[{"data":1,"prerenderedAt":675},["ShallowReactive",2],{"post-zh-securely-access-remote-synology-ssh-using-cloudflare-tunnel":3,"surround-zh-blog\u002Fzh\u002Fblog\u002Fsecurely-access-remote-synology-ssh-using-cloudflare-tunnel.md":662},{"id":4,"title":5,"body":6,"canonical":545,"category":648,"date":649,"description":650,"extension":651,"image":652,"meta":653,"navigation":654,"path":655,"seo":656,"slug":657,"status":658,"stem":659,"tags":660,"translationSlug":657,"__hash__":661},"blog\u002Fzh\u002Fblog\u002Fsecurely-access-remote-synology-ssh-using-cloudflare-tunnel.md","使用 Cloudflare Tunnel 安全访问远程群晖 SSH",{"type":7,"value":8,"toc":639},"minimark",[9,13,19,47,52,72,79,82,89,100,106,113,119,149,155,162,176,182,188,194,234,240,267,273,312,318,406,409,415,418,426,435,453,459,462,530,536,539,560,566,569,574,577,635],[10,11,12],"p",{},"您是否拥有一台放在异地（例如家中或办公室）的群晖（Synology） NAS，并希望无论身在何处，都能像在本地一样通过 SSH 安全地进行管理？这里记录了如何利用 Cloudflare Tunnel（零信任隧道）实现这一目标。",[10,14,15],{},[16,17,18],"strong",{},"使用 Cloudflare Tunnel 的优势：",[20,21,22,29,35,41],"ul",{},[23,24,25,28],"li",{},[16,26,27],{},"无需公网 IP","：即使您的群晖处于复杂的内网环境，也无需担心公网 IP 问题。",[23,30,31,34],{},[16,32,33],{},"无需开放端口","：您无需在路由器上设置任何端口转发，极大地提升了安全性，避免了将 SSH 端口暴露在公网被恶意扫描。",[23,36,37,40],{},[16,38,39],{},"高度安全","：所有流量都通过 Cloudflare 的全球网络进行加密和保护，并可享受其强大的 DDoS 防护能力。",[23,42,43,46],{},[16,44,45],{},"稳定且免费","：Cloudflare 为个人用户提供了慷慨的免费套餐，足以满足远程 SSH 管理的需求。",[10,48,49],{},[16,50,51],{},"准备工作：",[53,54,55,61],"ol",{},[23,56,57,60],{},[16,58,59],{},"一台群晖 NAS","：并知道其管理员账户和密码。",[23,62,63,66,67,71],{},[16,64,65],{},"一个您自己的域名","：例如 ",[68,69,70],"code",{},"yourdomain.com","，并且您需要能够修改这个域名的 DNS 设置。",[73,74,76],"h3",{"id":75},"第一部分在-cloudflare-进行云端设置",[16,77,78],{},"第一部分：在 Cloudflare 进行云端设置",[10,80,81],{},"在这一部分，我们将在 Cloudflare 的管理后台创建一个隧道，并获取连接所需的令牌。",[83,84,86],"h4",{"id":85},"步骤-11将您的域名添加到-cloudflare",[16,87,88],{},"步骤 1.1：将您的域名添加到 Cloudflare",[10,90,91,92,99],{},"如果您的域名还没有交由 Cloudflare 管理，请先登录 ",[93,94,98],"a",{"href":95,"rel":96},"https:\u002F\u002Fdash.cloudflare.com\u002F",[97],"nofollow","Cloudflare 官网","，点击 “Add a Site”，按照指引将您的域名添加进来。这通常需要您在您的域名注册商处，将域名的 DNS 服务器（Name Servers）修改为 Cloudflare 指定的地址。",[83,101,103],{"id":102},"步骤-12进入-zero-trust-管理后台",[16,104,105],{},"步骤 1.2：进入 Zero Trust 管理后台",[10,107,108,109,112],{},"在 Cloudflare 主仪表盘，从左侧菜单选择 ",[16,110,111],{},"Zero Trust","。首次进入可能需要您选择一个免费计划并设置一个团队名称。",[83,114,116],{"id":115},"步骤-13创建隧道-tunnel",[16,117,118],{},"步骤 1.3：创建隧道 (Tunnel)",[53,120,121,132,139],{},[23,122,123,124,127,128,131],{},"在 Zero Trust 后台，从左侧菜单选择 ",[16,125,126],{},"Access"," -> ",[16,129,130],{},"Tunnels","。",[23,133,134,135,138],{},"点击 ",[16,136,137],{},"Create a tunnel"," 按钮。",[23,140,141,142,145,146,131],{},"为您的隧道起一个容易识别的名字，例如 ",[68,143,144],{},"synology-nas","，然后点击 ",[16,147,148],{},"Save tunnel",[83,150,152],{"id":151},"步骤-14获取并保存连接器令牌",[16,153,154],{},"步骤 1.4：获取并保存连接器令牌",[10,156,157,158,161],{},"创建隧道后，您会看到一个“Choose your environment”的页面。这里会提供在不同操作系统上安装连接器（",[68,159,160],{},"cloudflared","）的命令。",[10,163,164,167,168,171,172,175],{},[16,165,166],{},"这是非常关键的一步！"," 在右侧的命令框中，您会看到一整条安装命令，类似于 ",[68,169,170],{},"cloudflared service install ey...","。您只需要复制这串命令中，跟在 ",[68,173,174],{},"install"," 后面的那段看起来像乱码的字符串，这就是您的隧道令牌(Token)。请将这串令牌完整地复制下来，保存在一个安全的地方，我们马上会在群晖上用到它。",[73,177,179],{"id":178},"第二部分在群晖-nas-上安装和配置隧道-套件中心版",[16,180,181],{},"第二部分：在群晖 NAS 上安装和配置隧道 (套件中心版)",[10,183,184,185,187],{},"现在，我们使用更方便的套件中心方法，在您的群晖上安装 ",[68,186,160],{}," 软件，并让它连接到 Cloudflare。",[83,189,191],{"id":190},"步骤-21添加第三方套件源",[16,192,193],{},"步骤 2.1：添加第三方套件源",[53,195,196,202,208,215,228],{},[23,197,198,199,131],{},"登录您的群晖 DSM 桌面，打开 ",[16,200,201],{},"套件中心 (Package Center)",[23,203,204,205,138],{},"点击右上角的 ",[16,206,207],{},"设置 (Settings)",[23,209,210,211,214],{},"在弹出的窗口中，选择 ",[16,212,213],{},"套件来源 (Package Sources)"," 标签页。",[23,216,134,217,220,221,224,225],{},[16,218,219],{},"新增 (Add)","，在“名称”处输入 ",[68,222,223],{},"SynoCommunity","，在“位置”处输入以下地址： ",[68,226,227],{},"https:\u002F\u002Fpackages.synocommunity.com",[23,229,134,230,233],{},[16,231,232],{},"确定 (OK)"," 保存。",[83,235,237],{"id":236},"步骤-22从套件中心安装-cloudflared",[16,238,239],{},"步骤 2.2：从套件中心安装 Cloudflared",[53,241,242,248,255,264],{},[23,243,244,245,131],{},"回到套件中心主界面，在左侧菜单选择 ",[16,246,247],{},"社群 (Community)",[23,249,250,251,254],{},"在右上角的搜索框中，输入 ",[68,252,253],{},"Cloudflared"," 进行搜索。",[23,256,257,258,260,261,131],{},"找到 ",[68,259,253],{}," 套件，点击 ",[16,262,263],{},"安装套件 (Install)",[23,265,266],{},"等待安装完成。这一步会自动处理好用户、权限和后台服务等问题。",[83,268,270],{"id":269},"步骤-23配置隧道令牌",[16,271,272],{},"步骤 2.3：配置隧道令牌",[53,274,275,284,290,301],{},[23,276,277,278,280,281,131],{},"安装完成后，在套件中心找到 ",[68,279,253],{},"，点击",[16,282,283],{},"打开 (Open)",[23,285,286,287,131],{},"套件的配置界面会非常简洁，通常会有一个输入框，提示您输入 ",[16,288,289],{},"Tunnel Token",[23,291,292,293,296,297,300],{},"将您在 ",[16,294,295],{},"步骤 1.4"," 中从 Cloudflare 仪表盘复制的那一长串",[16,298,299],{},"令牌字符串","，完整地粘贴到这个输入框中。",[23,302,303,304,307,308,311],{},"点击",[16,305,306],{},"应用 (Apply)"," 或 ",[16,309,310],{},"保存 (Save)","。套件会自动在后台启动并使用您的令牌连接到 Cloudflare 的网络。",[83,313,315],{"id":314},"步骤-24验证连接并指向-ssh-服务",[16,316,317],{},"步骤 2.4：验证连接并指向 SSH 服务",[53,319,320,327,333,338,401],{},[23,321,322,323,326],{},"回到您浏览器中的 Cloudflare Zero Trust 后台。刷新页面，您应该能在刚才的隧道配置页面看到您的连接器状态显示为 ",[16,324,325],{},"“Connected”","。如果看到了，说明您的群晖已经成功连接到云端！",[23,328,329,330,214],{},"现在，我们来告诉这个隧道，当收到请求时，应该把它转发到群晖的 SSH 服务。点击 ",[16,331,332],{},"Public Hostnames",[23,334,134,335,131],{},[16,336,337],{},"Add a public hostname",[23,339,340,341],{},"填写规则：\n",[20,342,343,355,361,367],{},[23,344,345,348,349,307,352,131],{},[16,346,347],{},"Subdomain",": 输入一个您喜欢的子域名，例如 ",[68,350,351],{},"ssh",[68,353,354],{},"nas",[23,356,357,360],{},[16,358,359],{},"Domain",": 选择您的域名。",[23,362,363,366],{},[16,364,365],{},"Path",": 留空。",[23,368,369,372,373],{},[16,370,371],{},"Service",":\n",[20,374,375,387],{},[23,376,377,380,381,131],{},[16,378,379],{},"Type",": ",[16,382,383,384],{},"必须选择 ",[68,385,386],{},"SSH",[23,388,389,392,393,396,397,400],{},[16,390,391],{},"URL",": 输入 ",[68,394,395],{},"localhost:22"," （",[68,398,399],{},"22"," 是群晖 SSH 服务的默认端口）。",[23,402,134,403,233],{},[16,404,405],{},"Save hostname",[10,407,408],{},"至此，服务器端的配置已全部完成！",[73,410,412],{"id":411},"第三部分在您的电脑上配置-ssh-客户端",[16,413,414],{},"第三部分：在您的电脑上配置 SSH 客户端",[10,416,417],{},"最后一步，我们需要配置您自己电脑上的 SSH 客户端，让它知道如何通过 Cloudflare Tunnel 进行连接。",[83,419,421],{"id":420},"步骤-31在您的电脑上安装-cloudflared",[16,422,423,424],{},"步骤 3.1：在您的电脑上安装 ",[68,425,160],{},[10,427,428,429,431,432,434],{},"您的电脑也需要安装这个工具来作为“客户端代理”。您可能会疑惑，为什么群晖上装了，电脑上还要装？这是因为它们扮演的角色不同：群晖上的 ",[68,430,160],{}," 负责把内部服务安全地“送”到云端；而您电脑上的 ",[68,433,160],{}," 则负责将您的 SSH 命令安全地“带”到云端。两者在云端握手，才能构成一条完整的加密通道。",[20,436,437,447],{},[23,438,439,442,443],{},[16,440,441],{},"官方下载地址","：",[93,444,445],{"href":445,"rel":446},"https:\u002F\u002Fdevelopers.cloudflare.com\u002Fcloudflare-one\u002Fconnections\u002Fconnect-networks\u002Fdownloads\u002F",[97],[23,448,449,450,131],{},"请根据您的操作系统（Windows\u002FmacOS\u002FLinux）下载并安装。例如，在 macOS 上，推荐使用 Homebrew：",[68,451,452],{},"brew install cloudflared",[83,454,456],{"id":455},"步骤-32修改本地-ssh-配置文件",[16,457,458],{},"步骤 3.2：修改本地 SSH 配置文件",[10,460,461],{},"这是让魔法发生的关键。",[53,463,464,475,485],{},[23,465,466,467,470,471,474],{},"用文本编辑器打开您电脑的 SSH 配置文件。通常位于 ",[68,468,469],{},"~\u002F.ssh\u002Fconfig"," (macOS\u002FLinux) 或 ",[68,472,473],{},"C:\\Users\\您的用户名\\.ssh\\config"," (Windows)。如果文件或目录不存在，请手动创建。",[23,476,477,478,481,482],{},"在文件中",[16,479,480],{},"添加","以下配置块：",[68,483,484],{},"# Connect to Synology NAS via Cloudflare Tunnel Host ssh.yourdomain.com ProxyCommand \u002Fopt\u002Fhomebrew\u002Fbin\u002Fcloudflared access ssh --hostname %h",[23,486,487,490,491],{},[16,488,489],{},"请务必修改","：\n",[20,492,493,510],{},[23,494,495,498,499,502,503,506,507,131],{},[68,496,497],{},"Host ssh.yourdomain.com",": 将这里的 ",[68,500,501],{},"ssh.yourdomain.com"," 替换为您在 ",[16,504,505],{},"步骤 2.4"," 中设置的",[16,508,509],{},"完整主机名",[23,511,512,515,516,518,519,522,523,470,526,529],{},[68,513,514],{},"\u002Fopt\u002Fhomebrew\u002Fbin\u002Fcloudflared",": 将这里替换为您电脑上 ",[68,517,160],{}," 的",[16,520,521],{},"实际安装路径","。您可以在终端中输入 ",[68,524,525],{},"which cloudflared",[68,527,528],{},"where.exe cloudflared"," (Windows) 来找到它。",[73,531,533],{"id":532},"第四部分开始远程连接",[16,534,535],{},"第四部分：开始远程连接！",[10,537,538],{},"所有配置都已完成！现在，无论您身在何处，只需打开您电脑的终端，输入我们熟悉的 SSH 命令：",[540,541,546],"pre",{"className":542,"code":543,"language":544,"meta":545,"style":545},"language-bash shiki shiki-themes github-light github-dark","ssh [您的群晖用户名]@ssh.yourdomain.com\n","bash","",[68,547,548],{"__ignoreMap":545},[549,550,553,556],"span",{"class":551,"line":552},"line",1,[549,554,351],{"class":555},"sScJk",[549,557,559],{"class":558},"sVt8B"," [您的群晖用户名]@ssh.yourdomain.com\n",[10,561,562,563,565],{},"(请将 ",[68,564,501],{}," 替换为您自己的主机名)",[10,567,568],{},"您会发现，系统会正常提示您输入密码，验证通过后，您就成功登录到了远方的群晖 NAS！",[73,570,572],{"id":571},"结语与常见问题排查",[16,573,571],{},[10,575,576],{},"恭喜您！您已经成功搭建了一条极其安全、便捷的回家之路。",[20,578,579,593,614],{},[23,580,581,584,585,588,589,592],{},[16,582,583],{},"Q: 连接超时或失败怎么办？"," A: 首先，请回到 Cloudflare Zero Trust 的隧道管理页面，确认您的隧道连接器状态是否为绿色的 “Connected”。如果不是，请尝试在群晖套件中心重启 Cloudflared 套件。如果状态正常但仍无法连接，请仔细检查您本地 ",[68,586,587],{},".ssh\u002Fconfig"," 文件中的主机名和 ",[68,590,591],{},"ProxyCommand"," 路径是否完全正确。",[23,594,595,602,603,605,606,609,610,613],{},[16,596,597,598,601],{},"Q: SSH 连接时提示 ",[68,599,600],{},"Classic tunnels have been deprecated"," 错误？"," A: 这是因为您的 SSH 配置文件中 ",[68,604,591],{}," 命令过时了。请确保您使用的是 ",[68,607,608],{},"cloudflared access ssh --hostname %h"," 而不是旧的 ",[68,611,612],{},"cloudflared tunnel ..."," 命令。",[23,615,616,623,624,627,628,627,631,634],{},[16,617,618,619,622],{},"Q: 使用 ",[68,620,621],{},"sudo"," 时，即使输入正确的密码也提示失败？"," A: 这很可能是因为您本地电脑的键盘布局与远程服务器不一致，导致输入的特殊字符（如 ",[68,625,626],{},"@",", ",[68,629,630],{},"!",[68,632,633],{},"#","）出错。请参考我们之前的讨论，使用“回显测试”或暂时修改为简单密码来解决。",[636,637,638],"style",{},"html pre.shiki code .sScJk, html code.shiki .sScJk{--shiki-default:#6F42C1;--shiki-dark:#B392F0}html pre.shiki code .sVt8B, html code.shiki .sVt8B{--shiki-default:#24292E;--shiki-dark:#E1E4E8}html .default .shiki span {color: var(--shiki-default);background: var(--shiki-default-bg);font-style: var(--shiki-default-font-style);font-weight: var(--shiki-default-font-weight);text-decoration: var(--shiki-default-text-decoration);}html .shiki span {color: var(--shiki-default);background: var(--shiki-default-bg);font-style: var(--shiki-default-font-style);font-weight: var(--shiki-default-font-weight);text-decoration: var(--shiki-default-text-decoration);}html .dark .shiki span {color: var(--shiki-dark);background: var(--shiki-dark-bg);font-style: var(--shiki-dark-font-style);font-weight: var(--shiki-dark-font-weight);text-decoration: var(--shiki-dark-text-decoration);}html.dark .shiki span {color: var(--shiki-dark);background: var(--shiki-dark-bg);font-style: var(--shiki-dark-font-style);font-weight: var(--shiki-dark-font-weight);text-decoration: var(--shiki-dark-text-decoration);}",{"title":545,"searchDepth":640,"depth":640,"links":641},2,[642,644,645,646,647],{"id":75,"depth":643,"text":78},3,{"id":178,"depth":643,"text":181},{"id":411,"depth":643,"text":414},{"id":532,"depth":643,"text":535},{"id":571,"depth":643,"text":571},"coder","2025-07-12","您是否拥有一台放在异地（例如家中或办公室）的群晖（Synology） NAS，并希望无论身在何处，都能像在本地 ...","md",null,{},true,"\u002Fzh\u002Fblog\u002Fsecurely-access-remote-synology-ssh-using-cloudflare-tunnel",{"title":5,"description":650},"securely-access-remote-synology-ssh-using-cloudflare-tunnel","publish","zh\u002Fblog\u002Fsecurely-access-remote-synology-ssh-using-cloudflare-tunnel",[],"QGdGBGNdAENivdjQCcDtGOhThBnOPoZEQ0H2kIeZY-w",[663,669],{"title":664,"path":665,"stem":666,"slug":667,"date":668,"children":-1},"成都3D微缩图","\u002Fzh\u002Fblog\u002Fchengdu-in-3d-miniature","zh\u002Fblog\u002Fchengdu-in-3d-miniature","chengdu-in-3d-miniature","2025-12-14",{"title":670,"path":671,"stem":672,"slug":673,"date":674,"children":-1},"翻译：张彦的前言","\u002Fzh\u002Fblog\u002Fsource-note-ian-johnsons-foreword-to-faithful-disobedience","zh\u002Fblog\u002Fsource-note-ian-johnsons-foreword-to-faithful-disobedience","source-note-ian-johnsons-foreword-to-faithful-disobedience","2025-04-10",1791430075776]