分类 默认分类 下的文章

在 macOS 14.3 连接 Oracle Cloud 的控制台，如果直接拷贝网页提供的连接命令，此时会提示 no matching host key type found

# ssh -o ProxyCommand='ssh -W %h:%p -p 443 ocid1.instanceconsoleconnection.oc1.ap-seoul-1.anuwgljryo5x33ac474hmssi6rdeyojcbebghmcatigqawamjjfb7himsjca@instance-console.ap-seoul-1.oci.oraclecloud.com' -N -L localhost:5900:ocid1.instance.oc1.ap-seoul-1.anuwgljryo5x33acw7aiq3oos6ktkb5aeqh4tpthifit4jpd2f2ataavelzq:5900 ocid1.instance.oc1.ap-seoul-1.anuwgljryo5x33acw7aiq3oos6ktkb5aeqh4tpthifit4jpd2f2ataavelzq
Unable to negotiate with 140.204.24.227 port 443: no matching host key type found. Their offer: ssh-rsa
kex_exchange_identification: Connection closed by remote host
Connection closed by UNKNOWN port 65535

- 阅读剩余部分 -

# nmcli connection add type ip-tunnel con-name sit1 ifname sit1 mode sit \
  remote SERVER_IPV4_ADDRESS -- ipv4.method disabled ipv6.method manual \
  ipv6.address CLIENT_IPV6_ADDRESS ipv6.gateway SERVER_IPV6_ADDRESS \
  ip-tunnel.ttl 64

替换其中的 SERVER_IPV4_ADDRESS 以及 SERVER_IPV6_ADDRESS
更多配置方法可参考 IPv6 tunnel via Hurricane Electric
除了 Hurricane Electric 的隧道，还有 Route48 可选

先开启伪装 IP 功能

# 检查是否允许伪装 IP
firewall-cmd --query-masquerade
# 允许防火墙伪装 IP
firewall-cmd --permanent --add-masquerade
# 禁止防火墙伪装 IP
firewall-cmd --permanent --remove-masquerade

然后设置转发规则

# 将 80 端口的流量转发至 8080
firewall-cmd --permanent --add-forward-port=port=80:proto=tcp:toport=8080
# 将 80 端口的流量转发至 192.168.0.1
firewall-cmd --permanent --add-forward-port=port=80:proto=tcp:toaddr=192.168.0.1
# 将 80 端口的流量转发至 192.168.0.1 的 8080 端口
firewall-cmd --permanent --add-forward-port=port=80:proto=tcp:toaddr=192.168.0.1:toport=8080

如果有安全组则打开对应的端口，firewalld 无需再次放行端口

放行 8.8.8.8/32 访问 9090 端口

firewall-cmd --add-rich='rule family="ipv4" source address="8.8.8.8/32" port port="9090" protocol="tcp" accept'

放行 8.8.8.0/24 网段访问 cockpit 服务

firewall-cmd --add-rich='rule family="ipv4" source address="8.8.8.0/24" service name="cockpit" accept'
  1. 1
  2. 2
  3. 3
  4. 4
  5. ...
  6. 11