HackerNews中文版

端口转发通常是访问内部服务（如数据库、管理面板或指标端点）最快的方法。然而，在许多设置中，这意味着需要打开一个公共端口，并依赖防火墙规则或IP限制来确保安全。这些规则往往会随着时间的推移而累积。我一直在研究现代“代理”端口转发模型是如何工作的。它们不是公开暴露服务，而是依赖于仅出站的连接，并创建仅在会话期间存在的身份范围隧道。没有持久的入站端口，也没有长期的防火墙例外。我在这里写了一篇分析，重点关注机制而不是产品宣传： https://www.lynxtrac.com/secure-port-forwarding-without-exposing-services 我很好奇这里的其他人是如何在云环境中处理临时服务访问的。

查看原文

Port forwarding is often the fastest way to access an internal service — a database, admin panel, or metrics endpoint.But in many setups, that means opening a public port and relying on firewall rules or IP restrictions for safety. Those rules tend to accumulate over time.I’ve been looking at how modern “brokered” port forwarding models work. Instead of exposing a service publicly, they rely on outbound-only connections and create identity-scoped tunnels that exist only for the duration of a session.No persistent inbound ports. No long-lived firewall exceptions.I wrote a breakdown here, focusing on mechanics rather than product pitch:https://www.lynxtrac.com/secure-port-forwarding-without-exposing-servicesCurious how others here handle temporary service access in cloud environments.

安全的端口转发，无需暴露内部服务