS 和 WebSocket 连接，通常不需要单独配置 WebSocket。如果页面能打开但画面或控制功能异常，请查看浏览器开发者工具、frpc 日志和 frps 日志。 + +## 配置域名和 HTTPS（可选） + +基础示例中的 `https://<公网IP>:8080` 使用的是 NanoKVM Go 自身证书，浏览器可能提示证书不受信任。如果有可用域名，可以将域名解析到 frps 服务器，并使用 Nginx 或 Caddy 提供可信 HTTPS 反向代理。 + +以 Nginx 为例，可以让 Nginx 监听 `443`，再将请求转发到 frp 暴露在服务器本机的 `8080` 端口： + +```nginx +server { + listen 443 ssl; + server_name kvm.example.com; + + ssl_certificate /path/to/fullchain.pem; + ssl_certificate_key /path/to/privkey.pem; + + location / { + proxy_pass https://127.0.0.1:8080; + proxy_http_version 1.1; + proxy_ssl_verify off; + proxy_set_header Host $host; + proxy_set_header X-Real-IP $remote_addr; + proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for; + proxy_set_header X-Forwarded-Proto $scheme; + proxy_set_header Upgrade $http_upgrade; + proxy_set_header Connection "upgrade"; + proxy_read_timeout 3600s; + } +} +``` + +配置步骤概括如下： + +1. 将域名的 A 记录指向 frps 服务器公网 IP； +2. 在服务器上安装 Nginx 或 Caddy； +3. 为域名申请 TLS 证书； +4. 将 HTTPS 请求反向代理到 `https://127.0.0.1:8080`； +5. 在安全组和防火墙中放行 `443/tcp`； +6. 确认 `https://kvm.example.com` 可以访问后，关闭公网入站的 `8080/tcp`。 + +配置 HTTPS 后，应通过云安全组和服务器防火墙拒绝 `8080/tcp` 的公网入站流量，仅允许服务器本机的 Nginx 访问该端口。不要在 HTTPS 配置完成后继续将 HTTP 端口公开在互联网中。 + + +## 常见问题 + +### frpc 无法连接 frps + +依次检查： + +- `serverAddr` 和 `serverPort` 是否正确； +- frps 是否为 `active (running)`； +- `7000/tcp` 是否已在云安全组和系统防火墙中放行； +- frps 和 frpc 的 Token 是否完全一致； +- 公网服务器和 NanoKVM Go 的 frp 版本是否兼容； +- NanoKVM Go 是否可以访问互联网和公网服务器。 + +可以在 NanoKVM Go 上测试端口连通性： + +```bash +nc -vz <公网服务器IP> 7000 +``` + +如果系统没有 `nc`，也可以直接观察 frpc 的连接日志。 + +### frpc 已连接，但公网端口无法访问 + +检查： + +- `remotePort` 是否被其他程序或其他 frp 代理占用； +- `8080/tcp` 是否已在云安全组和系统防火墙中放行； +- frpc 日志中是否显示代理启动成功； +- frps 日志中是否出现 `nanokvm-go-web`； +- 浏览器使用的是 `https://`，而不是 `http://`。 + +在公网服务器上确认端口是否正在监听： + +```bash +sudo ss -lntp | grep ':8080' +``` + +### 页面无法打开或返回连接拒绝 + +在 NanoKVM Go 上执行： + +```bash +wget --no-check-certificate -S -O /dev/null https://127.0.0.1:443 +``` + +如果本地访问也失败，说明 `localIP` 或 `localPort` 不正确，或者 NanoKVM Go Web 服务没有运行。 + +### 本地测试提示证书不受信任 + +如果执行 `wget -S -O /dev/null http://127.0.0.1:80` 后看到 `307 Temporary Redirect`，并跳转到 `https://127.0.0.1/`，说明 NanoKVM Go 会自动使用 HTTPS。随后出现以下证书错误通常是正常的： + +```text +ERROR: The certificate of '127.0.0.1' is not trusted. +ERROR: The certificate's owner does not match hostname '127.0.0.1' +``` + +这是因为 NanoKVM Go 使用的证书不是为 `127.0.0.1` 签发的公网可信证书。测试本机 HTTPS 服务时，使用： + +```bash +wget --no-check-certificate -S -O /dev/null https://127.0.0.1:443 +``` + +frpc 配置中也应转发 `localPort = 443`。 + +### 页面能打开，但视频或控制功能异常 + +检查： + +- 浏览器开发者工具中是否存在 WebSocket 连接错误； +- frpc 和 frps 是否频繁断线或重连； +- Nginx/Caddy 是否正确转发 WebSocket Upgrade 请求； +- HTTPS 页面是否加载了 HTTP 资源； +- 公网服务器带宽和 NanoKVM Go 所在网络的上行带宽是否足够。 + +### 重启后 frpc 没有自动运行 + +在 NanoKVM Go 上执行： + +```bash +systemctl status frpc +journalctl -u frpc -b +``` + +检查服务是否已启用、配置文件路径是否正确，以及网络就绪后 frpc 能否连接 frps。 + +## 停用 frp + +### 临时停用 + +如果只是暂时不使用 frp，并希望以后继续使用，可以停止服务并取消开机自启，同时保留程序和配置文件。 + +在 NanoKVM Go 上停止并禁用 frpc： + +```bash +systemctl disable --now frpc +``` + +如果公网服务器使用 systemd，停止并禁用 frps： + +```bash +sudo systemctl disable --now frps +``` + +如果公网服务器使用 SysV init，停止 frps 并取消开机自启： + +```bash +sudo service frps stop +sudo update-rc.d -f frps remove +``` + +需要恢复 NanoKVM Go 上的 systemd 服务时，执行： + +```bash +systemctl enable --now frpc +``` + +需要恢复公网服务器上的 systemd 服务时，执行： + +```bash +sudo systemctl enable --now frps +``` + +需要恢复公网服务器上的 SysV init 服务时，执行： + +```bash +sudo update-rc.d frps defaults +sudo service frps start +``` + +> 只执行与当前 init 系统对应的命令。如果公网服务器使用其他服务管理器，请使用对应的停止和禁用命令。 + +### 彻底卸载 + +frp 是通过手动复制二进制文件安装的，不受 `apt`、`dnf` 等软件包管理器管理。彻底卸载时，需要手动删除服务、程序和配置文件。 + +在 NanoKVM Go 上先停止 frpc，并删除 systemd 服务文件： + +```bash +systemctl disable --now frpc +rm -f /etc/systemd/system/frpc.service +systemctl daemon-reload +``` + +然后在 NanoKVM Go 上删除 frpc 程序和配置： + +```bash +rm -f /usr/local/bin/frpc +rm -f /etc/frp/frpc.toml +rmdir /etc/frp 2>/dev/null || true +``` + +删除 NanoKVM Go 中下载和解压产生的临时文件： + +```bash +rm -f /root/frp_0.70.0_linux_arm_hf.tar.gz +rm -rf /root/frp_0.70.0_linux_arm_hf +``` + +如果实际下载的是其他版本或架构，请将文件名替换为实际名称。 + +如果公网服务器使用 systemd，先删除 frps 服务： + +```bash +sudo systemctl disable --now frps +sudo rm -f /etc/systemd/system/frps.service +sudo systemctl daemon-reload +``` + +如果公网服务器使用 SysV init，先删除 frps 服务： + +```bash +sudo service frps stop +sudo update-rc.d -f frps remove +sudo rm -f /etc/init.d/frps +``` + +完成对应的服务清理后，删除 frps 程序和配置： + +```bash +sudo rm -f /usr/local/bin/frps +sudo rm -f /etc/frp/frps.toml +sudo rmdir /etc/frp 2>/dev/null || true +``` + +公网服务器上的 frp 压缩包和解压目录位于此前执行下载命令的目录中。确认目录和文件名无误后，可以将其删除。 + +### 清理防火墙和其他配置 + +如果安装并使用了 UFW，删除本文添加的放行规则： + +```bash +sudo ufw delete allow 7000/tcp +sudo ufw delete allow 8080/tcp +``` + +如果安装并使用了 firewalld，执行： + +```bash +sudo firewall-cmd --permanent --remove-port=7000/tcp +sudo firewall-cmd --permanent --remove-port=8080/tcp +sudo firewall-cmd --reload +``` + +最后还需要检查并清理： + +- 云服务器安全组中的 `7000/tcp`、`8080/tcp` 等 frp 端口； +- 专门为 NanoKVM Go 创建的 Nginx 或 Caddy 配置； +- 不再使用的 TLS 证书； +- 不再使用的域名 DNS 记录。 + +> 如果相应防火墙命令不存在，可以跳过该组命令。如果端口、反向代理或证书还被其他服务使用，请不要直接删除对应配置。 + +## 安全建议 + +- 为 NanoKVM Go 设置独立的强密码； +- 使用随机生成的强 Token，不要使用本文示例值； +- 不要对公网开放 frps Dashboard； +- 仅开放实际需要的端口，并尽可能通过防火墙限制来源 IP； +- 有域名时，可以配置可信 HTTPS 反向代理； +- 定期更新 NanoKVM Go、frp 和公网服务器系统； +- 定期检查 frpc、frps 和反向代理日志； +- 不再使用时立即停止服务并关闭公网端口。 + +## 参考资料 + +- [frp 官方文档](https://gofrp.org/zh-cn/) +- [frp GitHub 仓库](https://github.com/fatedier/frp) +- [frp Releases](https://github.com/fatedier/frp/releases)