Cloudflare：优选 IP 与 Tunnel 内网穿透

graph TD
C[客户端] --> Q{填什么入口?}
Q -->|CF 官方 IP| O[官方优选
挑 CF 自家 IP]
Q -->|别人 VPS 的反代 IP| R[反代优选
挑别人架的反代]
Q -->|一个域名| D[优选域名
域名背后是一堆 IP]
O --> CF[Cloudflare CDN]
R --> VPS[云厂商 VPS
跑着 Nginx 反代] --> CF
D --> X{解析出的是?}
X -->|官方 IP| CF
X -->|反代 IP| VPS
CF --> S[你的源站 VPS]
VPS --> CF

https://www.cloudflare.com/ips/

173.245.48.0/20
103.21.244.0/22
103.22.200.0/22
103.31.4.0/22
141.101.64.0/18
108.162.192.0/18
190.93.240.0/20
188.114.96.0/20
197.234.240.0/22
198.41.128.0/17
162.158.0.0/15
104.16.0.0/13
104.24.0.0/14
172.64.0.0/13
131.0.72.0/22

https://github.com/XIU2/CloudflareSpeedTest

# Linux / macOS
./CloudflareST

# Windows
.\CloudflareST.exe

# 标准跑法
./CloudflareST -n 500 -t 4 -dn 20 -dt 10 -tl 200 -tll 40

# 限定国家段（手动准备 ip.txt 只放某个段的）
./CloudflareST -f ip.txt -p 10 -o result.csv

IP 地址          已发送  已接收  丢包率  平均延迟  下载速度 (MB/s)
104.20.157.18     4       4      0.00     35.21     12.45
172.67.128.45     4       4      0.00     38.10     10.21
104.18.32.99      4       4      0.00     41.50      9.87

# mihomo 节点示例
proxies:
  - name: CF-Fast
    type: vless
    server: 104.20.157.18           # 优选出来的 IP
    port: 443
    uuid: your-uuid-here
    tls: true
    servername: your-cdn-domain.com # 真实的 CDN 域名（SNI 不能改）
    network: ws
    ws-opts:
      path: /your-path
      headers:
        Host: your-cdn-domain.com

visa.com           ← 解析出来是 CF 官方 IP
wto.org            ← 同上

cdn-fast.example.com  A  8.1.2.3
cdn-fast.example.com  A  47.4.5.6
cdn-fast.example.com  A  103.7.8.9

https://www.wetest.vip/page/cloudflare/cname.html

cdn.example.com  A  1.1.1.1
cdn.example.com  A  2.2.2.2
cdn.example.com  A  3.3.3.3

cdn.example.com  A     1.1.1.1
cdn.example.com  AAAA  2400:xxxx::xxx

cdn.example.com  CNAME  fast-pool.cdn-provider.xyz

#!/usr/bin/env bash
set -e

# 1. 跑优选
./CloudflareST -n 500 -t 4 -dn 10 -dt 10 -tl 200 -p 5 -o result.csv

# 2. 解析前 5 个 IP
IPS=$(awk -F, 'NR>1 {print $1}' result.csv | head -5)

# 3. 调 CF API 把这些 IP 写到 DNS（伪代码）
for ip in $IPS; do
    curl -X POST "https://api.cloudflare.com/client/v4/zones/$ZONE_ID/dns_records" \
        -H "Authorization: Bearer $CF_TOKEN" \
        -H "Content-Type: application/json" \
        --data '{"type":"A","name":"fast","content":"'$ip'","ttl":120,"proxied":false}'
done

0 4 * * * /path/to/auto-optimize.sh > /var/log/cf-optimize.log 2>&1

graph LR
U[外网用户] -->|HTTPS 访问 your-app.example.com| CF[Cloudflare 边缘节点]
CF <-->|加密长连接
主动从内网发起| CL[cloudflared 客户端
跑在你内网机器上]
CL --> S[内网服务
localhost:8080]

# Linux (Debian/Ubuntu)
curl -L --output cloudflared.deb \
  https://github.com/cloudflare/cloudflared/releases/latest/download/cloudflared-linux-amd64.deb
sudo dpkg -i cloudflared.deb

# 服务化 + 用 CF 给你的 token 注册
sudo cloudflared service install <YOUR-TUNNEL-TOKEN>

# Windows
# 下载 https://github.com/cloudflare/cloudflared/releases 里的 .msi 安装
cloudflared.exe service install <YOUR-TUNNEL-TOKEN>

# Docker
docker run -d \
  --name cloudflared \
  --restart unless-stopped \
  cloudflare/cloudflared:latest \
  tunnel --no-autoupdate run --token <YOUR-TUNNEL-TOKEN>

curl -I https://nas.your-domain.com

curl -L --output cloudflared.deb \
  https://github.com/cloudflare/cloudflared/releases/latest/download/cloudflared-linux-amd64.deb
sudo dpkg -i cloudflared.deb

cloudflared --version

cloudflared tunnel login

cloudflared tunnel create home-nas

tunnel: <你的 UUID>
credentials-file: /home/youruser/.cloudflared/<UUID>.json

ingress:
  - hostname: nas.your-domain.com
    service: http://localhost:8080
  - hostname: jellyfin.your-domain.com
    service: http://localhost:8096
  - hostname: ssh.your-domain.com
    service: ssh://localhost:22
  - service: http_status:404         # 兜底

cloudflared tunnel route dns home-nas nas.your-domain.com
cloudflared tunnel route dns home-nas jellyfin.your-domain.com
cloudflared tunnel route dns home-nas ssh.your-domain.com

# 前台跑（测试）
cloudflared tunnel run home-nas

# 服务化
sudo cloudflared service install
sudo systemctl status cloudflared

ingress:
  - hostname: video.your-domain.com
    service: http://localhost:8096
  - service: http_status:404

ingress:
  - hostname: ssh.your-domain.com
    service: ssh://localhost:22

# 本地 cloudflared
cloudflared access ssh --hostname ssh.your-domain.com

# 或者写到 ~/.ssh/config
Host my-home
    HostName ssh.your-domain.com
    ProxyCommand cloudflared access ssh --hostname %h

ingress:
  - hostname: router.your-domain.com
    service: https://192.168.1.1
    originRequest:
      noTLSVerify: true     # 路由器自签名证书要加这条