如何搭建可远程访问的公网文件服务器？

Hey there! I’ve walked dozens of users through this exact problem, so let’s break down why you can only access your server locally and fix it for good. The core issue here is that your home network is blocking traffic from the internet to your server—we just need to punch the right holes and set up some safeguards.

1. First: Lock Down Your Server’s Local IP #

Before we mess with router settings, make sure your file server has a static local IP address (not one that changes when you reboot). This ensures your router always knows where to send external traffic:

• On Windows: Open Command Prompt and run ipconfig—note the "IPv4 Address" (e.g., 192.168.1.105). Then go to your network adapter settings to set this as a static IP (instead of relying on DHCP).
• On Linux/macOS: Run ip addr (Linux) or ifconfig (macOS) to get your local IP, then edit your network config to set it static (a quick search for "[your OS] static IP" will walk you through the exact steps).

2. Port Forwarding: The Critical Router Step #

This is the most common roadblock. Your router acts as a gatekeeper—you need to tell it to send external traffic for your file server to the right device:

1. Log into your router’s admin panel (usually at 192.168.1.1 or 192.168.0.1—check the label on your router for the exact address).
2. Look for "Port Forwarding", "Virtual Servers", or "NAT Rules" (names vary by router brand).
3. Create a new rule with these details:
   • External Port: Pick a non-default port (avoid 445 for SMB, use something like 1445 instead—it’s far more secure).
   • Internal Port: Match the port your file service uses (e.g., 445 for SMB, 2049 for NFS, or whatever port your WebDAV/HTTP file server runs on).
   • Internal IP: The static local IP you set for your server.
   • Protocol: Select TCP (or TCP+UDP if you’re unsure which your service uses).
4. Save the rule and reboot your router to apply changes.

3. Fix Dynamic Public IPs with DDNS #

Most home ISPs assign dynamic public IPs (they change every few days). To avoid having to look up your IP every time, use Dynamic DNS (DDNS):

• Many routers have built-in DDNS support. Find the DDNS section in your router admin, sign up for a free service (like No-IP or DuckDNS), and link your account. The router will automatically update your domain to point to your current public IP.
• If your router doesn’t support DDNS, install a DDNS client on your file server (e.g., ddclient for Linux, or the official No-IP client for Windows) to handle IP updates automatically.

4. Unblock Firewalls (Local + ISP) #

Firewalls love to block external traffic—don’t forget to check both:

• Server Local Firewall:
  • Windows: Open "Windows Defender Firewall with Advanced Security", create an inbound rule allowing traffic on your external port (e.g., 1445) for TCP.
  • Linux: Run sudo ufw allow 1445/tcp (for UFW) or sudo firewall-cmd --add-port=1445/tcp --permanent && sudo firewall-cmd --reload (for firewalld).
• ISP Firewall: Some ISPs block common ports (like 445, 80, 443). If your port forwarding rule doesn’t work, switch to a less common port (e.g., 23456) and update your port forwarding rule to match.

5. Test It (The Right Way!) #

Don’t test with your home Wi-Fi—use your phone’s cellular data or a friend’s network to simulate external access:

• For SMB: On Windows, open File Explorer and type \\your-ddns-domain:1445; on macOS, use smb://your-ddns-domain:1445.
• For a web-based file server: Open a browser and go to http://your-ddns-domain:your-port.
• If direct IP access works (http://your-public-ip:your-port) but the DDNS doesn’t, your DDNS setup is the issue—double-check the client/router settings.

Quick Security Tips #

• Never use default ports or weak passwords—strong authentication is non-negotiable for external access.
• If your ISP doesn’t provide a public IP (some don’t), use an internal tunneling tool like FRP or Ngrok (just be aware of bandwidth limits and privacy considerations).
• Consider adding an IP whitelist in your router’s port forwarding settings to only allow traffic from specific external IPs (if you know where you’ll be accessing from).

内容的提问来源于stack exchange，提问作者Codrut