Method and device for realizing seven-layer NAT (Network Address Translation) based on openstack platform

Abstract

The invention relates to the technical field of communication, and particularly provides a method and a device for realizing seven-layer NAT (Network Address Translation) based on an openstack platform, which comprises the following steps of: firstly, creating a virtual machine in a VPC intranet, enabling FTP (File Transfer Protocol) service by the virtual machine, supporting a conntackhelper module by a neutron through a plug-in, starting nfconntackhelper kernel forwarding in an exclusive router of an existing virtual private network, and starting an nfconntackhelper kernel forwarding in a router exclusive to the existing virtual private network; the method comprises the following steps: firstly, a router is established, an FTP dual-channel port is established, an iptables rule for opening and closing an FTP dual-channel port is issued in the router through an interface, then, under the implementation of a helper module, internal and external conversion, namely conversion between floatingIp and an intranet Ip, is carried out on an IP address in seven layers, and conversion between floatingIp and a public network Ip in seven layers of data is also carried out on a firewall. Compared with the prior art, the connection consistency of the control channel and the data channel can be ensured, the problem of connection interruption caused by obtaining the private network address in the cloud is avoided, and mutual access of the external network and the internal network under a special protocol is completed.

Description

Technical Field

[0001] The present invention relates to the field of communication technologies, and specifically provides a method and device for implementing seven-layer NAT based on the openstack platform. Background Art

[0002] In a cloud computing environment, to ensure resource isolation and security between different users or tenants, it is necessary to allocate independent private networks to each user or tenant. These private networks use private IP addresses for internal communication, thus avoiding direct access from the external network and potential security threats. On the premise of ensuring security, further design is required for the outbound requirements of users. Based on this requirement, through NAT technology, the private IP addresses of the internal network can be converted into public IP addresses for communication, thereby hiding the true structure of the internal network and increasing security. At the same time, NAT technology allows multiple internal devices to share a public IP address for communication, thus greatly improving the utilization rate of IP addresses. In particular, dynamic NAT and NAPT (Network Address Port Translation) technologies can implement the mapping of multiple private IP addresses to a small number of public IP addresses, further saving IP address resources.

[0003] The NAT technology replaces the source IP address in the data packet sent from the internal network with a public IP address and records the mapping relationship in the NAT table. When the data packet from the external network returns, the NAT router replaces the destination IP address with the original internal IP address according to the NAT table, thereby realizing two-way communication of data. This address conversion is performed on the IP addresses of the three-layer IP layer.

[0004] Taking the FTP service in the internal network as an example, FTP (File Transfer Protocol) usually requires two channels: one is the control channel for transmitting control commands; the other is the data channel for transmitting actual data files. The establishment of the data channel requires obtaining the seven-layer data in the data packet transmitted by the control channel, and the seven-layer data contains the internal network FTP address for establishing a connection. When establishing the data channel, since the NAT conversion does not involve the seven-layer data, the establishment of the channel with the internal network IP fails.

[0005] How to achieve the purpose of communication between the private network in the cloud and the external network, and further convert the seven-layer address through the conntrack_helper module to assist in the establishment and data transmission of the data channel in scenarios such as the use of FTP and other protocols is an urgent problem to be solved by those skilled in the art. Summary of the Invention

[0006] In view of the above deficiencies of the prior art, the present invention provides a method for implementing seven-layer NAT based on the openstack platform with strong practicability.

[0007] A further technical task of the present invention is to provide a reasonably designed, safe and applicable seven-layer NAT device implemented based on the OpenStack platform.

[0008] The technical solution adopted by the present invention to solve its technical problems is as follows:

[0009] A method for implementing seven-layer NAT based on the OpenStack platform. First, create a virtual machine within the VPC internal network. The virtual machine enables the FTP service. Neutron supports the conntrack_helper module through a plugin. Enable nf_conntrack_helper kernel forwarding within the router dedicated to the existing virtual private network. At the same time, issue iptables rules for opening the FTP dual-channel ports through the interface within the router to ensure the establishment of both the control channel and the data channel.

[0010] Then, under the implementation of the helper module, perform internal and external conversion of the IP addresses in the seven layers, that is, the conversion between the floating IP and the internal network IP. Also perform the conversion between the floating IP and the public network IP in the seven-layer data on the firewall to ensure that the correct converted public network address is obtained from the application layer data when the data channel is established.

[0011] Furthermore, when creating a virtual machine within the VPC internal network and enabling the FTP service for the virtual machine, bind a floating IP address to the virtual machine. Establish a snat rule on the router dedicated to the virtual private network to perform the mutual conversion between the internal network address and the floating IP address, and perform internal and external address conversion of the IP layer addresses. Under the existing DVR network architecture, after exiting through the fipnamespace of this computing node, reach the firewall through the physical network. Then, perform further nat conversion between the floating IP and the public network address on the firewall to complete the service access provided by the internal network FTP server to the outside.

[0012] Furthermore, when performing Neutron configuration, the following steps are involved:

[0013] (1) Enable plugin support on the Neutron server side and add a conntrack_helper plugin configuration item in the neutron.conf configuration file;

[0014] (2) Enable plugin support on the l3agent node and add a conntrack_helper plugin configuration item in the l3_agent.ini configuration file;

[0015] (3) After modifying the configuration, restart all the modified nodes to make the configuration take effect.

[0016] Further, when configuring the conntrack_helper module, the following steps are involved:

[0017] (1) The conntrack_helper plugin provided by neutron exposes the operation interfaces of conntrack_helper, and create and delete operations are performed through the api interface;

[0018] (2) The parameters required when calling the interface;

[0019] (3) After the server side of conntrack_helper receives the API request, it sends the relevant configuration to the agent side. The agent side receives the configuration and successfully configures the raw table by calling iptables.

[0020] Further, the parameters required when calling the interface include the protocol type, protocol port number, and the virtual router id of the internal network where the internal network virtual machine is located. The FTP protocol encapsulation parameters are as follows:

[0021] {"conntrack_helper":{"helper":"ftp","protocol":"tcp","port":"21"},"router_id":"4f3dfff3-49fd-4faf-b00b-b3066e26161c"}.

[0022] Further, after the agent side receives the configuration and successfully configures the raw table by calling iptables, the following is displayed after successful configuration:

[0023] -A neutron-l3-agent-cth-546e839 -p tcp -m tcp --dport 20 -j CT --helper ftp

[0024] -A neutron-l3-agent-cth-7d85451 -p tcp -m tcp --dport 21 -j CT --helper ftp.

[0025] Further, when configuring the virtual router, the following steps are involved:

[0026] (1) Find the virtual router id of the internal network where the internal network server is located, and enter the namespace to modify the configuration: ip netns exec qrouter-4f3dfff3-49fd-4faf-b00b-b3066e26161c bash;

[0027] (2) Modify the nf_conntrack_helper kernel parameter: echo 1> / proc / sys / net / netfilter / nf_conntrack_helper;

[0028] (3) Manually load the nf_nat_ftp module:

[0029] modprobe nf_nat_ftp.

[0030] Furthermore, the internal network address of the FTP server is 172.31.100.53, and the bound FIP address is 100.148.2.132. When accessing the internal network from the external network, it can be seen from the packet capture analysis on the qrouter that after enabling the conntrack_helper function module, the internal network address 172.31.100.53 at the IP layer is converted to the FIP address 100.148.2.132, and the IP address in the application layer data is also converted from the internal network address to the FIP address. The function configuration is successful, and the correct control channel and data channel can be established when accessing the FTP server in the internal network from the external network, completing the access to the internal network FTP service.

[0031] A seven-layer NAT device implemented based on the openstack platform, including: at least one memory and at least one processor;

[0032] The at least one memory is used to store machine-readable programs;

[0033] The at least one processor is used to call the machine-readable program and execute a seven-layer NAT method implemented based on the openstack platform.

[0034] Compared with the prior art, a seven-layer NAT method and device based on the openstack platform of the present invention have the following prominent beneficial effects:

[0035] The present invention supports the requirements for IP address conversion in seven-layer data of application layer protocols such as FTP and SIP through connection tracking supported by the linux kernel and its extended modules. Through the support of service plugins of the openstack platform itself, no additional network resource overhead is required. Based on the NAT conversion supported by the cloud platform (application scenarios of internal and external mutual access), the conntrack_helper module completes the NAT conversion of the IP address in the seven-layer application data, ensures the connection consistency of the control channel and the data channel, avoids the problem of connection interruption caused by obtaining the private network address inside the cloud, and completes the mutual access between the external network and the internal network under special protocols. Description of the Drawings

[0036] To more clearly illustrate the technical solutions in the embodiments of the present invention or the prior art, the following will briefly introduce the drawings required for the description of the embodiments or the prior art. Obviously, the drawings in the following description are some embodiments of the present invention. For those of ordinary skill in the art, without creative efforts, other drawings can also be obtained based on these drawings.

[0037] Appendix Figure 1 is an architecture diagram for the internal network FTP to provide services externally in a method for implementing layer-7 NAT based on the OpenStack platform;

[0038] Appendix Figure 2 is an architecture diagram for the connection implementation in a method for implementing layer-7 NAT based on the OpenStack platform. Detailed implementation manners

[0039] To enable those skilled in the art of this technology to better understand the solution of the present invention, the following further details the present invention in combination with specific implementation manners. Obviously, the described embodiments are only a part of the embodiments of the present invention, rather than all of them. Based on the embodiments of the present invention, all other embodiments obtained by those of ordinary skill in the art without creative efforts belong to the scope protected by the present invention.

[0040] The following gives a best embodiment:

[0041] As Figure 1-2 shown, in a method for implementing layer-7 NAT based on the OpenStack platform in this embodiment, a virtual machine is created within the VPC internal network, and the FTP service is enabled on the virtual machine; a floating IP address is bound to the virtual machine, and a snat rule is established on the router dedicated to the virtual private network for the mutual conversion between the internal network address and the floating IP address, performing the internal and external address conversion of the IP layer address. Under the existing DVR network architecture, after passing through the fip namespace of this computing node to access the external network, through the physical network to reach the firewall, further nat conversion between the floating IP and the public network address is performed at the firewall to complete the service access provided by the internal network FTP server externally.

[0042] On this basis, neutron supports the conntrack_helper module through plugins, enables nf_conntrack_helper kernel forwarding in the existing routers dedicated to virtual private networks, and at the same time issues iptables rules for opening the FTP dual-channel ports in the router through the interface to ensure the dual establishment of the control channel and the data channel; under the implementation of the helper module, the IP addresses in the seventh layer are converted internally and externally (the conversion between floatingIp and internal network Ip), and the conversion between floatingIp and public network Ip in the seventh-layer data is also performed on the firewall, ensuring that the correct converted public network address is obtained from the application-layer data when the data channel is established.

[0043] Taking the access to the internal network FTP service as an example, the specific implementation mainly includes three major configurations: the neutron-side plugin support configuration, the conntrack_helper module configuration, and the virtual router configuration.

[0044] When performing neutron configuration, it is as follows:

[0045] (1) Enable plugin support on the neutron server side and add a conntrack_helper plugin configuration item in the neutron.conf configuration file.

[0046] (2) Enable plugin support on the l3agent node and add a conntrack_helper plugin configuration item in the l3_agent.ini configuration file.

[0047] (3) After modifying the configuration, restart all the modified nodes to make the configuration take effect.

[0048] When performing conntrack_helper module configuration, it is as follows:

[0049] (1) The conntrack_helper plugin provided by neutron provides operation interfaces for conntrack_helper, and operations such as creation and deletion can be performed through the api interface.

[0050] (2) The parameters that need to be noted when calling the interface are the protocol type, the protocol port number, and the virtual router id of the internal network where the internal network virtual machine is located. The FTP protocol encapsulation parameters are as follows:

[0051] {"conntrack_helper": {"helper": "ftp", "protocol": "tcp", "port": "21"}, "router_id": "4f3dfff3-49fd-4faf-b00b-b3066e26161c".

[0052] (3) After the server side of the conntrack_helper module receives the API request, it sends the relevant configuration to the agent side. After receiving the configuration, the agent side calls iptables to successfully configure the raw table. After successful configuration, it is shown as follows:

[0053] -A neutron-l3-agent-cth-546e839 -p tcp -m tcp --dport 20 -j CT --helper ftp;

[0054] -A neutron-l3-agent-cth-7d85451 -p tcp -m tcp --dport 21 -j CT --helper ftp.

[0055] When performing virtual router configuration, it is as follows:

[0056] (1) Find the virtual router id of the internal network where the internal network server is located, and enter the namespace to modify the configuration: ip netns exec qrouter-4f3dfff3-49fd-4faf-b00b-b3066e26161c bash;

[0057] (2) Modify the nf_conntrack_helper kernel parameter: echo 1 > / proc / sys / net / netfilter / nf_conntrack_helper;

[0058] (3) Manually load the nf_nat_ftp module (the modules to be loaded may be different for different protocols): modprobe nf_nat_ftp.

[0059] When verifying the configuration effect, after the above configuration is completed, as Figure 1In the architecture shown, the internal network address of the FTP server is 172.31.100.53, and the bound FIP address is 100.148.2.132. When accessing the internal network from the external network, packet capture analysis on the qrouter shows that after enabling the conntrack_helper function module, the internal network address 172.31.100.53 at the IP layer is converted to the FIP address 100.148.2.132, and the IP address in the application layer data is also converted from the internal network address to the FIP address. The function is configured successfully, and when accessing the FTP server in the internal network from the external network, the correct control channel and data channel can be established to complete the access to the internal network FTP service.

[0060] Based on the openstack platform, the platform provides the SNAT function for internal and external network communication, converting the source address of internal services to the external network through floatingIp to provide services externally. The floating IP is the IP address configured on the external network interface of the Neutron router (usually a virtual router). It provides static NAT (Network Address Translation) function, establishing a one-to-one mapping between the external network IP and the virtual machine tenant network IP. Network address translation is used to modify the source or destination IP address of a data packet when it passes through a router. In the scenario of Floating IP, the NAT rule ensures that the external network can access the virtual machine in the internal network through the Floating IP.

[0061] The connection tracking module (conntrack) is an important part of the NetFilter framework in the Linux kernel, mainly used to track the state of network connections. NetFilter is a subsystem in the Linux kernel used to implement functions such as packet filtering, address conversion, and network address port translation (NAT). The connection tracking module is the core module in NetFilter for maintaining network connection status information. This module identifies and tracks network connections passing through the Linux kernel, including connections of protocols such as TCP and UDP, and records information such as the start time, duration, status (such as NEW, ESTABLISHED, RELATED, INVALID, etc.) of the connection, as well as the IP addresses and port numbers at both ends of the connection.

[0062] For protocols such as FTP and SIP with different data streams and control streams, netfilter needs to know which streams are related, that is, to determine the main connection and the subordinate connection. The expected connection is the connection tracking information established in advance after determining the subordinate connection relationship by matching keywords. After the kernel knows the ownership relationship between the two connections, it can determine the relationship between the subordinate connection and the main connection through the connection tracking status, avoiding the subordinate connection being discarded as an ordinary connection.

[0063] Helper is one of the extended functions of connection tracking, which extends the functions of connection tracking modules for different application layer protocols. Conntrack_helper can support more application layer protocols by registering new helper functions. These helper functions can understand the packet formats of specific protocols and create expected connections accordingly, so that these connections can be correctly identified and tracked during subsequent packet processing. Conntrack_helper is closely related to the NAT function. By correctly identifying packets of the application layer protocol, conntrack helper can ensure that the protocol state information is not damaged during the NAT process, thus implementing a more flexible address translation strategy. This is crucial for applications that need to communicate through NAT.

[0064] Some application layer protocols store the IP addresses of layer 3, such as FTP, TFTP, SIP, etc. When we perform SNAT mapping on the packets going out from inside the cloud, the layer 3 source address of the packets becomes the external network address. However, the source address carried in the application layer protocol is still the private network address inside the cloud. If the source address in the application layer is not also subjected to SNAT address translation, the data in the data channels established between application layer protocols cannot enter the internal network service. By creating expected connections through helper functions, the problem of multiple connections can be matched through protocol ports, etc. At the same time, the helper function supports nat conversion, which is used to perform NAT conversion operations on the IP addresses carried in the application layer.

[0065] The virtual router resources in Neutron not only undertake the layer 3 IP address conversion work. On the basis of this function design, the nf_conntrack_helper function is enabled and the nf_nat_ftp module is loaded to meet the functional requirements of the IP address conversion carried in the seven-layer application layer. Inside the cloud, it is mainly the conversion between the internal network address and the floating IP address. Under the existing openstack platform architecture, it is also necessary to map the floating IP to the elastic public network IP on the egress firewall. At the same time, the firewall also performs address conversion on the application layer IP data to complete the access of the external network to the internal network FTP service.

[0066] Based on the above method, a seven-layer NAT device based on the openstack platform in this embodiment includes: at least one memory and at least one processor;

[0067] At least one memory for storing machine-readable programs;

[0068] At least one processor for calling the machine-readable program to execute a method for implementing seven-layer NAT based on the openstack platform.

[0069] The above specific embodiments are only specific cases of the present invention. The patent protection scope of the present invention includes but is not limited to the above specific embodiments. Any technical solution that conforms to the above specific embodiments of the present invention and any appropriate changes or substitutions made by any person of ordinary skill in the art shall fall within the patent protection scope of the present invention.

[0070] Although the embodiments of the present invention have been shown and described, for those of ordinary skill in the art, it can be understood that various changes, modifications, substitutions, and variations can be made to these embodiments without departing from the principles and spirit of the present invention. The scope of the present invention is defined by the appended claims and their equivalents.

Claims

1. A method for implementing a seven-layer NAT based on an openstack platform, characterized in that: First, create a virtual machine in the VPC intranet and enable the FTP service on the virtual machine. Neutron supports the conntrack_helper module through a plug-in. Enable the nf_conntrack_helper kernel forwarding in the router dedicated to the existing virtual private network. At the same time, send the iptables rule of opening the FTP dual-channel port in the router through the interface to ensure the dual establishment of the control channel and the data channel. Then, under the implementation of the helper module, the IP address in the seventh layer is converted internally and externally, that is, the conversion between floatingIp and internal network IP. The floatingIp in the seventh layer data and the public network IP are also converted on the firewall to ensure that the correct converted public network address is obtained from the application layer data when the data channel is established.

2. According to a method for implementing a seven-layer NAT based on an openstack platform according to claim 1, it is characterized in that: Create a virtual machine in the VPC intranet. When the virtual machine enables the FTP service, bind the floatingIp address to the virtual machine, establish a snat rule on the router dedicated to the virtual private network, convert the intranet address and the floatingIp address, and convert the internal and external addresses of the IP layer. Under the existing DVR network architecture, the network goes out through the fip namespace of the computing node, reaches the firewall through the physical network, and then further performs nat conversion between the floatingIp and the public network address on the firewall to complete the service access provided by the intranet FTP server to the outside world.

3. According to a method for implementing a seven-layer NAT based on an openstack platform according to claim 2, it is characterized in that: The steps for neutron configuration are as follows: (1) Enable plug-in support on the neutron server and add the conntrack_helper plug-in configuration item to the neutron.conf configuration file; (2) Enable plug-in support on the l3 agent node and add the conntrack_helper plug-in configuration item to the l3_agent.ini configuration file; (3) After modifying the configuration, restart all modified nodes to make the configuration take effect.

4. According to a method for implementing a seven-layer NAT based on an openstack platform according to claim 3, it is characterized in that: The steps to configure the conntrack_helper module are as follows: (1) The conntrack_helper plug-in provided by neutron provides the conntrack_helper operation interface to the outside world, and performs creation and deletion operations through the API interface; (2) Parameters required when calling the interface; (3) After receiving the API request, the conntrack_helper server sends the relevant configuration to the agent. After receiving the configuration, the agent calls iptables to successfully configure the raw table.

5. According to a method for implementing a seven-layer NAT based on an openstack platform according to claim 4, it is characterized in that: The parameters required for the interface call include the protocol type, protocol port number, and the virtual router ID of the intranet network where the intranet virtual machine is located. The FTP protocol encapsulation parameters are as follows: {"conntrack_helper":{"helper":"ftp","protocol":"tcp","port":"21"},"router_id":"4f3dfff3-49fd-4faf-b00b-b3066e26161c"}.

6. According to a method for implementing a seven-layer NAT based on an openstack platform according to claim 5, it is characterized in that: The agent receives the configuration and calls iptables to successfully configure the raw table. After the configuration is successful, the following is displayed: -A neutron-l3-agent-cth-546e839-p tcp-m tcp--dport 20 -j CT --helper ftp -A neutron-l3-agent-cth-7d85451-p tcp-m tcp--dport 21 -j CT --helper ftp.

7. A method for implementing a seven-layer NAT based on an openstack platform according to claim 6, characterized in that: The virtual router configuration has the following steps: (1) Find the virtual router ID of the intranet where the intranet server is located, enter the namespace to modify the configuration: ipnetns exec qrouter-4f3dfff3-49fd-4faf-b00b-b3066e26161c bash; (2) Modify the nf_conntrack_helper kernel parameters: echo 1> / proc / sys / net / netfilter / nf_conntrack_helper; (3) Manually load the nf_nat_ftp module: modprobe nf_nat_ftp.

8. The method for implementing layer 7 NAT based on openstack platform according to claim 7, characterized in that: The intranet address of the FTP server is 172.31.100.53, and the bound FIP address is 100.148.2.

132. When the external network accesses the intranet, the packet capture analysis on qrouter shows that after the conntrack_helper function module is enabled, the IP layer intranet address 172.31.100.53 is converted to the FIP address 100.148.2.132, and the IP address in the application layer data is also converted from the intranet address to the FIP address. The function configuration is successful. When the external network accesses the intranet FTP server, the correct control channel and data channel can be established to complete the access to the intranet FTP service.

9. A seven-layer NAT device based on the openstack platform, characterized in that: include: at least one memory and at least one processor; The at least one memory is used to store a machine-readable program; The at least one processor is configured to call the machine-readable program to execute the method according to any one of claims 1 to 8.

Images