A method and firewall for preventing attacks

Abstract

The invention discloses a method for preventing attacks, which is applied to a firewall in an enable EIM mode in a network address translation NAT network, and comprises the steps of: receiving a message; looking up an EIM table item with an external network address and an external network port number which are matched with a destination address and a destination port number of the message in an Endpoint-Independent Mapping (EIM) table; determining whether a conversation to which the message belongs is established by internal network equipment corresponding to an internal network address and an internal network port number in the EIM table item; if the conversation to which the message belongs is not established by the internal network equipment, then determining number of conversations established by the internal network equipment; and discarding the message when the number of conversations is greater than a first conversation number threshold value preset in the EIM table item. The method and the firewall are used for preventing malicious attacks by controlling the number of conversations corresponding to the internal network equipment.

Description

technical field [0001] The present application relates to the field of network technology, in particular to a method for preventing attacks and a firewall. Background technique [0002] After the NAT (Network Address Translation) hairpin function is enabled on the internal network side interface of the firewall, if the P2P method is used for packet forwarding, each internal network device on the internal network first registers its own internal network with the external network server. Address information to obtain its corresponding external network address information, and then intranet devices exchange visits by using the external network address information obtained by registering with each other with the external network server. In this mode, the outbound address translation on the external network side must be configured as PAT (Port Address Translation, port address translation) translation mode, and the EIM (Endpoint-Independent Mapping, endpoint independent mapping) ...

AI Technical Summary

Problems solved by technology

That is to say, devices on the internal network or external network can use the external network address information to freely access the internal network device corresponding to the internal network address information after the external network address information is transferred through the EIM table on the firewall, so that the attacker can easily pass the EIM The table carries out DDOS (Distributed Denial of service) attacks on intranet devices, so that the security of intranet devices cannot be effectively guaranteed, and at the same time, it may threaten the security of the entire intranet

Images