Method, device, computer equipment and storage medium for adding EIP to NAT rule

Abstract

The present application relates to a method, device, computer equipment and storage medium for adding a new EIP to a NAT rule. The method includes: binding the target EIP to the NAT rule corresponding to the grayscale egress gateway, wherein the NAT rule corresponding to the grayscale egress gateway only binds the target EIP, so that when accessing any external partner through the grayscale egress gateway, only the target EIP is used to access any of the above external partners; distributing some requests from the intranet area corresponding to each external partner to the grayscale egress gateway to access each external partner through the grayscale egress gateway; verifying whether the target EIP is included in the whitelist of each external partner based on the feedback information of each external partner to the grayscale egress gateway; in response to all external partners passing the verification, binding the target EIP to the target NAT rule. The embodiment of the present application can smoothly and efficiently add EIP to the NAT rule, reducing the impact on the business.

Description

Technical Field

[0001] The present application relates to the computer field, and in particular to a method, apparatus, computer equipment and storage medium for adding an EIP to a NAT rule. Background Art

[0002] In order to ensure network security in the production environment, it is generally divided into at least an intranet area and an extranet area. The intranet cannot directly access the Internet, but the extranet area can directly access the Internet. If the intranet service accesses the extranet, it generally accesses the Internet by accessing the proxy gateway service deployed in the extranet area. The proxy gateway service is usually called an egress gateway, and is generally installed with proxy software such as Nginx (engine x) and OpenResty.

[0003] When an egress gateway requests the Internet, it will be forwarded to the corresponding fixed NAT (Network Address Translation) rule through the routing table, and then access the Internet through the EIP bound to the NAT rule. Specifically, when requesting an external partner, the external partner will obtain the requested EIP for IP whitelist verification.

[0004] Considering that one or some EIPs (Elastic IP Address) may be blocked by network operators by mistake, multiple EIPs are usually bound to NAT rules to achieve high availability of the export. In order for the newly added EIP to pass the whitelist verification of each external partner, it is necessary to notify each external partner to add the new EIP to its whitelist when adding a new EIP. However, the timeliness of adding whitelists by each external partner varies greatly. The new EIP must be bound to the NAT rule only after all external partners have added the new EIP and it takes effect.

[0005] When adding an EIP to a NAT rule, it is very dependent on the time it takes for an external partner to add it. This takes a long time and is inconvenient to verify whether the new EIP is effective. Therefore, the current method of adding an EIP has a great impact on the business and is high risk. Summary of the invention

[0006] In view of the above-mentioned deficiencies or shortcomings, the present application provides a method, apparatus, computer device and storage medium for adding a new EIP to a NAT rule. The embodiments of the present application can smoothly and efficiently add a new EIP to a NAT rule, reducing the impact on the business.

[0007] According to a first aspect, the present application provides a method for adding an EIP to a NAT rule. In one embodiment, the method includes:

[0008] Bind the target EIP to the NAT rule corresponding to the grayscale egress gateway, wherein the NAT rule corresponding to the grayscale egress gateway only binds the target EIP, so that when accessing any external partner through the grayscale egress gateway, only the target EIP is used to access any of the above external partners; the target EIP refers to the EIP that needs to be bound to the target NAT rule; distribute some requests from the intranet area corresponding to each external partner to the grayscale egress gateway to access each external partner through the grayscale egress gateway; verify whether the whitelist of each external partner contains the target EIP based on the feedback information of each external partner to the grayscale egress gateway; in response to all external partners passing the verification, bind the target EIP to the target NAT rule.

[0009] In some embodiments, the above method further includes: configuring corresponding gateway configuration information for each external partner; the gateway configuration information includes an egress traffic ratio configuration.

[0010] In some embodiments, the partial requests from the intranet zone corresponding to each external partner are distributed to the grayscale egress gateway, including:

[0011] The traffic distribution gateway pulls the gateway configuration information corresponding to each external partner, and distributes part of the requests from the intranet area corresponding to each external partner to the grayscale export gateway according to the export traffic ratio configuration of each external partner.

[0012] In some embodiments, the above method further includes: determining the number of EIPs supported by each external partner for access; and adjusting the egress traffic ratio configuration of each external partner according to the number of EIPs supported by each external partner for access.

[0013] In some embodiments, the feedback information from any external partner to the grayscale egress gateway includes feedback information from any external partner to each request to access any external partner through the grayscale egress gateway, and the feedback information includes return content and / or HTTP response code.

[0014] In some embodiments, the operation of verifying whether the whitelist of any external partner includes the target EIP according to the feedback information of any external partner to the grayscale egress gateway includes:

[0015] Determine the request result of each request to access any of the external partners through the grayscale egress gateway according to the feedback information of any external partner to the grayscale egress gateway;

[0016] When the result of each request to access any of the above external partners through the Grayscale egress gateway is a request failure, it is determined that any of the above external partners cannot pass the verification;

[0017] When the request result of any request to access any of the above-mentioned external partners through the grayscale export gateway is a successful request, it is determined that any of the above-mentioned external partners has passed the verification.

[0018] In some embodiments, the above method also includes: before binding the target EIP to the NAT rule corresponding to the grayscale egress gateway, creating a grayscale egress gateway and a NAT rule corresponding to the grayscale egress gateway; after binding the target EIP to the target NAT rule, deleting the grayscale egress gateway.

[0019] According to a second aspect, the present application provides a device for adding an EIP to a NAT rule. In one embodiment, the device includes:

[0020] The first binding module is used to bind the target EIP to the NAT rule corresponding to the grayscale egress gateway, wherein the NAT rule corresponding to the grayscale egress gateway only binds the target EIP, so that when accessing any external partner through the grayscale egress gateway, only the target EIP is used to access any external partner; the target EIP refers to the EIP that needs to be bound to the target NAT rule;

[0021] The distribution module is used to distribute some requests from the intranet area corresponding to each external partner to the grayscale egress gateway, so as to access each external partner through the grayscale egress gateway;

[0022] The verification module is used to verify whether the target EIP is included in the whitelist of each external partner based on the feedback information of each external partner on the grayscale egress gateway;

[0023] The second binding module is configured to bind the target EIP to the target NAT rule in response to all external partners passing the verification.

[0024] According to a third aspect, the present application provides a computer device, including a memory, a processor, and a computer program stored in the memory and executable on the processor, wherein the processor implements the steps of any of the above method embodiments when executing the computer program.

[0025] According to a fourth aspect, the present application provides a computer-readable storage medium on which a computer program is stored. When the computer program is executed by a processor, the steps of an embodiment of any of the above methods are implemented.

[0026] In an embodiment of the present application, by binding the target EIP to the NAT rule corresponding to the grayscale egress gateway, wherein the NAT rule corresponding to the grayscale egress gateway only binds the target EIP, so that when accessing any external partner through the grayscale egress gateway, only the target EIP is used to access any of the above external partners; distribute some requests from the intranet area corresponding to each external partner to the grayscale egress gateway to access each external partner through the grayscale egress gateway; verify whether the target EIP is included in the whitelist of each external partner based on the feedback information of each external partner to the grayscale egress gateway; in response to all external partners passing the verification, bind the target EIP to the target NAT rule. The embodiment of the present application can smoothly and efficiently add EIPs to NAT rules, reducing the impact on the business. BRIEF DESCRIPTION OF THE DRAWINGS

[0027] Figure 1 is an exemplary flow chart of a method for adding a new EIP to a NAT rule in one embodiment;

[0028] Figure 2 This is an exemplary application environment diagram of a method for adding an EIP to a NAT rule in an embodiment;

[0029] Figure 3 An exemplary schematic diagram of gateway configuration information in one embodiment;

[0030] Figure 4 is an exemplary structural block diagram of a device for adding an EIP to a NAT rule in one embodiment;

[0031] Figure 5 FIG. 4 is a diagram showing an exemplary internal structure of a computer device in one embodiment. DETAILED DESCRIPTION

[0032] In order to make the purpose, technical solution and advantages of the present application more clearly understood, the present application is further described in detail below in conjunction with the accompanying drawings and embodiments. It should be understood that the specific embodiments described herein are only used to explain the present application and are not used to limit the present application.

[0033] As mentioned above, the intranet cannot directly access the Internet, but needs to access the Internet through the egress gateway. When the egress gateway requests the Internet, it will be forwarded to the corresponding fixed NAT through the routing table, and then access the Internet through the EIP bound to the NAT rule. Since the external partner will perform whitelist verification on the requested EIP, when you need to add a new EIP to the NAT rule, you need to ask the external partner to add the new EIP to the whitelist first, so that when you use the new EIP to access the external partner, it can pass the external partner's whitelist verification. However, the timeliness of adding whitelists to different external partners varies greatly. When the number of external partners is large, the operation of adding a new EIP to the NAT rule will be very dependent on the time of adding the external partner, which will increase the cycle of adding EIPs and cannot easily verify whether the new EIP has been successfully added to the external partner's whitelist.

[0034] To this end, the present application provides a method for adding an EIP to a NAT rule. In one embodiment, the method includes: Figure 1 The steps shown below are combined with Figure 2 The exemplary application environment of the above method is shown to illustrate the above method.

[0035] The above method includes steps S110-S140.

[0036] S110: Bind the target EIP to the NAT rule corresponding to the grayscale egress gateway, wherein the NAT rule corresponding to the grayscale egress gateway only binds the target EIP, so that when accessing any external partner through the grayscale egress gateway, only the target EIP is used to access any of the above external partners.

[0037] When a new EIP, that is, an EIP that has never been bound to any NAT rule (hereinafter referred to as the target EIP) needs to be bound to a NAT rule (hereinafter referred to as the target NAT rule), the new EIP is first bound to the grayscale egress gateway. Among them, the grayscale egress gateway is also an egress gateway. The difference between it and the ordinary egress gateway is that the grayscale egress gateway is only used when a new EIP needs to be added. Generally, there is no grayscale egress gateway. Therefore, before binding the target EIP to the NAT rule corresponding to the grayscale egress gateway, the grayscale egress gateway and the NAT rule corresponding to the grayscale egress gateway can be created, and after binding the target EIP to the target NAT rule, the grayscale egress gateway is deleted. This embodiment does not specifically limit the NAT rule, for example, it can be an iptables rule in the Linux system.

[0038] In order to prevent EIP from being blocked by network operators by mistake, multiple EIPs will be bound to the NAT rule. When the request of the egress gateway is forwarded to the NAT rule, one EIP will be selected from the bound multiple EIPs to access the external partner. In order to more conveniently verify whether the external partner has successfully added the target EIP to its whitelist, this embodiment only binds the target EIP to the NAT rule corresponding to the grayscale egress gateway, so that when accessing any external partner through the grayscale egress gateway, only the target EIP is used to access any external partner.

[0039] S120: Distribute some requests from the intranet area corresponding to each external partner to the grayscale egress gateway, so as to access each external partner through the grayscale egress gateway.

[0040] On the basis that the NAT rule corresponding to the grayscale egress gateway only binds the target EIP, some requests from external partners are distributed to the grayscale egress gateway to access the external partners. This helps to quickly verify whether the external partners have successfully added the target EIP. In addition, during implementation, only a small number of requests can be distributed to the grayscale egress gateway. In this way, if the external partners fail to successfully add the target EIP, only a small number of requests will fail, minimizing the impact on the overall business.

[0041] For example, when each device in the intranet zone wants to access the Internet, it calls SLB, specifically sending the request to access the external partner (it should be understood that the external partners accessed by different devices can be different) to SLB (Server Load Balance), and then SLB distributes the received requests evenly to each traffic distribution gateway ( Figure 2 Only one is shown in the figure), each traffic distribution gateway forwards the request to each group of egress gateways under its control according to the pulled gateway configuration information.

[0042] S130: Verify whether the target EIP is included in the whitelist of each external partner based on the feedback information of each external partner to the grayscale egress gateway.

[0043] Among them, the feedback information of any external partner to the grayscale export gateway includes the feedback information of any of the above-mentioned external partners for each request to access any of the above-mentioned external partners through the grayscale export gateway, and the feedback information includes the return content and / or HTTP (Hyper Text Transfer Protocol) response code.

[0044] S140: In response to all external partners passing the verification, the target EIP is bound to the target NAT rule.

[0045] After ensuring that all external partners have passed verification, you can bind the target EIP to the target NAT rule.

[0046] In this embodiment, the target EIP is bound to the NAT rule corresponding to the grayscale egress gateway, wherein the NAT rule corresponding to the grayscale egress gateway is only bound to the target EIP, so that when accessing any external partner through the grayscale egress gateway, only the target EIP is used to access the above-mentioned external partner; some requests from the intranet area corresponding to each external partner are distributed to the grayscale egress gateway to access each external partner through the grayscale egress gateway; based on the feedback information of each external partner to the grayscale egress gateway, it is verified whether the whitelist of each external partner contains the target EIP; in response to all external partners passing the verification, the target EIP is bound to the target NAT rule, so that the EIP can be added to the NAT rule smoothly and efficiently, and the impact on the business can be minimized.

[0047] In one embodiment, part of the requests from the intranet area corresponding to each external partner are distributed to the grayscale egress gateway, including: pulling the gateway configuration information corresponding to each external partner through the traffic distribution gateway, and distributing part of the requests from the intranet area corresponding to each external partner to the grayscale egress gateway according to the egress traffic ratio configuration of each external partner.

[0048] Among them, before distributing part of the requests from the intranet area corresponding to each external partner to the grayscale export gateway, the above method also includes: configuring corresponding gateway configuration information for each external partner; the gateway configuration information includes export traffic ratio configuration.

[0049] For example, the gateway configuration information configured for the external partner can be found in Figure 3 The figure shows the gateway configuration information of two external partners, namely "egress_httpbin" and "egress_test". The gateway configuration information includes at least the following fields:

[0050] "context" indicates the export alias, which is the unique identifier of the external partner;

[0051] "egressNatList" indicates the egress traffic ratio configuration, which is used to control the traffic of each egress. For example, if the egress traffic ratio of the external partner "egress_httpbin" is configured as "nat01:50, nat02:100", then 1 / 3 of the requests to access "egress_httpbin" in the intranet zone will be distributed to NAT rule nat01, and 2 / 3 will be distributed to NAT rule nat02;

[0052] "exposeProtocol", which indicates the export protocol;

[0053] "hosts" indicates the forwarded domain name list;

[0054] "eipCheck" is an indicator used to indicate whether the external partner verifies the IP whitelist;

[0055] "ibType" indicates the load balancing type.

[0056] Among them, the gateway configuration information of each external partner can be configured by the system operation and maintenance personnel or network engineers through the gateway configuration application, and the configuration can be adjusted in real time according to actual needs. The traffic distribution gateway and each egress gateway can dynamically pull the gateway configuration information of all external partners from the gateway configuration application at any time. It should be noted that the traffic distribution gateway and the egress gateway are the same application, for example, both are openresty. The difference between the two is that the forwarding logic of the traffic distribution gateway is to forward according to the nat ratio of the egressNatList, while the forwarding logic of the egress gateway is to forward according to the hosts list.

[0057] Furthermore, the traffic distribution gateway and the egress gateway can dynamically pull the gateway configuration information of the external partner. Specifically, taking openresty as an example, you can use the http client tool class of the lua script to initiate an http request to the gateway configuration application to pull.

[0058] In one embodiment, the above method further includes: determining the number of EIPs supported by each external partner for access; and adjusting the egress traffic ratio configuration of each external partner according to the number of EIPs supported by each external partner for access.

[0059] In actual scenarios, some external partners only support the configuration of a few (for example, 3) IP whitelists, but the requester's NAT rule has been bound to multiple (greater than 3) EIPs. The traditional processing method is to create a new egress gateway and its corresponding NAT rule, and bind a few EIPs to the new NAT rule. However, this processing method requires the establishment of a separate egress proxy, which is not conducive to the rectification of egress gateway management.

[0060] For the above-mentioned shortcomings, this embodiment can adjust the export traffic ratio configuration of the relevant external partners (referring to the external partners that do not support multiple EIP accesses), for example, Figure 2 As shown in , assume that there are three NAT rules, nat01, nat02, and nat03. If the external partner "egress_httpbin" only supports the EIP bound to nat01, then the egress traffic ratio configuration can be configured as nat01:100, nat02:0, nat03:0, thereby specifying the egress EIP.

[0061] In one embodiment, an operation of verifying whether a target EIP is included in the whitelist of any external partner is performed based on feedback information from any external partner to the grayscale egress gateway, including: determining a request result of each request to access any of the external partners through the grayscale egress gateway based on feedback information from any external partner to the grayscale egress gateway; when a request result of each request to access any of the external partners through the grayscale egress gateway is a request failure, determining that any of the external partners cannot pass the verification; when a request result of any request to access any of the external partners through the grayscale egress gateway is a request success, determining that any of the external partners has passed the verification.

[0062] For example, see Figure 2 , assuming that EIP5 is to be bound to NAT rule 1, since the traffic through NAT rule 1 may access multiple external partners, the EIP used to access external partners is completely random. If EIP5 is bound to NAT rule 1 rashly, then if the external partner does not add EIP5 to the whitelist, the request will fail. Therefore, EIP5 can be bound to NAT rule 3 first. By controlling the nat03 ratio of each external partner's egressNatList configuration, a small amount of traffic (i.e., grayscale traffic) is directed to the grayscale egress gateway (egress 3). By observing the http return content and http response code (non-200) after the grayscale traffic requests the external partner, it can be determined whether the external partner has really added the EIP. If the external partner does not configure the EIP5 whitelist, all requests through the grayscale egress gateway will fail, which can be easily found through the monitoring dashboard or log of the grayscale egress gateway. Therefore, the method provided in this embodiment can quickly promote the progress of adding EIPs, and this operation method of adding EIPs has little impact on the business.

[0063] It should be noted that, with respect to the various steps included in the method for adding an EIP to a NAT rule provided in any of the above embodiments, unless otherwise specified in this document, there is no strict order restriction on the execution of these steps, and these steps can be executed in other orders. Moreover, at least a part of these steps can include multiple sub-steps or multiple stages, and these sub-steps or stages are not necessarily executed at the same time, but can be executed at different times. The execution order of these sub-steps or stages is not necessarily sequential, but can be executed in turn or alternately with other steps or at least a part of the sub-steps or stages of other steps.

[0064] Based on the same inventive concept, the present application also provides a device for adding an EIP to a NAT rule. Figure 4 As shown, the device for adding an EIP to a NAT rule includes the following modules:

[0065] The first binding module 110 is used to bind the target EIP to the NAT rule corresponding to the grayscale egress gateway, wherein the NAT rule corresponding to the grayscale egress gateway only binds the target EIP, so that when accessing any external partner through the grayscale egress gateway, only the target EIP is used to access any external partner; the target EIP refers to the EIP that needs to be bound to the target NAT rule;

[0066] The distribution module 120 is used to distribute the partial requests from the intranet area corresponding to each external partner to the grayscale egress gateway, so as to access each external partner through the grayscale egress gateway;

[0067] The verification module 130 is used to verify whether the target EIP is included in the whitelist of each external partner according to the feedback information of each external partner to the grayscale egress gateway;

[0068] The second binding module 140 is configured to bind the target EIP to the target NAT rule in response to all external partners passing the verification.

[0069] In some embodiments, the above apparatus further includes a configuration module.

[0070] The configuration module is used to configure corresponding gateway configuration information for each external partner; the gateway configuration information includes the egress traffic ratio configuration.

[0071] In some embodiments, the distribution module is specifically used to pull the gateway configuration information corresponding to each external partner through the traffic distribution gateway, and distribute part of the requests from the intranet area corresponding to each external partner to the grayscale export gateway according to the export traffic ratio configuration of each external partner.

[0072] In some embodiments, the above apparatus further comprises:

[0073] The EIP quantity determination module is used to determine the number of EIPs that each external partner supports access to;

[0074] The configuration adjustment module is used to adjust the egress traffic ratio configuration of each external partner according to the number of EIPs supported by each external partner.

[0075] In some embodiments, the feedback information from any external partner to the grayscale egress gateway includes feedback information from any external partner to each request to access any external partner through the grayscale egress gateway, and the feedback information includes return content and / or HTTP response code.

[0076] In some embodiments, when the verification module verifies whether the target EIP is included in the whitelist of any external partner according to the feedback information of any external partner to the grayscale egress gateway, it is specifically used to:

[0077] Determine the request result of each request to access any of the external partners through the grayscale egress gateway according to the feedback information of any external partner to the grayscale egress gateway;

[0078] When the result of each request to access any of the above external partners through the Grayscale egress gateway is a request failure, it is determined that any of the above external partners cannot pass the verification;

[0079] When the request result of any request to access any of the above-mentioned external partners through the grayscale export gateway is a successful request, it is determined that any of the above-mentioned external partners has passed the verification.

[0080] In some embodiments, the above apparatus further comprises:

[0081] A creation module is used to create a grayscale egress gateway and a NAT rule corresponding to the grayscale egress gateway before binding the target EIP to the NAT rule corresponding to the grayscale egress gateway;

[0082] The deletion module is used to delete the grayscale egress gateway after binding the target EIP to the target NAT rule.

[0083] For the specific limitations of the device for adding a new EIP to the NAT rule, please refer to the limitations of the method for adding a new EIP to the NAT rule above, which will not be repeated here. Each module in the above-mentioned device for adding a new EIP to the NAT rule can be implemented in whole or in part by software, hardware and a combination thereof. The above-mentioned modules can be embedded in or independent of the processor in the computer device in the form of hardware, or can be stored in the memory of the computer device in the form of software, so that the processor can call and execute the operations corresponding to the above modules.

[0084] In one embodiment, a computer device is provided, whose internal structure diagram can be as follows: Figure 5 shown.

[0085] The computer device includes a processor, a memory, a network interface and a database connected through a system bus. Among them, the processor of the computer device is used to provide computing and control capabilities. The memory of the computer device includes a non-volatile storage medium and an internal memory. The non-volatile storage medium stores an operating system, a computer program and a database. The internal memory provides an environment for the operation of the operating system and the computer program in the non-volatile storage medium. The database of the computer device is used to store data such as information on EIP and NAT rules. The specific stored data can also refer to the definition in the above method embodiment. The network interface of the computer device is used to communicate with an external terminal through a network connection. When the computer program is executed by the processor, a method for adding an EIP to a NAT rule is implemented.

[0086] Those skilled in the art will understand that Figure 5 The structure shown in the figure is only a block diagram of a part of the structure related to the solution of the present application, and does not constitute a limitation on the computer device to which the solution of the present application is applied. The specific computer device may include more or fewer components than those shown in the figure, or combine certain components, or have a different arrangement of components.

[0087] This embodiment further provides a computer device, including a memory, a processor, and a computer program stored in the memory and executable on the processor. When the processor executes the computer program, the following steps are implemented:

[0088] Bind the target EIP to the NAT rule corresponding to the grayscale egress gateway, wherein the NAT rule corresponding to the grayscale egress gateway only binds the target EIP, so that when accessing any external partner through the grayscale egress gateway, only the target EIP is used to access any of the above external partners; the target EIP refers to the EIP that needs to be bound to the target NAT rule; distribute some requests from the intranet area corresponding to each external partner to the grayscale egress gateway to access each external partner through the grayscale egress gateway; verify whether the whitelist of each external partner contains the target EIP based on the feedback information of each external partner to the grayscale egress gateway; in response to all external partners passing the verification, bind the target EIP to the target NAT rule.

[0089] In one embodiment, the processor executes the computer program to further implement the following steps: configuring corresponding gateway configuration information for each external partner; the gateway configuration information includes an egress traffic ratio configuration.

[0090] In one embodiment, when the processor executes the computer program to distribute part of the requests from the intranet area corresponding to each external partner to the grayscale egress gateway, the processor also implements the following steps:

[0091] The traffic distribution gateway pulls the gateway configuration information corresponding to each external partner, and distributes part of the requests from the intranet area corresponding to each external partner to the grayscale export gateway according to the export traffic ratio configuration of each external partner.

[0092] In one embodiment, the processor executes the computer program to further implement the following steps:

[0093] Determine the number of EIPs that each external partner supports access to; adjust the egress traffic ratio configuration for each external partner based on the number of EIPs that each external partner supports access to.

[0094] In one embodiment, when the processor executes a computer program to implement an operation of verifying whether the target EIP is included in the whitelist of any external partner according to feedback information of any external partner to the grayscale egress gateway, the processor also implements the following steps:

[0095] The request result of each request for accessing any of the above-mentioned external partners through the grayscale exit gateway is determined based on the feedback information from any external partner to the grayscale exit gateway; when the request result of each request for accessing any of the above-mentioned external partners through the grayscale exit gateway is a request failure, it is determined that any of the above-mentioned external partners cannot pass the verification; when the request result of any request for accessing any of the above-mentioned external partners through the grayscale exit gateway is a request success, it is determined that any of the above-mentioned external partners has passed the verification.

[0096] In one embodiment, the processor executes the computer program to further implement the following steps:

[0097] Before binding the target EIP to the NAT rule corresponding to the grayscale egress gateway, create the grayscale egress gateway and the NAT rule corresponding to the grayscale egress gateway; after binding the target EIP to the target NAT rule, delete the grayscale egress gateway.

[0098] In one embodiment, a computer readable storage medium is provided, on which a computer program is stored, and when the computer program is executed by a processor, the following steps are implemented:

[0099] Bind the target EIP to the NAT rule corresponding to the grayscale egress gateway, wherein the NAT rule corresponding to the grayscale egress gateway only binds the target EIP, so that when accessing any external partner through the grayscale egress gateway, only the target EIP is used to access any of the above external partners; the target EIP refers to the EIP that needs to be bound to the target NAT rule; distribute some requests from the intranet area corresponding to each external partner to the grayscale egress gateway to access each external partner through the grayscale egress gateway; verify whether the whitelist of each external partner contains the target EIP based on the feedback information of each external partner to the grayscale egress gateway; in response to all external partners passing the verification, bind the target EIP to the target NAT rule.

[0100] In one embodiment, the computer program is executed by a processor to further implement the following steps: configuring corresponding gateway configuration information for each external partner; the gateway configuration information includes an egress traffic ratio configuration.

[0101] In one embodiment, the computer program is executed by a processor to distribute the partial requests from the intranet area corresponding to each external partner to the grayscale egress gateway, and further implement the following steps:

[0102] The traffic distribution gateway pulls the gateway configuration information corresponding to each external partner, and distributes part of the requests from the intranet area corresponding to each external partner to the grayscale export gateway according to the export traffic ratio configuration of each external partner.

[0103] In one embodiment, the computer program is executed by a processor to further implement the following steps:

[0104] Determine the number of EIPs that each external partner supports access to; adjust the egress traffic ratio configuration for each external partner based on the number of EIPs that each external partner supports access to.

[0105] In one embodiment, the computer program is executed by a processor, and when verifying whether the whitelist of any external partner includes the target EIP according to the feedback information of any external partner to the grayscale egress gateway, the following steps are further implemented:

[0106] The request result of each request for accessing any of the above-mentioned external partners through the grayscale exit gateway is determined based on the feedback information from any external partner to the grayscale exit gateway; when the request result of each request for accessing any of the above-mentioned external partners through the grayscale exit gateway is a request failure, it is determined that any of the above-mentioned external partners cannot pass the verification; when the request result of any request for accessing any of the above-mentioned external partners through the grayscale exit gateway is a request success, it is determined that any of the above-mentioned external partners has passed the verification.

[0107] In one embodiment, the computer program is executed by a processor to further implement the following steps:

[0108] Before binding the target EIP to the NAT rule corresponding to the grayscale egress gateway, create the grayscale egress gateway and the NAT rule corresponding to the grayscale egress gateway; after binding the target EIP to the target NAT rule, delete the grayscale egress gateway.

[0109] Those skilled in the art can understand that all or part of the processes in the above method embodiments can be completed by instructing the relevant hardware through a computer program, and the computer program can be stored in a non-volatile computer-readable storage medium. When the computer program is executed, it can include the processes of the embodiments of the above methods. Among them, any reference to memory, storage, database or other media used in the embodiments provided in the present application can include non-volatile and / or volatile memory. Non-volatile memory can include read-only memory (ROM), programmable ROM (PROM), electrically programmable ROM (EPROM), electrically erasable programmable ROM (EEPROM) or flash memory. Volatile memory can include random access memory (RAM) or external cache memory. As an illustration and not limitation, RAM is available in many forms, such as static RAM (SRAM), dynamic RAM (DRAM), synchronous DRAM (SDRAM), double data rate SDRAM (DDRSDRAM), enhanced SDRAM (ESDRAM), synchronous link (Synchlink) DRAM (SLDRAM), memory bus (Rambus), direct RAM (RDRAM), direct memory bus dynamic RAM (DRDRAM), and memory bus dynamic RAM (RDRAM).

[0110] The technical features of the above embodiments may be combined arbitrarily. To make the description concise, not all possible combinations of the technical features in the above embodiments are described. However, as long as there is no contradiction in the combination of these technical features, they should be considered to be within the scope of this specification.

[0111] The above-mentioned embodiments only express several implementation methods of the present application, and the descriptions thereof are relatively specific and detailed, but they cannot be understood as limiting the scope of the invention patent. It should be pointed out that, for a person of ordinary skill in the art, several variations and improvements can be made without departing from the concept of the present application, and these all belong to the protection scope of the present application. Therefore, the protection scope of the patent of the present application shall be subject to the attached claims.

Claims

1. A method for adding an EIP to a NAT rule, characterized in that: The method comprises: Bind the target EIP to the NAT rule corresponding to the grayscale egress gateway, wherein the NAT rule corresponding to the grayscale egress gateway only binds the target EIP, so that when accessing any external partner through the grayscale egress gateway, only the target EIP is used to access any external partner; the target EIP refers to the EIP that needs to be bound to the target NAT rule; Distribute some requests from the intranet area corresponding to each external partner to the grayscale egress gateway, so as to access each external partner through the grayscale egress gateway; Verify whether the target EIP is included in the whitelist of each external partner according to the feedback information of each external partner on the grayscale egress gateway; In response to all external partners passing the verification, binding the target EIP to the target NAT rule; The feedback information of any external partner to the grayscale egress gateway includes the feedback information of any external partner to each request to access any external partner through the grayscale egress gateway, and the feedback information includes the return content and / or HTTP response code; The operation of verifying whether the whitelist of any external partner includes the target EIP according to the feedback information of any external partner to the grayscale egress gateway includes: Determine, according to feedback information from any external partner to the grayscale egress gateway, a request result of each request for accessing any external partner through the grayscale egress gateway; When the request result of each request to access any external partner through the grayscale egress gateway is a request failure, it is determined that any external partner cannot pass the verification; When the request result of any request to access any external partner through the grayscale export gateway is a success, it is determined that any external partner has passed the verification.

2. The method according to claim 1, characterized in that The method further comprises: Configure corresponding gateway configuration information for each external partner; the gateway configuration information includes egress traffic ratio configuration.

3. The method according to claim 2, characterized in that The distributing part of the requests from the intranet area corresponding to each external partner to the grayscale egress gateway includes: The traffic distribution gateway pulls the gateway configuration information corresponding to each external partner, and distributes part of the requests from the intranet area corresponding to each external partner to the grayscale export gateway according to the export traffic ratio configuration of each external partner.

4. The method according to claim 2, characterized in that The method further comprises: Determine the number of EIPs that each external partner can access; Adjust the egress traffic ratio configuration for each external partner based on the number of EIPs that each external partner supports access to.

5. The method according to claim 1, characterized in that The method further comprises: Before binding the target EIP to the NAT rule corresponding to the grayscale egress gateway, create the grayscale egress gateway and the NAT rule corresponding to the grayscale egress gateway; After binding the target EIP to the target NAT rule, deleting the grayscale egress gateway.

6. A device for adding an EIP to a NAT rule, characterized in that: The device comprises: A first binding module is used to bind a target EIP to a NAT rule corresponding to a grayscale egress gateway, wherein the NAT rule corresponding to the grayscale egress gateway only binds the target EIP, so that when accessing any external partner through the grayscale egress gateway, only the target EIP is used to access any external partner; the target EIP refers to an EIP that needs to be bound to the target NAT rule; A distribution module, used to distribute part of the requests from the intranet area corresponding to each external partner to the grayscale egress gateway, so as to access each external partner through the grayscale egress gateway; A verification module, used to verify whether the target EIP is included in the whitelist of each external partner according to the feedback information of each external partner to the grayscale egress gateway; A second binding module, configured to bind the target EIP to the target NAT rule in response to all external partners passing the verification; The feedback information of any external partner to the grayscale egress gateway includes the feedback information of any external partner to each request to access any external partner through the grayscale egress gateway, and the feedback information includes the return content and / or HTTP response code; The verification module verifies whether the whitelist of any external partner contains the target EIP according to the feedback information of any external partner to the grayscale egress gateway, including: Determine, according to feedback information from any external partner to the grayscale egress gateway, a request result of each request for accessing any external partner through the grayscale egress gateway; When the request result of each request to access any external partner through the grayscale egress gateway is a request failure, it is determined that any external partner cannot pass the verification; When the request result of any request to access any external partner through the grayscale export gateway is a success, it is determined that any external partner has passed the verification.

7. A computer device comprising a memory, a processor and a computer program stored in the memory and executable on the processor, characterized in that: When the processor executes the computer program, the steps of the method according to any one of claims 1 to 5 are implemented.

8. A computer-readable storage medium having a computer program stored thereon, characterized in that: When the computer program is executed by a processor, the steps of the method according to any one of claims 1 to 5 are implemented.

Images