Method and system for MQTT to bear VPN

Abstract

The invention provides a method for MQTT to bear a VPN, and the method comprises the following steps: S110, building an MQTT service on a server, and enabling the MQTT service to serve as a core component for message transmission; step S120, the VPN client issues related data to the MQTT service through the gw2mq; step S130, the gw2mq subscribes to related data from the MQTT and sends the related data to the VPN server; step S140, the data of the VPN server side is returned to the MQTT through the gw2mq, and the VPN client side subscribes to the data through the gw2mq, so that a network tunnel is created through the MQTT; and S150, an MQTT is established to bear a Wi-guide network, the MQTT in the step S110 is a message publishing / subscribing transmission protocol based on a client-server, VPN flow is borne by using the MQTT, and data transmission is effectively managed through a publishing-subscribing mode and an authentication and authorization mechanism of the MQTT.

Description

Technical Field

[0001] The present invention relates to the field of communication technology, and in particular to a method and system for MQTT-based VPN. Background Art

[0002] The full name of VPN is "Virtual Private Network", which is a technology that securely connects private networks through public networks. VPN technology can encrypt data streams to ensure the confidentiality and integrity of data during transmission. Through VPN, users can remotely access internal company network resources or create secure communication channels on public networks. In some actual scenarios, there will be situations where there is no public IP on both ends of the client, which makes direct communication difficult. In order to solve this problem, each VPN service will have its own solution. For example, N2N uses supernode nodes to transfer data traffic, Wireguard will deploy a node as a transfer node to transfer data traffic, or use some relay servers to transfer traffic, such as TURN servers. TURN stands for Traversal Using Relays around NAT, which is an extension of the STUN protocol. If two hosts are behind different NATs and want to communicate with each other, they can either traverse through P2P or transfer through a machine with a public IP. The TURN server provides a relay function to help hosts communicate.

[0003] When traditional VPNs solve the problem of no public IP on both ends of the client, they often need to implement relay services to transfer data traffic. For example, N2N uses proprietary supernode technology to solve this problem, which has certain limitations and is difficult to promote. The conventional practice of Wireguard is to find a node as a transfer node, that is, a VPN gateway, and then all nodes are connected to this gateway. All nodes communicate through this gateway. Each peer's message needs to be configured on the node, and each peer establishes a tunnel with this transfer node, and then forwards the data traffic. In this way, when there are more and more peers, the VPN gateway will become a bottleneck for vertical expansion. Forwarding traffic through the VPN gateway will bring high latency. If the TURN service is used to transfer traffic, the bandwidth consumption will increase significantly, especially in high-traffic scenarios, resulting in increased operating costs. In addition, the configuration and maintenance of the TURN server is relatively complicated, especially when ensuring high availability and load balancing, which increases the complexity and operation and maintenance costs of the system. Summary of the invention

[0004] 1. Technical issues to be solved

[0005] In view of the deficiencies in the prior art, the present invention provides a method and system for MQTT-based VPN, which solves the problems that the prior art has limitations and is difficult to promote, forwarding traffic through a VPN gateway will cause high latency, and using a TURN service to transfer traffic will lead to complex configuration and maintenance of a TURN server.

[0006] (II) Technical solution

[0007] To achieve the above objectives, the present invention is implemented by the following technical solution: A method for MQTT carrying VPN includes the following steps:

[0008] Step S110, building an MQTT service on the server as a core component for message transmission;

[0009] Step S120, the VPN client publishes relevant data to the MQTT service via gw2mq;

[0010] Step S130, gw2mq subscribes to relevant data from MQTT and sends it to the VPN server;

[0011] Step S140, the data of the VPN server is returned to MQTT through gw2mq, and the VPN client subscribes to the data through gw2mq, thus creating a network tunnel through MQTT;

[0012] Step S150, building an MQTT-based Wireguard network.

[0013] Preferably, MQTT in step S110 is a client-server based message publish / subscribe transmission protocol, which is suitable for a wide range of application scenarios due to its lightweight, simple, open and easy to implement characteristics. When implementing VPN, MQTT can be used as a mechanism for data exchange in the VPN tunnel, so that data can be reliably transmitted between devices in different network environments.

[0014] Preferably, in step S120, gw2mq needs to transfer the data between the two VPN programs via MQTT. Specifically, gw2mq can be constructed separately or integrated into the VPN program.

[0015] Preferably, the data between the two VPN programs is transferred through MQTT. When a separate gw2mq program is used, the data received from the network interface needs to be published to MQTT. At the same time, the data of MQTT can also be subscribed and sent back to the network interface, so that the data between the two VPN programs is transferred through MQTT, thereby solving the VPN technology networking problem when both communication parties do not have a public network IP. The specific gw2mq program involves the following steps:

[0016] S(1) initializes the MQTT client library and establishes a connection with the MQTT service;

[0017] When connecting, obtain the MQTT service address to be connected, as well as the username and password for the connection from the configuration file. This ensures that the client can correctly authenticate and connect to the MQTT service, set up the heartbeat mechanism, and check the smoothness of the communication channel through periodic heartbeats;

[0018] S(2) handles the communication between the VPN program and MQTT;

[0019] Process corresponding network events according to different roles. When gw2mq acts as a TCP or UDP server, the program listens for connections on the specified port and publishes the received data to the corresponding MQTT topic. When acting as a TCP or UDP client, the program connects to the specified VPN server and sends the corresponding MQTT topic data to the VPN server.

[0020] S(3) handles multiple socket connections simultaneously and interacts with MQTT;

[0021] Different topics can be set according to different connections to distinguish them.<vpn_id><source_node><destination_node> The number and content of the levels can be adjusted according to actual needs, but are not limited to this. vpn_id is the network ID of the vpn, which is used to distinguish the VPN network.<source_node> Used to identify the source node.<destination_node> Used to identify the target node. If the establishment of VPN and data transmission interact through different ports, the topic can be expanded to<vpn_id><source_node><destination_node><port_id> in the form of<port_id> is the corresponding port;

[0022] S(4) establishes a mapping table between VPN node addresses and socket connections. Therefore, it is necessary to record the connection information of each node so that the corresponding socket can be quickly found for data forwarding when processing data.

[0023] Preferably, when the data between two VPN programs is transferred via MQTT and integrated into the VPN program, the VPN program needs to be modified, specifically including the following steps:

[0024] S① Initialize the MQTT client library:

[0025] Connect to the MQTT service, obtain the required configuration information, set up the heartbeat mechanism, and ensure the smoothness of the communication channel.

[0026] S②Set up publishing and subscription topics:

[0027] Can be set to<vpn_id><source_node><destination_node> forms, but not limited to them.

[0028] S③ Modify the processing logic of the VPN program to publish the data originally sent through TCP or UDP through MQTT, receive the data in the MQTT subscription topic, and return it to the VPN program for processing.

[0029] Preferably, the specific process in step S130 can be divided into two cases according to whether gw2mq is constructed separately:

[0030] Build gw2mq separately: First, set the gw2mq program on the right to TCP or UDP client mode, set the publishing topic to "01 / B / A", the subscription topic to "01 / A / B" and set the MQTT to be connected. Then the gw2mq program can subscribe to the data under the relevant MQTT topic, and send the data to the service port of the local VPN after obtaining the data packet. After that, the VPN program writes the original IP data packet in the tunnel load to the character device. These IP packets will appear on the Tun virtual device on the right, and finally sent to the application on the right through the operating system protocol stack and socket interface;

[0031] Integrate into VPN program: First, set the subscribed topic of the VPN program on the right to "01 / B" through the internal gw2mq module, so that the data subscribed from MQTT will be processed by the VPN program.

[0032] Preferably, the specific process in step S140 can be divided into two cases according to whether gw2mq is constructed separately:

[0033] Build gw2mq separately: the data returned from the VPN server will also be sent to MQTT through the gw2mq program. After the VPN client's gw2mq subscribes to the data from MQTT, it will be sent back to the client eth0, the client network protocol stack, the client Tun, and finally to the client application.

[0034] Integrate into VPN program: The data returned from the VPN server is subsequently published to MQTT by dynamically setting the publishing topic to "01 / A" by calling the internal gw2mq module. The VPN client subscribes to the "01 / A" message through the internal gw2mq module for processing.

[0035] Preferably, in step S150, Wireguard is a fast and modern VPN designed to provide ease of use and high performance, and its protocol is open source and relatively simple, making the code easy to develop and review.

[0036] A system for carrying VPN via MQTT is proposed based on the method for carrying VPN via MQTT, and includes a MQTT service module, a gw2mq module and a VPN server. The VPN server sends request data to the gw2mq module, and then the gw2mq module uploads the request data to the MQTT service module to obtain subscription data from the server, and then the gw2mq module transmits the obtained subscription data to the VPN server.

[0037] (III) Beneficial effects

[0038] The present invention provides a method and system for MQTT-based VPN, which has the following beneficial effects:

[0039] VPN built by using the MQTT protocol has significant advantages. First, it is simpler. Using standardized MQTT, it is easy to implement on various operating systems and embedded devices, achieving wide compatibility and coverage. In addition, it is more secure. In addition to the VPN protocol's authentication authorization, key negotiation, tunnel encryption and other security mechanisms, it can also use the MQTT protocol's security extensions, such as MQTTS, WSS and topic filtering, to provide multi-level security protection. BRIEF DESCRIPTION OF THE DRAWINGS

[0040] Figure 1 This is a basic flow chart of the MQTT VPN system proposed by the present invention;

[0041] Figure 2 The gw2mq principle diagram proposed by the present invention;

[0042] Figure 3 This is a flow chart of processing MQTT information proposed by the present invention;

[0043] Figure 4 This is a diagram of the MQTT-based VPN architecture proposed by the present invention;

[0044] Figure 5 This is a diagram of the MQTT-borne Wireguard negotiation process proposed by the present invention;

[0045] Figure 6 This is the MQTT-carrying Wireguard topology diagram proposed in the present invention. DETAILED DESCRIPTION

[0046] The following will be combined with the drawings in the embodiments of the present invention to clearly and completely describe the technical solutions in the embodiments of the present invention. Obviously, the described embodiments are only part of the embodiments of the present invention, not all of the embodiments. Based on the embodiments of the present invention, all other embodiments obtained by ordinary technicians in this field without creative work are within the scope of protection of the present invention.

[0047] like Figure 1-6 As shown, the embodiment of the present invention provides a method for MQTT carrying VPN, comprising the following steps:

[0048] Step S110, building an MQTT service on the server as a core component for message transmission;

[0049] MQTT is a client-server based message publishing / subscription transmission protocol. It is suitable for a wide range of application scenarios due to its lightweight, simple, open and easy-to-implement characteristics. When implementing VPN, MQTT can be used as a data exchange mechanism in the VPN tunnel, so that data can be reliably transmitted between devices in different network environments. Therefore, it is necessary to build an MQTT service on a public network server, and no modification is required, only simple configuration is required. Specifically, during the configuration process, it is necessary to ensure that the MQTT service can accept external connections and set necessary security measures for each connection, which involves the following steps:

[0050] S1. Enable the authentication function of MQTT. First, disable anonymous access to ensure that all connections require authentication. Next, create a user account and set the corresponding password to ensure that only authenticated users can connect to the MQTT service. In this way, each connection will be authenticated to ensure the security of the connection.

[0051] S2. Enable the authorization function of MQTT. As needed, configure the publishing and subscribing permissions of users on specific MQTT topics to control access to VPN connections. For example, allow a user to publish and subscribe only to topics related to his VPN tunnel. This configuration can finely control the permissions of each user to ensure the security and effective transmission of data.

[0052] S3. After completing the configuration, use the MQTT client to perform basic tests to verify whether it can publish and subscribe messages normally. In addition, use the clustering and load balancing functions of MQTT to configure multiple MQTT services and distribute connections to different instances through the load balancer to improve the reliability and scalability of the system. In this way, a large number of VPN connections and data traffic can be effectively managed and processed.

[0053] Step S120, the VPN client publishes relevant data to the MQTT service through gw2mq. gw2mq needs to transfer the data between the two VPN programs through MQTT. Specifically, gw2mq can be built separately or integrated into the VPN program.

[0054] The first case: Build the gw2mq program separately. You need to publish the data received from the network interface to MQTT. You can also subscribe to the MQTT data and send it back to the network interface. This allows the data between the two VPN programs to be transferred through MQTT, thereby solving the VPN technology networking problem when both parties do not have a public IP. The specific gw2mq program involves the following steps:

[0055] S(1) initializes the MQTT client library and establishes a connection with the MQTT service;

[0056] When connecting, obtain the MQTT service address to be connected, as well as the username and password for the connection from the configuration file. This ensures that the client can correctly authenticate and connect to the MQTT service, set up the heartbeat mechanism, and check the smoothness of the communication channel through periodic heartbeats;

[0057] S(2) handles the communication between the VPN program and MQTT;

[0058] Process corresponding network events according to different roles. When gw2mq acts as a TCP or UDP server, the program listens for connections on the specified port and publishes the received data to the corresponding MQTT topic. When acting as a TCP or UDP client, the program connects to the specified VPN server and sends the corresponding MQTT topic data to the VPN server.

[0059] S(3) handles multiple socket connections simultaneously and interacts with MQTT;

[0060] Different topics can be set according to different connections to distinguish them.<vpn_id><source_node><destination_node> The number and content of the levels can be adjusted according to actual needs, but are not limited to this. vpn_id is the network ID of the vpn, which is used to distinguish the VPN network.<source_node> Used to identify the source node.<destination_node> Used to identify the target node. If the establishment of VPN and data transmission interact through different ports, the topic can be expanded to<vpn_id><source_node><destination_node><port_id> in the form of<port_id> is the corresponding port;

[0061] S(4) Establish a mapping table between VPN node addresses and socket connections. Therefore, it is necessary to record the connection information of each node so that the corresponding socket can be quickly found for data forwarding when processing data.

[0062] The specific contents of the mapping table include: the identifier of the VPN node, such as nodeA, nodeB, Socket information: the socket connection object, IP address and port number of the corresponding node, MQTT topic: the subscription and publication topics of the node in MQTT, so that the respective publication and subscription topics can be defined for each socket connection.

[0063] The specific processing process is as follows Figure 2 As shown, it starts with initializing components, including parsing configuration file parameters and initializing the MQTT client. Then the program connects to the specified MQTT service and sets up a TCP or UDP socket for network communication according to the role. Then it enters the event loop and waits for receiving socket data or MQTT messages.

[0064] When socket data is received, it is processed accordingly, without parsing the TCP / UDP data content, and is sent directly to the specified MQTT topic through the MQTT client; when an MQTT message is received, the callback function is called to process the message, and the message is sent to the corresponding socket according to the MQTT topic. This can effectively process the data received from the socket and publish it to MQTT, and can also receive MQTT messages and send them to the specified socket.

[0065] The specific process of handling multiple connections is as follows Figure 3 As shown in the figure, when gw2mq receives an MQTT message from an edge VPN client, it checks the mapping table. If the record exists, it directly writes the message to the existing socket connection corresponding to the client address; if the record does not exist, it creates a new socket connection to the VPN server and writes the message to this new socket connection, and then updates the mapping table information. In this way, the VPN server can accurately distinguish the connections of different clients, thereby achieving correct data communication when multiple clients are connected at the same time.

[0066] The second situation: integrated into the VPN program, the VPN program needs to be modified, including the following steps:

[0067] S① Initialize the MQTT client library:

[0068] Connect to the MQTT service, obtain the required configuration information, set up the heartbeat mechanism, and ensure the smoothness of the communication channel.

[0069] S②Set up publishing and subscription topics:

[0070] Can be set to<vpn_id><source_node><destination_node> forms, but not limited to them.

[0071] S③ Modify the processing logic of the VPN program to publish data originally sent via TCP or UDP via MQTT, receive data from the MQTT subscription topic, and return it to the VPN program for processing;

[0072] The specific process is as follows Figure 4 As shown, the gw2mq in the dashed box can be built separately or integrated into the VPN;

[0073] When building gw2mq separately, the VPN and gw2mq programs run on the same device. The application on the left host generates data and sends the data to the local TCP / IP protocol stack through the socket API. After the data packet is processed in the TCP / IP protocol stack, it is sent to the Tun interface by looking up the routing table. The Tun driver writes the data packet received by the Tun interface to the / dev / net / tun character device as is. After that, the VPN program can read the data packet from the device, encapsulate the data packet, and send the data to the specified port of the gw2mq program through the local loopback interface. At this time, the gw2mq program is set to TCP or UDP server mode, set the publishing topic to "01 / A / B", the subscription topic to "01 / B / A", and set the MQTT to be connected. In this way, VPN traffic is published to the specified MQTT topic through the gw2mq program.

[0074] When integrated into a VPN program, the gw2mq acts as an internal module of the VPN program. After the VPN program encapsulates and encrypts the data, it calls the gw2mq module to send the data to the specified MQTT. The published topic is "01 / B" and the subscribed topic is "01 / A", where 01 is the network number, B is the virtual IP of the VPN server, and A is the virtual IP of the VPN client.

[0075] Step S130, gw2mq subscribes to relevant data from MQTT and sends it to the VPN server;

[0076] like Figure 4As shown, when building gw2mq separately, the gw2mq program on the right is set to TCP or UDP client mode, the publishing topic is set to "01 / B / A", the subscription topic is set to "01 / A / B", and the MQTT to be connected is set, so that the gw2mq program can subscribe to the data under the relevant MQTT topic, and send the data to the service port of the local VPN after obtaining the data packet. After that, the VPN program writes the original IP data packet in the tunnel load to the character device, and these IP packets will appear on the Tun virtual device on the right, and finally sent to the application on the right through the operating system protocol stack and socket interface;

[0077] When integrated into the VPN program, the VPN program on the right sets the subscribed topic to "01 / B" through the internal gw2mq module, so that the data subscribed from MQTT is handed over to the VPN program for processing.

[0078] Step S140, the data of the VPN server is returned to MQTT through gw2mq, and the VPN client subscribes to the data through gw2mq;

[0079] like Figure 4 As shown in the figure, when gw2mq is built separately, the subsequent data returned from the VPN server will also be sent to MQTT through the gw2mq program. After the VPN client's gw2mq subscribes to the data from MQTT, it will be sent back to the client eth0, the client network protocol stack, the client Tun, and finally to the client application.

[0080] When integrated into the VPN program, the data returned from the VPN server is published to MQTT by dynamically setting the publishing topic to "01 / A" by calling the internal gw2mq module. The VPN client subscribes to the "01 / A" message through the internal gw2mq module for processing, thus creating a network tunnel through MQTT.

[0081] Step S150, build MQTT to carry Wireguard network. Wireguard is a fast and modern VPN designed to provide ease of use and high performance. Its protocol is open source and relatively simple, making the code easy to develop and review. Wireguard is simply a three-layer P2P security tunnel. The underlying transmission uses UDP, and there are kernel state implementations and user state implementations. The main logical concepts of Wireguard are interface and peer; interface represents the local tunnel interface, and the listening port, network card IP, and Wireguard private key need to be specified. Peer refers to the Wireguard node logically connected to the interface, and the Wireguard public key, AllowedIPs, and Endpoint need to be specified;

[0082] The negotiation process of MQTT carrying Wireguard is as follows Figure 5 As shown: initiator is the initiator of the Wireguard node, and responder is the responder of the Wireguard node. First, the initiator initiates the connection and sends the handshake initialization message to the local gw2mq program. After receiving the data, gw2mq sends it to the specified MQTT. After the gw2mq on the other end subscribes to the handshake initialization message from MQTT, it sends it to the responder to process and verify the data, including key negotiation and other operations. After the verification is passed, a handshake response message is created and sent to the local gw2mq. After receiving the message, gw2mq sends it to MQTT. After receiving the data, the gw2mq on the initiator's end will send it back to the Wireguard node to process and verify the data. In this way, the Wireguard tunnel is successfully established, and data can be sent normally afterwards.

[0083] The specific network topology is as follows: Figure 6 In the example, the Wireguard-1 node sets the local virtual interface IP to 10.0.10.2 / 24, specifies AllowedIPs to 10.0.10.1 / 32, and the Endpoint points to the local port 1000; the gw2mq of the Wireguard-1 node is set to UDPServer mode, the listening port is 1000, the publishing topic is wg / 10.0.10.2 / 10.0.10.1, the subscription topic is wg / 10.0.10.1 / 10.0.10.2, the IP and port of the MQTT to be connected, and the username and password for the connection;

[0084] The Wireguard-2 node sets the local virtual interface IP to 10.0.10.1 / 24, configures two peers, one of which has AllowedIPs 10.0.10.2 / 32 and the other has AllowedIPs 10.0.10.3 / 32; the gw2mq program of the wireguard-2 node sets the UDPClient mode, connects to the local port 51820, and establishes two socket connections, one of which publishes the topic wg / 10.0.10.1 / 10.0.10.2 and subscribes to the topic wg / 10.0.10.2 / 10.0.10.1; the other publishes the topic wg / 10.0.10.1 / 10.0.10.3 and subscribes to the topic wg / 10.0.10.3 / 10.0.10.1, as well as the IP and port number of the MQTT to be connected, and the username and password for the connection;

[0085] The Wireguard-3 node sets the local virtual interface IP to 10.0.10.3 / 24, specifies AllowedIPs to 10.0.10.1 / 32, and the Endpoint points to the local port 1000; the gw2mq of the wireguard-3 node is set to UDPServer mode, the listening port is 1000, the publishing topic is wg / 10.0.10.3 / 10.0.10.1, the subscription topic is wg / 10.0.10.1 / 10.0.10.3, the IP and port of the MQTT to be connected, and the username and password for the connection;

[0086] After the configuration is complete, start the respective gw2mq and Wireguard services. In this way, when Wireguard-1 wants to initiate a connection, the data will be published to the wg / 10.0.10.2 / 10.0.10.1 topic of MQTT through gw2mq. After the gw2mq on the Wireguard-2 node subscribes to the data of the wg / 10.0.10.2 / 10.0.10.1 topic from MQTT, it will first look for the mapping relationship table between the VPN node address and the socket connection;

[0087] If the record does not exist, create a socket with Wireguard-2, write the message, and add the Wireguard-1 edge address and the socket to the table;

[0088] If it exists, the message is written directly, the information in the mapping table remains unchanged, and the returned data is sent to the wg / 10.0.10.1 / 10.0.10.2 topic of MQTT through gw2mq. The gw2mq of the Wireguard-1 node subscribes to the data and then passes it to wireguard-1 for processing, thus realizing data communication;

[0089] Similarly, the data of the Wireguard-3 node published to MQTT will be subscribed to by gw2mq on the Wireguard-2 node, and then sent to Wireguard-2, so that the wireguard-1 and wireguard-2 nodes can access the wireguard-3 node. If you need to configure the sitetosite mode, you can add the corresponding network segment to AllowedIPs, enable routing forwarding and configure the corresponding NAT rules;

[0090] Since Wireguard actively connects to MQTT through gw2mq, data can be transferred through the MQTT service after the connection is established. This can effectively solve the NAT problem. As long as the device can establish a connection with MQTT, it can communicate even behind different NAT networks, so that a VPN network can be established.

[0091] The MQTT-based VPN system proposed in the method of MQTT-based VPN includes an MQTT service module, a gw2mq module and a VPN server. The VPN server sends request data to the gw2mq module, and then the gw2mq module uploads the request data to the MQTT service module to obtain subscription data from the server, and then the gw2mq module transmits the obtained subscription data to the VPN server.

[0092] Although embodiments of the present invention have been shown and described, it will be appreciated by those skilled in the art that various changes, modifications, substitutions and variations may be made to the embodiments without departing from the principles and spirit of the present invention, and that the scope of the present invention is defined by the appended claims and their equivalents.

Claims

1. A method for carrying VPN via MQTT, characterized in that: The following steps are involved: Step S110, building an MQTT service on the server as a core component for message transmission; Step S120, the VPN client publishes relevant data to the MQTT service via gw2mq; Step S130, gw2mq subscribes to relevant data from MQTT and sends it to the VPN server; Step S140, the data of the VPN server is returned to MQTT through gw2mq, and the VPN client subscribes to the data through gw2mq, thus creating a network tunnel through MQTT; Step S150, building an MQTT-based Wireguard network.

2. The method for carrying VPN over MQTT according to claim 1, characterized in that: In step S110, MQTT is a client-server based message publishing / subscribing transmission protocol. Due to its lightweight, simple, open and easy to implement characteristics, it is suitable for a wide range of application scenarios. When implementing VPN, MQTT can be used as a mechanism for data exchange in the VPN tunnel, so that data can be reliably transmitted between devices in different network environments.

3. The method for carrying VPN over MQTT according to claim 1, characterized in that: In step S120, gw2mq needs to transfer the data between the two VPN programs through MQTT. Specifically, gw2mq can be constructed separately or integrated into the VPN program.

4. The method for carrying VPN over MQTT according to claim 3, characterized in that: When using a separate gw2mq program to transfer data between two VPN programs through MQTT, you need to publish the data received from the network interface to MQTT. At the same time, you can also subscribe to the MQTT data and send it back to the network interface, so that the data between the two VPN programs can be transferred through MQTT, thereby solving the VPN technology networking problem when both parties do not have a public IP. The specific gw2mq program involves the following steps: S(1) initializes the MQTT client library and establishes a connection with the MQTT service; When connecting, obtain the MQTT service address to be connected, as well as the username and password for the connection from the configuration file. This ensures that the client can correctly authenticate and connect to the MQTT service, set up the heartbeat mechanism, and check the smoothness of the communication channel through periodic heartbeats; S(2) handles the communication between the VPN program and MQTT; Process corresponding network events according to different roles. When gw2mq acts as a TCP or UDP server, the program listens for connections on the specified port and publishes the received data to the corresponding MQTT topic. When acting as a TCP or UDP client, the program connects to the specified VPN server and sends the corresponding MQTT topic data to the VPN server. S(3) handles multiple socket connections simultaneously and interacts with MQTT; Different topics can be set according to different connections to distinguish them.<vpn_id><source_node><destination_node> The number and content of the levels can be adjusted according to actual needs, but are not limited to this. vpn_id is the network ID of the vpn, which is used to distinguish the VPN network.<source_node> Used to identify the source node.<destination_node> Used to identify the target node. If the establishment of VPN and data transmission interact through different ports, the topic can be expanded to<vpn_id><source_node><destination_node><port_id> in the form of<port_id> is the corresponding port; S(4) establishes a mapping table between VPN node addresses and socket connections. Therefore, it is necessary to record the connection information of each node so that the corresponding socket can be quickly found for data forwarding when processing data.

5. The method for carrying VPN over MQTT according to claim 3, characterized in that: When transferring data between two VPN programs through MQTT and integrating it into the VPN program, the VPN program needs to be modified. The specific steps include: S① Initialize the MQTT client library: Connect to the MQTT service, obtain the required configuration information, set up the heartbeat mechanism, and ensure the smoothness of the communication channel. S②Set up publishing and subscription topics: Can be set to<vpn_id><source_node><destination_node> forms, but not limited to them. S③ Modify the processing logic of the VPN program to publish the data originally sent through TCP or UDP through MQTT, receive the data in the MQTT subscription topic, and return it to the VPN program for processing.

6. The method for carrying VPN over MQTT according to claim 1, characterized in that: The specific process in step S130 can be divided into two cases according to whether gw2mq is constructed separately: Build gw2mq separately: First, set the gw2mq program on the right to TCP or UDP client mode, set the publishing topic to "01 / B / A", the subscription topic to "01 / A / B" and set the MQTT to be connected. Then the gw2mq program can subscribe to the data under the relevant MQTT topic, and send the data to the service port of the local VPN after obtaining the data packet. After that, the VPN program writes the original IP data packet in the tunnel load to the character device. These IP packets will appear on the Tun virtual device on the right, and finally sent to the application on the right through the operating system protocol stack and socket interface; Integrate into VPN program: First, set the subscribed topic of the VPN program on the right to "01 / B" through the internal gw2mq module, so that the data subscribed from MQTT will be processed by the VPN program.

7. The method for carrying VPN over MQTT according to claim 1, characterized in that: The specific process in step S140 can be divided into two cases according to whether gw2mq is constructed separately: Build gw2mq separately: the data returned from the VPN server will also be sent to MQTT through the gw2mq program. After the VPN client's gw2mq subscribes to the data from MQTT, it will be sent back to the client eth0, the client network protocol stack, the client Tun, and finally to the client application. Integrate into VPN program: The data returned from the VPN server is subsequently published to MQTT by dynamically setting the publishing topic to "01 / A" by calling the internal gw2mq module. The VPN client subscribes to the "01 / A" message through the internal gw2mq module for processing.

8. The method for carrying VPN over MQTT according to claim 1, characterized in that: In step S150, Wireguard is a fast and modern VPN designed to provide ease of use and high performance, and its protocol is open source and relatively simple, making the code easy to develop and review.

9. A system for carrying VPN over MQTT is proposed based on the method for carrying VPN over MQTT, characterized in that: It includes an MQTT service module, a gw2mq module and a VPN server. The VPN server sends request data to the gw2mq module, and then the gw2mq module uploads the request data to the MQTT service module to obtain subscription data from the server, and then the gw2mq module transmits the obtained subscription data to the VPN server.

Images