{"id":847,"date":"2026-01-13T18:44:54","date_gmt":"2026-01-13T10:44:54","guid":{"rendered":"https:\/\/www.ddosgj.com\/?p=847"},"modified":"2026-01-13T18:45:19","modified_gmt":"2026-01-13T10:45:19","slug":"ali-cloud-cdn-realize-home-broadband-no-lose-port-solution-aliyun-esa","status":"publish","type":"post","link":"https:\/\/www.ddosgj.com\/en\/847-html","title":{"rendered":"AliCloud CDN Realization of Home Broadband Loss-Free Port Solution: AliCloud ESA In-Depth Pit Avoidance Guide"},"content":{"rendered":"

Every player who tosses around a home NAS (GroupHub, Weilian) or private cloud service will eventually face a question of elegance or lack thereof: the access address.<\/p>\n

When connecting back to the private cloud via DDNS, the address has to be followed by a small tail, such as :9416 or :8080, which is not only hard to remember, but also blocked by some company's intranet firewalls.<\/p>\n

Today I'm sharing an ultimate solution using AliCloud ESA (Edge Security Acceleration): say goodbye to non-standard ports and realize HTTPS full domain opening in seconds. The end of the article summarizes the details of avoiding pitfalls that took 3 days to get through, so I recommend collecting it.<\/p>\n

I. Why ESA<\/span>\uff1f<\/h3>\n

Traditional CDNs can only accelerate 80 or 443, but with our home broadband, these two ports are usually blocked. The core black technology of AliCloud ESA is: back to source port rewriting. It allows users to access your standard domain name (port 443) externally, and then at Ali's edge nodes, it automatically forwards the request to a non-standard port at your home. The whole process is transparent to the user, no need to enter the port number again.<\/p>\n

II. Practical Steps: From \u201cTailed\u201d to \u201cPort-Free\u201d<\/h3>\n

1. Hosted domain names<\/h4>\n

Change your domain DNS to the servers provided by Aliyun ESA. Turn on \u201cProxy Status\u201d (small orange cloud) in the control panel.<\/p>\n

2. Configure \u201crewrite back to source\u201d rules (core)<\/h4>\n

Go to \u201cRule Settings\u201d -> \u201cBack to Source Configuration\u201d in the ESA:<\/p>\n

Match conditions: hostname equal to music.yourdomain.com (for your service), multiple second-level domain names in order to saveThe number of return rule entries can be set to select all incoming requests as shown in the illustration:<\/span><\/p>\n

Back to the source protocol: It is recommended to choose \u201cHTTP\u201d (most of the home intranet services do not have TLS, and ESA is responsible for the encryption of the extranet).<\/p>\n

Back to source port rewrite: turn on and fill in your real intranet port (such as 9416 or 8080 which is the port of each of your QunHui services).<\/p>\n

3. Setting the SSL\/TLS mode<\/h4>\n

In SSL\/TLS -> Overview, set the encryption mode to \u201cFull\u201d or \u201cFlexible\u201d, which is the default for the free version. Then you can securely access your home private cloud via https:\/\/.<\/p>\n

III. In-depth pothole avoidance guide (dry goods, must see!)<\/h3>\n

Many students found that after the configuration of the \u201cstill can not open\u201d or \u201cfrequent timeout\u201d, the probability is that they fell into the following three pits:<\/p>\n

Pit 1: Rule Priority (Priority)<\/h4>\n

Phenomenon: The forwarding of domain A is configured, but the result is that the service jumps to the domain B. Countermeasure: The rules of ESA are executed in order. If you have more than one subdomain, please make sure to click \u201cSort\u201d to put the forwarding rule specific to the subdomain on the top.<\/p>\n

Pit 2: WebSocket Master Switch<\/h4>\n

Phenomenon: The web page can be opened, but the service can't establish a long connection (e.g. some admin panels can't be logged in). Countermeasure: Nowadays private cloud services use WebSocket a lot, you have to manually search for and enable \u201cWebSocket\u201d option in \u201cRule Settings\u201d -> \u201cSite Settings\u201d of ESA. \"This is one of the most overlooked points. This is the most overlooked point!<\/p>\n

Pitfall 3: Return Source Protocol Conflict (Error 521)<\/h4>\n

Phenomenon: Browser prompts HTTP ERROR 521. Countermeasure: Check your back-origin rules. If ESA tries to connect to your home HTTP port using HTTPS protocol, the connection will be rejected. For home broadband, make sure to manually specify HTTP as the return protocol.<\/p>\n

4. 2.5G Broadband Test Experience<\/h3>\n

In Urumqi Unicom's 2.5G broadband environment, the improvement after ESA acceleration is very obvious:<\/p>\n

Eliminate Latency: Ali Edge nodes automatically find the optimal path, and the latency of cross-carrier access is significantly reduced.<\/p>\n

Aesthetics and security: the real port is hidden and only a standard HTTPS URL is shown to the public.<\/p>\n

Stability: Even if the IP of the home public network changes, as long as the DDNS synchronization is successful, the connection on the ESA side is almost senseless.<\/p>\n

Conclusion<\/h3>\n

The joy of tossing around the digitalization of the home lies in the technical means to make complex networks simple and usable.<\/p>\n

If you also encountered \u201c522 Connection Timed Out\u201d or \u201cInvalid Certificate\u201d during the configuration process, welcome to leave a message in the comment section.<\/p>","protected":false},"excerpt":{"rendered":"

Every home NAS (Qunhui, WLAN) or private cloud service player will face an elegant problem: the access address. When connecting to a private cloud via DDNS, the address always has a little tail at the end, such as :9416 or :8080, which is not only hard to remember, but also directly blocked by some company's intranet firewalls. Today, I'd like to share an ultimate solution using AliCloud ESA (Edge Security Acceleration): say goodbye to non-standard ports and realize HTTPS for all domain names in seconds. The end of the article summarizes the details of avoiding pitfalls after 3 days of tossing and running through, and it is recommended to collect them. Why ESA? Traditional CDNs can only accelerate 80 or 443 ports, which are usually blocked in our home broadband.<\/p>","protected":false},"author":1,"featured_media":103,"comment_status":"open","ping_status":"closed","sticky":false,"template":"","format":"standard","meta":{"_seopress_robots_primary_cat":"none","_seopress_titles_title":"","_seopress_titles_desc":"","_seopress_robots_index":"","footnotes":""},"categories":[150],"tags":[],"collection":[],"class_list":["post-847","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-updates"],"_links":{"self":[{"href":"https:\/\/www.ddosgj.com\/en\/wp-json\/wp\/v2\/posts\/847","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/www.ddosgj.com\/en\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/www.ddosgj.com\/en\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/www.ddosgj.com\/en\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/www.ddosgj.com\/en\/wp-json\/wp\/v2\/comments?post=847"}],"version-history":[{"count":1,"href":"https:\/\/www.ddosgj.com\/en\/wp-json\/wp\/v2\/posts\/847\/revisions"}],"predecessor-version":[{"id":850,"href":"https:\/\/www.ddosgj.com\/en\/wp-json\/wp\/v2\/posts\/847\/revisions\/850"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/www.ddosgj.com\/en\/wp-json\/wp\/v2\/media\/103"}],"wp:attachment":[{"href":"https:\/\/www.ddosgj.com\/en\/wp-json\/wp\/v2\/media?parent=847"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/www.ddosgj.com\/en\/wp-json\/wp\/v2\/categories?post=847"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/www.ddosgj.com\/en\/wp-json\/wp\/v2\/tags?post=847"},{"taxonomy":"collection","embeddable":true,"href":"https:\/\/www.ddosgj.com\/en\/wp-json\/wp\/v2\/collection?post=847"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}