Method and system for using NFQUEUE mechanism to realize gateway

Abstract

The invention discloses a method and system for using an NFQUEUE mechanism to realize a gateway. The method comprises the steps of: 1, grabbing a data packet from a network card by means of the NFQUEUE mechanism; 2, receiving the data packet from the NFQUEUE mechanism through a user state process, and reading the data packet; 3, matching data packet information with a connection table by the user state process, if the data packet information is matched with one connection record in the connection table, then modifying and forwarding the data packet, and jumping to a step 5, otherwise carrying out a step 4; 4, according to strategies configured by a user, carrying out comparison one by one between strategy information and the data packet information by the user state process, and when the data packet is matched with the strategy information, carrying out an operation instruction matched with the strategy information on the data packet, simultaneously establishing a connection record, and storing the record into the connection table; and 5, monitoring the state of connection records in the connection table, and when connection is overtime, executing an operation instruction for releasing the connection, and executing an operation instruction for jumping to the step 1.

Description

technical field [0001] The invention relates to computer network technology, in particular to a method for realizing a gateway by using the NFQUEUE mechanism. Background technique [0002] Since the private address in address translation in the prior art cannot be on the public network, in order to solve the problem of insufficient IP addresses, address translation technology has emerged; before the private address accesses the public network, source address translation (SNAT) needs to be performed on the gateway device ; Destination address translation (DNAT) is often used to convert the destination address of public network access to the address of the intranet server; source-destination address translation (FULLNAT) refers to the translation of both the source address and the destination address. [0003] In addition, Netfilter is a firewall framework of the Linux kernel. Users can add policy matching data packets to the firewall framework through the iptables command, an...

AI Technical Summary

Problems solved by technology

[0006] 1) The options for matching data packets are not rich enough (such as matching data packets according to content, matching according to a set of IP addresses);

[0007] 2) Implementing new matching options requires writing a kernel module, which affects product portability;

[0008] 3) It does not provide rich statistical data display (such as: a user's current connection, bandwidth, and new additions per second). If you want to realize rich statistical data functions, you need to modify the Linux kernel, which will affect the portability and stability of the product

Images