将手机作为服务器使用
在我们之前探索的各个领域中，无论使用安卓手机运行AI聊天网站、Kali Linux、Metasploit Framework还是其它某种服务，都经常需要将手机锁屏后长期后台运行程序。
我的绝大部分设备都是小米和红米手机。在获取唤醒锁（Wakelock）的情况下，绝大部分安卓应用都能在锁屏状态下平稳地后台运行。任何网络行为也不受干扰。
诡异的华为Mate 8
然而，情况到了我一台华为Mate 8的手机上就变得诡异了起来。让我们做一个测试。
先在Mate 8上，Termux应用中获取唤醒锁并开启SSH服务。
shell
sshd接着，查看其IP地址信息和默认用户名
shell
whoami
ifconfig再用局域网下的另一台设备连接。
kotlin
Windows PowerShell
Copyright (C) Microsoft Corporation. All rights reserved.
PS C:\WINDOWS\system32> ssh u0_a167@192.168.0.238 -p8022
The authenticity of host '[192.168.0.238]:8022 ([192.168.0.238]:8022)' can't be established.
ED25519 key fingerprint is SHA256:d7vbdofcyUxZrDbLmvEbij9JIIxE2SYMhA2WtOzlYy4.
This key is not known by any other names.
Are you sure you want to continue connecting (yes/no/[fingerprint])? yes
Warning: Permanently added '[192.168.0.238]:8022' (ED25519) to the list of known hosts.
u0_a167@192.168.0.238's password:
Welcome to Termux!
Docs: https://termux.dev/docs
Donate: https://termux.dev/donate
Community: https://termux.dev/community
Working with packages:
- Search: pkg search <query>
- Install: pkg install <package>
- Upgrade: pkg upgrade
Subscribing to additional repositories:
- Root: pkg install root-repo
- X11: pkg install x11-repo
For fixing any repository issues,
try 'termux-change-repo' command.
Report issues at https://termux.dev/issues
~ $接下来，除了已有的sshd外，我们再在该设备上启用一个服务，例如Ollama。
shell
~ $ OLLAMA_HOST=0.0.0.0 OLLAMA_ORIGINS="*" ollama serve
time=2026-11-04T10:29:47.934Z level=INFO source=routes.go:1961 msg="server config" env="map[CUDA_VISIBLE_DEVICES: GGML_VK_VISIBLE_DEVICES: GPU_DEVICE_ORDINAL: HIP_VISIBLE_DEVICES: HSA_OVERRIDE_GFX_VERSION: HTTPS_PROXY: HTTP_PROXY: LLAMA_ARG_FIT: LLAMA_ARG_FIT_TARGET: NO_PROXY: OLLAMA_CONTEXT_LENGTH:0 OLLAMA_DEBUG:INFO OLLAMA_DEBUG_LOG_REQUESTS:false OLLAMA_EDITOR: OLLAMA_FLASH_ATTENTION:false OLLAMA_GO_TEMPLATE:true OLLAMA_GPU_OVERHEAD:0 OLLAMA_HOST:http://0.0.0.0:11434 OLLAMA_IGPU_ENABLE: OLLAMA_KEEP_ALIVE:5m0s OLLAMA_KV_CACHE_TYPE: OLLAMA_LLM_LIBRARY: OLLAMA_LOAD_TIMEOUT:5m0s OLLAMA_MAX_LOADED_MODELS:0 OLLAMA_MAX_QUEUE:512 OLLAMA_MAX_TRANSFER_STREAMS:4 OLLAMA_MODELS:/data/data/com.termux/files/home/.ollama/models OLLAMA_NOHISTORY:false OLLAMA_NOPRUNE:false OLLAMA_NO_CLOUD:false OLLAMA_NUM_PARALLEL:1 OLLAMA_ORIGINS:[* http://localhost https://localhost http://localhost:* https://localhost:* http://127.0.0.1 https://127.0.0.1 http://127.0.0.1:* https://127.0.0.1:* http://0.0.0.0 https://0.0.0.0 http://0.0.0.0:* https://0.0.0.0:* app://* file://* tauri://* vscode-webview://* vscode-file://*] OLLAMA_REMOTES:[ollama.com] OLLAMA_SCHED_SPREAD:false OLLAMA_VULKAN:true ROCR_VISIBLE_DEVICES: http_proxy: https_proxy: no_proxy:]"
time=2026-11-04T10:29:47.939Z level=INFO source=routes.go:1963 msg="Ollama cloud disabled: false"
time=2026-11-04T10:29:47.986Z level=INFO source=images.go:883 msg="total blobs: 9"
time=2026-11-04T10:29:47.991Z level=INFO source=images.go:890 msg="total unused blobs removed: 0"
time=2026-11-04T10:29:48.000Z level=INFO source=routes.go:2023 msg="Listening on [::]:11434 (version 0.31.1)"
time=2026-11-04T10:29:48.047Z level=INFO source=model_list_cache.go:111 msg="model list cache hydration complete" models=2 failures=0 elapsed=46.236459ms
time=2026-11-04T10:29:48.054Z level=INFO source=runner.go:60 msg="discovering available GPUs..."
time=2026-11-04T10:29:48.341Z level=INFO source=types.go:50 msg="inference compute" id=cpu library=cpu compute="" name=cpu description=cpu libdirs=ollama driver="" pci_id="" type="" total="2.7 GiB" available="1.1 GiB"
time=2026-11-04T10:29:48.342Z level=INFO source=routes.go:2073 msg="vram-based default context" total_vram="0 B" default_num_ctx=4096
time=2026-11-04T10:29:51.024Z level=WARN source=model_show_cache.go:142 msg="model show cloud cache hydration failed" error="Get \"https://ollama.com:443/api/tags?ts=1793788188\": context deadline exceeded"
time=2026-11-04T10:29:51.024Z level=WARN source=model_recommendations.go:168 msg="model recommendations refresh failed" error="Get \"https://ollama.com/api/experimental/model-recommendations\": context deadline exceeded"
time=2026-11-04T10:29:51.025Z level=INFO source=model_recommendations.go:177 msg="model recommendations cache sleep scheduled" wait=5m27.292439427s consecutive_failures=1此时，我们还能ping通该设备。
powershell
PS C:\Users\...> Test-Connection 192.168.0.238
Source Destination IPV4Address IPV6Address Bytes Time(ms)
------ ----------- ----------- ----------- ----- --------
计算机名... 192.168.0.238 32 157
计算机名... 192.168.0.238 32 11
计算机名... 192.168.0.238 32 16
计算机名... 192.168.0.238 32 166
PS C:\Users\...>Ollama也可访问。
powershell
PS C:\Users\...> (Invoke-WebRequest -Uri "http://192.168.0.238:11434/" -UseBasicParsing).RawContent
HTTP/1.1 200 OK
Content-Length: 17
Content-Type: text/plain; charset=utf-8
Date: Wed, 04 Nov 2026 10:34:05 GMT
Ollama is running
PS C:\Users\...>现在，让我们什么都不做。保持与Mate 8的SSH会话不中断，但将手机锁屏放置一会儿，约5分钟不到。
现在，再尝试ping。
powershell
PS C:\Users\...> Test-Connection 192.168.0.238
Test-Connection : Testing connection to computer '192.168.0.238' failed: Error due to lack of resources
At line:1 char:1
+ Test-Connection 192.168.0.238
+ ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
+ CategoryInfo : ResourceUnavailable: (192.168.0.238:String) [Test-Connection], PingException
+ FullyQualifiedErrorId : TestConnectionException,Microsoft.PowerShell.Commands.TestConnectionCommand
Test-Connection : Testing connection to computer '192.168.0.238' failed: Error due to lack of resources
At line:1 char:1
+ Test-Connection 192.168.0.238
+ ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
+ CategoryInfo : ResourceUnavailable: (192.168.0.238:String) [Test-Connection], PingException
+ FullyQualifiedErrorId : TestConnectionException,Microsoft.PowerShell.Commands.TestConnectionCommand
Test-Connection : Testing connection to computer '192.168.0.238' failed: Error due to lack of resources
At line:1 char:1
+ Test-Connection 192.168.0.238
+ ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
+ CategoryInfo : ResourceUnavailable: (192.168.0.238:String) [Test-Connection], PingException
+ FullyQualifiedErrorId : TestConnectionException,Microsoft.PowerShell.Commands.TestConnectionCommand
Test-Connection : Testing connection to computer '192.168.0.238' failed: Error due to lack of resources
At line:1 char:1
+ Test-Connection 192.168.0.238
+ ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
+ CategoryInfo : ResourceUnavailable: (192.168.0.238:String) [Test-Connection], PingException
+ FullyQualifiedErrorId : TestConnectionException,Microsoft.PowerShell.Commands.TestConnectionCommand
PS C:\Users\...>根本连不通。
访问Ollama呢？
powershell
PS C:\Users\...> (Invoke-WebRequest -Uri "http://192.168.0.238:11434/" -UseBasicParsing).RawContent
Invoke-WebRequest : Unable to connect to the remote server
At line:1 char:2
+ (Invoke-WebRequest -Uri "http://192.168.0.238:11434/" -UseBasicParsin ...
+ ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
+ CategoryInfo : InvalidOperation: (System.Net.HttpWebRequest:HttpWebRequest) [Invoke-WebRequest], WebExc
eption
+ FullyQualifiedErrorId : WebCmdletWebResponseException,Microsoft.PowerShell.Commands.InvokeWebRequestCommand
PS C:\Users\...>直接超时。
尝试建立一条新SSH会话：
powershell
PS C:\Users\...> ssh @u0_a167@192.168.0.238 -p8022
ssh: connect to host 192.168.0.238 port 8022: Connection refused
PS C:\Users\...>由于某种诡异的原因，等待了很久，连接被拒绝了。虽然消息说"被拒绝"，但给人的感觉却更像超时。
进一步的行为实验
出站规则
太棒了，这可真是。难道手机陷入深度休眠了？那些获取了唤醒锁的进程是否还在运行？我们的SSH会话是否断开了？
会话还在。键入任何命令都在屏幕上有反馈，说明已有的连接未中断。
但诡异的是，任何出站请求（ping）都被拒绝。
shell
~ $ ping www.google.com
PING www.google.com (142.251.152.119) 56(84) bytes of data.
^C
--- www.google.com ping statistics ---
21 packets transmitted, 0 received, 100% packet loss, time 20020ms
~ $ ping 192.168.0.1
PING 192.168.0.1 (192.168.0.1) 56(84) bytes of data.
^C
--- 192.168.0.1 ping statistics ---
26 packets transmitted, 0 received, 100% packet loss, time 25041ms
~ $ ping 8.8.8.8
PING 8.8.8.8 (8.8.8.8) 56(84) bytes of data.
^C
--- 8.8.8.8 ping statistics ---
321 packets transmitted, 0 received, 100% packet loss, time 320539ms不，也许不是"所有"。HTTP出站请求可以。
shell
~ $ pkg install dnsutils
No mirror or mirror group selected. You might want to select one by running 'termux-change-repo'
Testing the available mirrors:
[*] (10) https://packages-cf.termux.dev/apt/termux-main: ok
[*] (1) https://linux.domainesia.com/applications/termux/termux-main: ok
[*] (1) https://termux.niranjan.co/termux-main: ok
[*] (1) https://mirror.bardia.tech/termux/termux-main: bad
[*] (1) https://mirrors.saswata.cc/termux/termux-main: bad
[*] (1) https://mirrors.ravidwivedi.in/termux/termux-main: ok
[*] (1) https://mirror.textcord.xyz/termux/termux-main: ok
[*] (1) https://mirrors.krnk.org/apt/termux/termux-main: ok
[*] (1) https://mirror.rinarin.dev/termux/termux-main: ok
[*] (1) https://mirror.jeonnam.school/termux/termux-main: ok
[*] (1) https://mirrors.nguyenhoang.cloud/termux/termux-main: ok
[*] (1) https://mirrors.cbrx.io/apt/termux/termux-main: ok
[*] (1) https://tmx.xvx.my.id/apt/termux-main: ok
[*] (1) https://mirror.albony.in/termux/termux-main: ok
[*] (1) https://mirror.twds.com.tw/termux/termux-main: ok
[*] (1) https://mirror.nevacloud.com/applications/termux/termux-main: ok
[*] (1) https://mirror.meowsmp.net/termux/termux-main: bad
[*] (1) https://mirror.freedif.org/termux/termux-main: ok
[*] (1) https://mirrors.in.sahilister.net/termux/termux-main/: ok
[*] (1) https://mirror.iscas.ac.cn/termux/apt/termux-main: ok
[*] (1) https://mirrors.sau.edu.cn/termux/apt/termux-main: ok
[*] (1) https://mirrors.sdu.edu.cn/termux/termux-main: ok
[*] (1) https://mirrors.aliyun.com/termux/termux-main: ok
[*] (1) https://mirrors.cernet.edu.cn/termux/apt/termux-main: ok
[*] (1) https://mirrors.cqupt.edu.cn/termux/termux-main: ok
[*] (1) https://mirrors.sustech.edu.cn/termux/apt/termux-main: ok
[*] (1) https://mirrors.bfsu.edu.cn/termux/apt/termux-main: ok
[*] (1) https://mirrors.pku.edu.cn/termux/termux-main/: ok
[*] (1) https://mirrors.hust.edu.cn/termux/apt/termux-main: ok
[*] (1) https://mirrors.tuna.tsinghua.edu.cn/termux/apt/termux-main: ok
[*] (1) https://mirror.sjtu.edu.cn/termux/termux-main/: ok
[*] (1) https://mirror.nyist.edu.cn/termux/apt/termux-main: ok
[*] (1) https://mirrors.ustc.edu.cn/termux/termux-main: ok
[*] (1) https://mirrors.zju.edu.cn/termux/apt/termux-main: ok
[*] (1) https://mirrors.nju.edu.cn/termux/apt/termux-main: ok
[*] (4) https://grimler.se/termux/termux-main: ok
[*] (1) https://mirror.polido.pt/termux/termux-main: bad
[*] (1) https://termux.3san.dev/termux/termux-main: ok
[*] (1) https://mirrors.medzik.dev/termux/termux-main: bad
[*] (1) https://mirror.accum.se/mirror/termux.dev/termux-main: ok
[*] (1) https://mirror.mwt.me/termux/main: ok
[*] (1) https://ro.mirror.flokinet.net/termux/termux-main: ok
[*] (1) https://md.mirrors.hacktegic.com/termux/termux-main: bad
[*] (1) https://is.mirror.flokinet.net/termux/termux-main: ok
[*] (1) https://mirror.termux.dev/termux-main: bad
[*] (1) https://termux.mentality.rip/termux-main: bad
[*] (1) https://nl.mirror.flokinet.net/termux/termux-main: ok
[*] (1) https://termux.cdn.lumito.net/termux-main: bad
[*] (1) https://mirror.leitecastro.com/termux/termux-main: ok
[*] (1) https://mirror.bouwhuis.network/termux/termux-main: bad
[*] (1) https://termux.librehat.com/apt/termux-main: ok
[*] (1) https://mirror.autkin.net/termux/termux-main: ok
[*] (1) https://mirror.sunred.org/termux/termux-main: ok
[*] (1) https://packages.termux.dev/apt/termux-main: ok
[*] (1) https://ftp.agdsn.de/termux/termux-main: ok
[*] (1) https://ftp.fau.de/termux/termux-main: ok
[*] (1) https://mirrors.cfe.re/termux/termux-main: bad
[*] (1) https://mirrors.de.sahilister.net/termux/termux-main: ok
[*] (1) https://gnlug.org/pub/termux/termux-main: ok
[*] (1) https://mirror.mwt.me/termux/main: ok
[*] (1) https://mirror.quantum5.ca/termux/termux-main: ok
[*] (1) https://mirrors.utermux.dev/termux/termux-main: bad
[*] (1) https://plug-mirror.rcac.purdue.edu/termux/termux-main: ok
[*] (1) https://mirror.vern.cc/termux/termux-main: bad
[*] (1) https://dl.kcubeterm.com/termux-main: bad
[*] (1) https://termux.danyael.xyz/termux/termux-main: ok
[*] (1) https://mirror.csclub.uwaterloo.ca/termux/termux-main: ok
[*] (1) https://mirror.fcix.net/termux/termux-main: ok
[*] (1) https://mirrors.middlendian.com/termux/termux-main: ok
[*] (1) https://repository.su/termux/termux-main/: ok
[*] (1) http://mirror.mephi.ru/termux/termux-main: ok
Picking mirror: (28) /data/data/com.termux/files/usr/etc/termux/mirrors/chinese_mainland/mirrors.aliyun.com
Get:1 https://mirrors.aliyun.com/termux/termux-main stable InRelease [14.0 kB]
Get:2 https://mirrors.aliyun.com/termux/termux-main stable/main aarch64 Packages [590 kB]
Fetched 604 kB in 5s (128 kB/s)
Reading package lists... Done
Building dependency tree... Done
Reading state information... Done
101 packages can be upgraded. Run 'apt list --upgradable' to see them.
Reading package lists... Done
Building dependency tree... Done
Reading state information... Done
The following packages were automatically installed and are no longer required:
file ncurses-utils
Use 'apt autoremove' to remove them.
The following additional packages will be installed:
cmocka libcap liburcu libuv
The following NEW packages will be installed:
cmocka dnsutils libcap liburcu libuv
0 upgraded, 5 newly installed, 0 to remove and 101 not upgraded.
Need to get 2048 kB of archives.
After this operation, 9814 kB of additional disk space will be used.
Do you want to continue? [Y/n] y
Abort.
~ $ pkg install dnsutils
No mirror or mirror group selected. You might want to select one by running 'termux-change-repo'
Checking availability of current mirror:
[*] https://mirrors.aliyun.com/termux/termux-main: ok
Reading package lists... Done
Building dependency tree... Done
Reading state information... Done
The following packages were automatically installed and are no longer required:
file ncurses-utils
Use 'apt autoremove' to remove them.
The following additional packages will be installed:
cmocka libcap liburcu libuv
The following NEW packages will be installed:
cmocka dnsutils libcap liburcu libuv
0 upgraded, 5 newly installed, 0 to remove and 101 not upgraded.
Need to get 2048 kB of archives.
After this operation, 9814 kB of additional disk space will be used.
Do you want to continue? [Y/n] y
Get:1 https://mirrors.aliyun.com/termux/termux-main stable/main aarch64 cmocka aarch64 2.0.2 [48.5 kB]
Get:2 https://mirrors.aliyun.com/termux/termux-main stable/main aarch64 libcap aarch64 2.78 [79.2 kB]
Get:3 https://mirrors.aliyun.com/termux/termux-main stable/main aarch64 liburcu aarch64 0.15.7 [122 kB]
Get:4 https://mirrors.aliyun.com/termux/termux-main stable/main aarch64 libuv aarch64 1.53.0 [83.9 kB]
Get:5 https://mirrors.aliyun.com/termux/termux-main stable/main aarch64 dnsutils aarch64 9.20.30 [1714 kB]
Fetched 2048 kB in 7s (312 kB/s)
Selecting previously unselected package cmocka.
(Reading database ... 23835 files and directories currently installed.)
Preparing to unpack .../cmocka_2.0.2_aarch64.deb ...
Unpacking cmocka (2.0.2) ...
Selecting previously unselected package libcap.
Preparing to unpack .../libcap_2.78_aarch64.deb ...
Unpacking libcap (2.78) ...
Selecting previously unselected package liburcu.
Preparing to unpack .../liburcu_0.15.7_aarch64.deb ...
Unpacking liburcu (0.15.7) ...
Selecting previously unselected package libuv.
Preparing to unpack .../libuv_1.53.0_aarch64.deb ...
Unpacking libuv (1.53.0) ...
Selecting previously unselected package dnsutils.
Preparing to unpack .../dnsutils_9.20.30_aarch64.deb ...
Unpacking dnsutils (9.20.30) ...
Setting up libuv (1.53.0) ...
Setting up libcap (2.78) ...
Setting up cmocka (2.0.2) ...
Setting up liburcu (0.15.7) ...
Setting up dnsutils (9.20.30) ...
~ $ curl -vv "https://www.google.com/"
21:14:25.016217 [0-0] * [HTTPS-CONNECT] added
21:14:25.016922 [0-0] * [HTTPS-CONNECT] adjust_pollset -> 0, 0 socks
21:14:25.331568 [0-0] * [HTTPS-CONNECT] connect, init
21:14:25.331821 [0-0] * [HTTPS-CONNECT] 1st attempt uses h2 from wanted versions
21:14:25.331997 [0-0] * [SETUP] happy eyeballing to origin www.google.com:443
21:14:25.332629 [0-0] * Trying 142.251.153.119:443...
21:14:25.335157 [0-0] * [HTTPS-CONNECT] connect -> 0, done=0
21:14:25.335323 [0-0] * [HTTPS-CONNECT] adjust_pollset -> 0, 1 socks
21:14:25.361388 [0-0] * [SETUP] added SSL filter for origin
21:14:25.376399 [0-0] * ALPN: curl offers h2,http/1.1
21:14:25.382333 [0-0] * TLSv1.3 (OUT), TLS handshake, Client hello (1):
21:14:25.383475 [0-0] * SSL Trust Anchors:
21:14:25.454715 [0-0] * CAfile: /data/data/com.termux/files/usr/etc/tls/cert.pem
21:14:25.454890 [0-0] * CApath: /data/data/com.termux/files/usr/etc/tls/certs
21:14:25.454974 [0-0] * [HTTPS-CONNECT] connect -> 0, done=0
21:14:25.455150 [0-0] * [HTTPS-CONNECT] adjust_pollset -> 0, 1 socks
21:14:25.455427 [0-0] * Host www.google.com:443 was resolved.
21:14:25.455839 [0-0] * IPv6: 2001:4860:4829:7700::, 2001:4860:482d:7700::, 2001:4860:4828:7700::, 2001:4860:482c:7700::, 2001:4860:482a:7700::, 2001:4860:4827:7700::, 2001:4860:482b:7700::, 2001:4860:4826:7700::
21:14:25.455995 [0-0] * IPv4: 142.251.153.119, 142.251.152.119, 142.251.154.119, 142.251.150.119, 142.251.155.119, 142.251.157.119, 142.251.151.119, 142.251.156.119
21:14:25.456287 [0-0] * [HTTPS-CONNECT] connect -> 0, done=0
21:14:25.456535 [0-0] * [HTTPS-CONNECT] adjust_pollset -> 0, 1 socks
21:14:25.512907 [0-0] * TLSv1.3 (IN), TLS handshake, Server hello (2):
21:14:25.526091 [0-0] * TLSv1.3 (IN), TLS change cipher, Change cipher spec (1):
21:14:25.526640 [0-0] * TLSv1.3 (IN), TLS handshake, Encrypted Extensions (8):
21:14:25.526981 [0-0] * TLSv1.3 (IN), TLS handshake, Certificate (11):
21:14:25.554891 [0-0] * TLSv1.3 (IN), TLS handshake, CERT verify (15):
21:14:25.556361 [0-0] * TLSv1.3 (IN), TLS handshake, Finished (20):
21:14:25.557093 [0-0] * TLSv1.3 (OUT), TLS change cipher, Change cipher spec (1):
21:14:25.557635 [0-0] * TLSv1.3 (OUT), TLS handshake, Finished (20):
21:14:25.558234 [0-0] * SSL connection using TLSv1.3 / TLS_AES_256_GCM_SHA384 / X25519MLKEM768 / id-ecPublicKey
21:14:25.558384 [0-0] * ALPN: server accepted h2
21:14:25.558471 [0-0] * Server certificate:
21:14:25.558790 [0-0] * subject: CN=www.google.com
21:14:25.559057 [0-0] * start date: Oct 7 19:09:54 2026 GMT
21:14:25.559288 [0-0] * expire date: Dec 30 19:09:53 2026 GMT
21:14:25.559535 [0-0] * issuer: C=US; O=Google Trust Services; CN=WE2
21:14:25.559812 [0-0] * Certificate level 0: Public key type EC/prime256v1 (256/128 Bits/secBits), signed using ecdsa-with-SHA256
21:14:25.560043 [0-0] * Certificate level 1: Public key type EC/prime256v1 (256/128 Bits/secBits), signed using ecdsa-with-SHA384
21:14:25.560269 [0-0] * Certificate level 2: Public key type EC/secp384r1 (384/192 Bits/secBits), signed using ecdsa-with-SHA384
21:14:25.560550 [0-0] * subjectAltName: "www.google.com" matches cert's "www.google.com"
21:14:25.560641 [0-0] * OpenSSL verify result: 0
21:14:25.560706 [0-0] * SSL certificate verified via OpenSSL.
21:14:25.560914 [0-0] * [SETUP] query ALPN
21:14:25.561263 [0-0] * [HTTP/2] [0] created h2 session
21:14:25.561485 [0-0] * [HTTP/2] [0] -> FRAME[SETTINGS, len=18]
21:14:25.561675 [0-0] * [HTTP/2] [0] -> FRAME[WINDOW_UPDATE, incr=1048510465]
21:14:25.561865 [0-0] * [HTTP/2] cf_connect() -> 0, 1,
21:14:25.562043 [0-0] * [HTTPS-CONNECT] connect -> 0, done=1
21:14:25.562310 [0-0] * Established connection to www.google.com (142.251.153.119 port 443) from 192.168.0.238 port 33924
21:14:25.562487 [0-0] * [HTTPS-CONNECT] removing connected setup filter
21:14:25.562656 [0-0] * [HTTPS-CONNECT] destroy
21:14:25.562837 [0-0] * [SETUP] removing connected setup filter
21:14:25.563009 [0-0] * [SETUP] destroy
21:14:25.563215 [0-0] * [HTTP/2] query ALPN
21:14:25.563393 [0-0] * using HTTP/2
21:14:25.563683 [0-0] * [HTTP/2] [1] OPENED stream for https://www.google.com/
21:14:25.563875 [0-0] * [HTTP/2] [1] [:method: GET]
21:14:25.564066 [0-0] * [HTTP/2] [1] [:scheme: https]
21:14:25.564295 [0-0] * [HTTP/2] [1] [:authority: www.google.com]
21:14:25.564524 [0-0] * [HTTP/2] [1] [:path: /]
21:14:25.564754 [0-0] * [HTTP/2] [1] [user-agent: curl/8.21.0]
21:14:25.564984 [0-0] * [HTTP/2] [1] [accept: */*]
21:14:25.565400 [0-0] * [HTTP/2] [1] submit -> 0, 76
21:14:25.565873 [0-0] * [HTTP/2] [1] -> FRAME[HEADERS, len=31, hend=1, eos=1]
21:14:25.566509 [0-0] * [HTTP/2] [1] cf_send(len=76) -> 0, 76, eos=1, h2 windows 65535-65535 (stream-conn), buffers 0-0 (stream-conn)
21:14:25.566735 [0-0] > GET / HTTP/2
21:14:25.566735 [0-0] > Host: www.google.com
21:14:25.566735 [0-0] > User-Agent: curl/8.21.0
21:14:25.566735 [0-0] > Accept: */*
...传输层出站请求，例如TCP和UDP也可以。
shell
~ $ nc -vz -w3 192.168.0.251 8000 # 另一台笔记本电脑的Python HTTP 服务器监听端口
Ncat: Version 7.993 ( https://nmap.org/ncat )
Ncat: Connected to 192.168.0.251:8000.
Ncat: 0 bytes sent, 0 bytes received in 0.11 seconds.
~ $
~ $ dig @8.8.8.8 google.com
; <<>> DiG 9.20.30 <<>> @8.8.8.8 google.com
; (1 server found)
;; global options: +cmd
;; Got answer:
;; ->>HEADER<<- opcode: QUERY, status: NOERROR, id: 13426
;; flags: qr rd ra; QUERY: 1, ANSWER: 1, AUTHORITY: 0, ADDITIONAL: 1
;; OPT PSEUDOSECTION:
; EDNS: version: 0, flags:; udp: 512
;; QUESTION SECTION:
;google.com. IN A
;; ANSWER SECTION:
google.com. 199 IN A 142.250.183.46
;; Query time: 20 msec
;; SERVER: 8.8.8.8#53(8.8.8.8) (UDP)
;; WHEN: Wed Nov 04 23:09:37 AEST 2026
;; MSG SIZE rcvd: 55
~ $入站规则
Termux的SSH默认端口8022仍接受入站请求。这有些反常（Ollama端口早已无响应）。
kotlin
PS C:\Users\...> ssh @u0_a167@192.168.0.238 -p8022
@u0_a167@192.168.0.238's password:
PS C:\Users\...> Test-NetConnection 192.168.0.238 -Port 8022
ComputerName : 192.168.0.238
RemoteAddress : 192.168.0.238
RemotePort : 8022
InterfaceAlias : Ethernet0
SourceAddress : 192.168.231.128
TcpTestSucceeded : True
PS C:\Users\...> Test-Connection 192.168.0.238
Test-Connection : Testing connection to computer '192.168.0.238' failed: Error due to lack of resources
At line:1 char:1
+ Test-Connection 192.168.0.238
+ ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
+ CategoryInfo : ResourceUnavailable: (192.168.0.238:String) [Test-Connection], PingException
+ FullyQualifiedErrorId : TestConnectionException,Microsoft.PowerShell.Commands.TestConnectionCommand
Test-Connection : Testing connection to computer '192.168.0.238' failed: Error due to lack of resources
At line:1 char:1
...但我们高度怀疑是我们当前活跃的这条SSH会话迫使8022处于开放状态（和防火墙打洞同理）。主动断开SSH会话，等待一段时间再次连接。
shell
exit果然。没有已有活跃连接维持，立刻就无法连接了。
kotlin
PS C:\Users\...> ssh @u0_a167@192.168.0.238 -p8022
ssh: connect to host 192.168.0.238 port 8022: Connection timed out
PS C:\Users\...> Test-NetConnection 192.168.0.238 -Port 8022
WARNING: TCP connect to (192.168.0.238 : 8022) failed
WARNING: Ping to 192.168.0.238 failed with status: TimedOut
ComputerName : 192.168.0.238
RemoteAddress : 192.168.0.238
RemotePort : 8022
InterfaceAlias : Ethernet0
SourceAddress : 192.168.231.128
PingSucceeded : False
PingReplyDetails (RTT) : 0 ms
TcpTestSucceeded : False
PS C:\Users\...>一个值得注意的怪异现象。复制最后
Connection timed outSSH错误输出后，我尝试解锁手机却发现Termux进程已被杀死。经过重新试验进程未被杀死但锁屏"防火墙"已生效的情况下后，发现得到的ssh错误信息应通常是如下，就如同在前文中我们看到的那样。
shellPS C:\WINDOWS\system32> ssh u0_a167@192.168.0.238 -> p8022 ssh: connect to host 192.168.0.238 port 8022: Connection refused PS C:\WINDOWS\system32>这令人有些费解，虽然我不清楚原因。虽然
ssh声称被"拒绝"，但行为却更像超时。
以上所有怪异现象在手机被唤醒解锁后数秒后全部消失。
行为特征
我们已经可以很清晰地感受到该设备锁屏时的总体行为趋势，即类似传统"智能防火墙"的逻辑，尽管以上的测试不一定涵盖所有方面：
- 拒绝一切入站，除非是主动出站数据的响应。
- 允许一切出站（应用和传输层），除了特殊底层数据包（例如ICMP）。
解决方案
无用的方案
一些人提议通过ADB命令行将Termux加入到安卓低耗电（Doze）模式白名单中。
shell
adb shell dumpsys deviceidle # 检查 mState / mLightState
adb shell dumpsys deviceidle whitelist +com.termux # 将Termux添加到低耗电白名单中或干脆完全关闭低耗电模式。
shell
adb shell dumpsys deviceidle disable # 完全关闭低耗电模式经过尝试，似乎都对Mate 8的行为没有任何改变。
又或者，使用一个诸如下面的命令关闭华为PowerGenie省电管理服务。
shell
adb shell pm disable-user --user 0 com.huawei.powergenie # 用户ID `0` 指设备主用户但尝试过后，行为也无任何改变。
如果想要重新开启PowerGenie，使用命令
shelladb shell pm enable com.huawei.powergenie下面的命令也许能帮你找到其它可能存在的电池管理进程，但我没有尝试过，且希望渺茫。
shelladb shell pm list packages | findstr -i "power aware"
很遗憾，我们目前没有找到从根本上解决该问题的方案，因此下列可行的方法仅仅是绕过而已。
有用的绕过方案一：端口转发想要访问的端口到另一设备
我们可以将必须能够访问的端口（例如说8022和11434）使用反向代理转发到另一台设备，例如另一台手机。由于这些连接由Mate 8主动发出并建立，因此就不会被"智能防火墙"的限制。
我将把华为Mate 8的该两端口转发到我另一台小米6X设备的端口上，使用FRP，一个反向代理程序。
在6X上设置frps服务端，以接收任何认证通过的来访客户端，并帮助它们转发端口到自己的端口上。更改配置文件frps.toml：
toml
bindPort = 7000
auth.method = "token"
auth.token = "SomeRandomAuthToken"然后启动服务端。
shell
~ $ ./frps -c frps.toml
2026-11-04 16:15:07.450 [I] [frps/root.go:108] frps uses config file: frps.toml
2026-11-04 16:15:08.136 [I] [server/service.go:236] frps tcp listen on 0.0.0.0:7000
2026-11-04 16:15:08.137 [I] [frps/root.go:117] frps started successfully接着在Mate 8上配置frpc客户端，连接到6X，并指定要转发的端口和转发目标端口。将frpc.toml更改为，例如如下的样子，以将8022和11434端口分别映射到8023和11435端口`。
toml
serverAddr = "6X的内网IP"
serverPort = 7000
auth.token = "SomeRandomAuthToken"
[[proxies]]
name = "Ollama"
type = "tcp"
localIP = "127.0.0.1"
localPort = 11434
remotePort = 11435
[[proxies]]
name = "Ssh"
type = "tcp"
localIP = "127.0.0.1"
localPort = 8022
remotePort = 8023接着启动frpc。
shell
~/frp $ ./frpc -c frpc.toml
2026-11-05 02:41:14.802 [I] [sub/root.go:201] start frpc service for config file [frpc.toml] with aggregated configuration
2026-11-05 02:41:14.802 [I] [client/service.go:378] try to connect to server...
2026-11-05 02:41:14.988 [I] [client/service.go:370] [d5e310c219da0462] login to server success, get run id [d5e310c219da0462]
2026-11-05 02:41:14.989 [I] [proxy/proxy_manager.go:180] [d5e310c219da0462] proxy added: [Ollama Ssh]
2026-11-05 02:41:15.013 [I] [client/control.go:176] [d5e310c219da0462] [Ollama] start proxy success
2026-11-05 02:41:15.014 [I] [client/control.go:176] [d5e310c219da0462] [Ssh] start proxy success此时，尽管Mate 8已彻底无法从外界连通，但我们仍可随时通过6X ssh连接，只需使用端口8023和Mate 8的凭据即可。
shell
Pinging 192.168.0.238 with 32 bytes of data:
Request timed out.
Request timed out.
Request timed out.
Request timed out.
Ping statistics for 192.168.0.238:
Packets: Sent = 4, Received = 0, Lost = 4 (100% loss),
shell
Windows PowerShell
Copyright (C) Microsoft Corporation. All rights reserved.
PS C:\Users\xyzzklkadmin> ssh u0_a167@192.168.0.248 -p8023
The authenticity of host '[192.168.0.248]:8023 ([192.168.0.248]:8023)' can't be established.
ED25519 key fingerprint is SHA256:d7vbdofcyUxZrDbLmvEbij9JIIxE2SYMhA2WtOzlYy4.
This host key is known by the following other names/addresses:
C:\Users\xyzzklkadmin/.ssh/known_hosts:7: [192.168.0.238]:8022
Are you sure you want to continue connecting (yes/no/[fingerprint])? yes
Warning: Permanently added '[192.168.0.248]:8023' (ED25519) to the list of known hosts.
u0_a167@192.168.0.248's password:
Welcome to Termux!
Docs: https://termux.dev/docs
Donate: https://termux.dev/donate
Community: https://termux.dev/community
Working with packages:
- Search: pkg search <query>
- Install: pkg install <package>
- Upgrade: pkg upgrade
Subscribing to additional repositories:
- Root: pkg install root-repo
- X11: pkg install x11-repo
For fixing any repository issues,
try 'termux-change-repo' command.
Report issues at https://termux.dev/issues
~ $ ls frp/frpc.toml
frp/frpc.toml
~ $ cat frp/frpc.toml # 该配置文件只有在Mate 8上被配置了。以此验证设备身份
serverAddr = "192.168.0.248"
serverPort = 7000
auth.token = "SomeRandomAuthToken"
[[proxies]]
name = "Ollama"
type = "tcp"
localIP = "127.0.0.1"
localPort = 11434
remotePort = 11435
[[proxies]]
name = "Ssh"
type = "tcp"
localIP = "127.0.0.1"
localPort = 8022
remotePort = 8023
~ $同时，Ollama尽管无法被直接访问，但却可以通过6X访问。
powershell
PS C:\Users\...> (Invoke-WebRequest -Uri "http://192.168.0.238:11434/" -UseBasicParsing).RawContent
Invoke-WebRequest : Unable to connect to the remote server
At line:1 char:2
+ (Invoke-WebRequest -Uri "http://192.168.0.238:11434/" -UseBasicParsin ...
+ ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
+ CategoryInfo : InvalidOperation: (System.Net.HttpWebRequest:HttpWebRequest) [Invoke-WebRequest], WebExc
eption
+ FullyQualifiedErrorId : WebCmdletWebResponseException,Microsoft.PowerShell.Commands.InvokeWebRequestCommand
PS C:\Users\...> (Invoke-WebRequest -Uri "http://192.168.0.248:11435/" -UseBasicParsing).RawContent # 通过6X访问
HTTP/1.1 200 OK
Content-Length: 17
Content-Type: text/plain; charset=utf-8
Date: Wed, 04 Nov 2026 16:55:23 GMT
Ollama is running
PS C:\Users\...>这下再也不用担心华为怪异的智能防火墙行为了。
有用的绕过方案二：使用虚拟专用网络
另外一种更加简单粗暴的方式是使用一个诸如Tailscale的虚拟专用网络。在这种情况下，任何想访问Mate 8的设备只需加入同一个Tailnet即可通过Tailscale访问它。由于到Tailscale云端的连接主动由Mate 8上运行的安卓Tailscale客户端建立，所以不存在防火墙入站问题。任何入站请求都自动通过已建立的Wireguard连接直达Mate 8。
将Mate 8加入一Tailnet后，用同一Tailnet中的另一台设备分别使用Mate 8原IP和Tailscale分配的MagicDNS进行测试。
shell
PS C:\WINDOWS\system32> ssh u0_a167@192.168.0.238 -p8022
ssh: connect to host 192.168.0.238 port 8022: Connection refused
PS C:\WINDOWS\system32> ssh u0_a167@huawei-nxt-tl00.tail7acace.ts.net -p8022
The authenticity of host '[huawei-nxt-tl00.tail7acace.ts.net]:8022 ([100.91.155.114]:8022)' can't be established.
ED25519 key fingerprint is SHA256:d7vbdofcyUxZrDbLmvEbij9JIIxE2SYMhA2WtOzlYy4.
This host key is known by the following other names/addresses:
C:\Users\xyzzklkadmin/.ssh/known_hosts:7: [192.168.0.238]:8022
C:\Users\xyzzklkadmin/.ssh/known_hosts:10: [192.168.0.248]:8023
Are you sure you want to continue connecting (yes/no/[fingerprint])? yes
Warning: Permanently added '[huawei-nxt-tl00.tail7acace.ts.net]:8022' (ED25519) to the list of known hosts.
u0_a167@huawei-nxt-tl00.tail7acace.ts.net's password:
Welcome to Termux!
Docs: https://termux.dev/docs
Donate: https://termux.dev/donate
Community: https://termux.dev/community
Working with packages:
- Search: pkg search <query>
- Install: pkg install <package>
- Upgrade: pkg upgrade
Subscribing to additional repositories:
- Root: pkg install root-repo
- X11: pkg install x11-repo
For fixing any repository issues,
try 'termux-change-repo' command.
Report issues at https://termux.dev/issues
~ $Tailscale成功绕过了智能防火墙。
结语
一些愚蠢的手机厂商在给设备增加他们认为合理的限制和约束时大幅削弱了设备的可用性和"可玩性"。这也许对一个每天只用来发消息上网的普通用户来说十分合适，但对极客简直就是噩梦。对于这类问题，除了想方设法绕过外，最好的方法就是更换设备。