ehang-io / nps

一款轻量级、高性能、功能强大的内网穿透代理服务器。支持tcp、udp、socks5、http等几乎所有流量转发,可用来访问内网网站、本地支付接口调试、ssh访问、远程桌面,内网dns解析、内网socks5代理等等……,并带有功能强大的web管理端。a lightweight, high-performance, powerful intranet penetration proxy server, with a powerful web management terminal.
https://ehang.io/nps/documents
GNU General Public License v3.0
29.75k stars 5.37k forks source link

Random subdomain for each client, plus API to connect to DNS services such as Cloudflare #1175

Open akymakr opened 1 year ago

akymakr commented 1 year ago

Is your feature request related to a problem? Please describe. First of all, NPS is powerful, easy to deploy on Ubuntu server. So what I need is just a clear install Ubuntu server with NPS installed, plus some firewall settings and boom! A NPS is here. You can set the port forwarding config from the server side and pass it through port 8024. As long as the bridge is connected and you are golden. Once the NPC is set as a cronjob and basically you rely on your internet. Plus an API to implement more stuffs plus you can add, modify, delete, stop clients and tunnels. Perfect!

Describe the solution you'd like I see one thing that you can improve for security measure is that you can add a custom domain method. So each client has its own custom subdomain just like the vkey (but could be different). And I know what you might ask is: "Yeah I let you to create the subdomain but you still need to add that on the DNS service provider." And afaik, Cloudflare provides a free API that you can add or remove a DNS entry. Thus, as long as NPS also communicates with Cloudflare API, you should be able to create or remove a subdomain.

So what's next? NPS should check whether a specific port forwarding is from the specific URL. For example I have 2 clients but I only got 1 NPS. Client A has 2 ports (11001 and 11002), Client B has 1 port (11101). Both has its own subdomain and if someone is using Client A's subdomain connecting to Client B's port 11101, NPS refuses or drops the connection. If a client doesn't have a custom domain, they are allowed to connect using IPs or any A records pointing to the NPS.

Describe alternatives you've considered This is the best open-source NAT transversal on the Internet by far.

Additional context You already have an option for specific domain pointing to a specific host. I don't know if this is already done. Otherwise, I just need to implement your API with the Cloudflare API so once I created a client, it generates a random subdomain and I will just send the request to Cloudflare API to add 1 entry.

For your reference: https://ehang-io.github.io/nps/#/feature?id=url%e8%b7%af%e7%94%b1

Thank you very much for reading this. 謝謝!