外网远程访问威联通、群晖等 NAS 的异地容灾方案

graph LR
    A[User] -- 访问 --> B{nas.xxx.com};
    B --> C(DDNS);
    C -- tcping-port --> D[Service1<br>Service2<br>more];
    D -- 择优 --> E((解析));
		E -- Service* IP Address --> B;
    B -- FRP --> F[Service*] -- FRP NAT --> G[NAS] -- Nginx Proxy --> H[APP];
		B -- Cloudflare Tunnel --> F2[Cloudflare Service] -- Tunnel --> G2[NAS] -- Nginx Proxy --> H2[APP];

#Frp作为中间件使用
[common]
bind_addr = 0.0.0.0
bind_port = 7000
kcp_bind_port = 7000
token = xxxxxxxxxxxxxxxxxxx
#接受未启用TLS的客户端连接
tls_only = false
# console or real logFile path like ./frpc.log
#log_file = /dev/null
# trace, debug, info, warn, error
log_level = error
log_max_days = 3

server
{
    listen nginx:2096 ssl proxy_protocol;
    server_name nas.xxx.com;
    index index.html;
    root /etc/nginx/web/default/;
    access_log  /LogFile/log/proxy_myqnap_access.log;
    error_log   /LogFile/log/proxy_myqnap_error.log error;
    
    #SSL-START SSL相关配置
    ssl_certificate         /acme.sh/*.xxx.com//fullchain.cer;
    ssl_certificate_key     /acme.sh/*.xxx.com/*.xxx.com.key;
    ssl_protocols TLSv1 TLSv1.1 TLSv1.2 TLSv1.3;
    ssl_ciphers ECDHE-RSA-AES128-GCM-SHA256:HIGH:!aNULL:!MD5:!RC4:!DHE;
    ssl_prefer_server_ciphers on;
    ssl_session_cache shared:SSL:10m;
    ssl_session_timeout 10m;
    error_page 497  https://$host$request_uri;
    #SSL-END
    
    #ERROR-PAGE-START  错误页配置
    #error_page 404 /404.html;
    #error_page 502 /502.html;
    #ERROR-PAGE-END

    #禁止访问的文件或目录
    location ^~ /\.env { return 403; break; }
    location ~ ^/(\.user.ini|\.htaccess|\.git|\.svn|\.conf|\.yml|\.pem|\.key|\.bak|\.types|\.project|LICENSE|README.md) { return 403; break; }

    #QnapWEB
    location / {
        proxy_pass https://qnap:2021;
        #持久化连接
        proxy_connect_timeout 30s;
        proxy_read_timeout 86400s;
        proxy_send_timeout 30s;
        #WebSocket
        proxy_http_version 1.1;
        proxy_set_header Upgrade $http_upgrade;
        proxy_set_header Connection "upgrade";
        #proxy protocol
        include proxy_header_proxy_protocol.conf;
    }

    # 禁止爬虫访问
    if ($http_user_agent ~* "qihoobot|Baiduspider|Googlebot|Googlebot-Mobile|Googlebot-Image|Mediapartners-Google|Adsbot-Google|Feedfetcher-Google|Yahoo! Slurp|Yahoo! Slurp China|YoudaoBot|Sosospider|Sogou spider|Sogou web spider|MSNBot|ia_archiver|Tomato Bot") { return 403; }
    location =/robots.txt {
        default_type text/html;
        return 200 "User-Agent: *\nDisallow: /";
        log_not_found off;access_log off;
        access_log /dev/null;error_log /dev/null;
    }
    #favicon不生成日志
    location =/favicon.ico { 
        log_not_found off;access_log off;
        access_log /dev/null;error_log /dev/null;
    }

}

[common]
server_addr = 1.1.1.1(服务器地址)
server_port = 7000
token = xxxxxxxxxxxxxxxxxxx

# KCP
protocol = tcp
# if tls_enable is true, frpc will connect frps by tls
# 启用此功能后除 xtcp 外，可以不用再设置 use_encryption 重复加密
tls_enable = true
# console or real logFile path like ./frpc.log
#log_file = /etc/frp/log/frpc-rt-home.log
# trace, debug, info, warn, error
log_level = error
log_max_days = 3

#NAS网页管理反代理隧道(Docker)
[TCP_NASWEB_HTTPS]
type = tcp
local_ip = nginx #nginx的NAS内部地址
local_port = 2096 #nginx端口
remote_port = 2096 #服务器端口
use_encryption = false
use_compression = false
#Proxy Protocol 协议
proxy_protocol_version = v2

{
  "dns": "cloudflare",
  "id": "",
  "index4": "default",
  "index6": "default",
  "ipv4": "nas.xxx.com", #域名
  "ipv6": "nas.xxx.com", #域名
  "proxy": null,
  "token": "cloudflare API", #Cloudflare API
  "ttl": 60,
  "port": 2096,
  "pings": 3,
  "tunnelscname": "xxxxxxxx-xxxx-xxxx-xxxx-xxxxxxxxxxxx.cfargotunnel.com", #Connector ID
  "backser": "FRP服务器地址或域名", #备用服务器
  "addresslis4": [
    {
      "name": "FRP服务器地址或域名1" #常用服务器1
    },
    {
      "name": "FRP服务器地址或域名2" #常用服务器2
    }
  ],
  "addresslis6": [
    {
      "name": "FRP服务器地址或域名1"
    },
    {
      "name": "FRP服务器地址或域名2"
    }
  ]
}