A website access method and system during website IPv6 transformation

Abstract

The present invention discloses a website access method and system during the website IPv6 transformation process, wherein the system includes an address pool and a protocol conversion device, the address pool and the protocol conversion device are communicatively connected; and a user accesses an IPv4 website through the protocol conversion device. The present invention achieves the purpose of multiple websites flexibly using multiple operator address spaces to perform parallel IPv6 upgrades through multiple different network exits through target address conversion, virtual address, reverse proxy, and source-in and source-out strategy combinations, and also achieves the normal access of users to IPv4 websites through routes provided by different operators during the website IPv6 transformation process.

Description

Technical Field

[0001] The present invention relates to the field of network technology, in particular to a website access method and system during the website IPv6 transformation process. Background Art

[0002] The complete upgrade of website IPv6 is a long and complex process, including the transformation of network, server, security and other infrastructure, application system, support system and other contents. The most complex part is the logic of website business application coding needs to be reorganized. Because the complete transformation of website IPv6 has problems such as long cycle, high cost and high risk, all units generally adopt network transition technology to realize website IPv6 upgrade.

[0003] IPv4 and IPv6 are incompatible network layer protocols. Due to the exhaustion of IPv4 addresses and the advancement of IPv6, the transition from IPv4 to IPv6 is imperative. IPv6 transition technology refers to the technology that can ensure the coexistence and interoperability of IPv4 and IPv6 networks, applications and terminals during the upgrade process from IPv4 to IPv6. The transition from IPv4 to IPv6 is not a one-time thing, but is gradually achieved through the upgrade and evolution of technology on the basis of the normal operation of the network system and the unaffected business carrying capacity. IPv4-IPv6 reverse proxy technology is the current mainstream website IPv6 upgrade technology. Its basic implementation method is to deploy a reverse proxy device between IPv6 users and IPv4 websites to enable websites to support IPv6 users to access.

[0004] The traditional method of upgrading websites to IPv6 through reverse proxy has certain limitations. It usually uses the server interface IPv6 address to proxy IPv4 websites, and generally adopts a single network export method. As a result, application scenarios such as parallel upgrading of multiple websites, publishing access control, and converting and publishing multiple operators' IPv6 addresses for a single website are complex and difficult to implement. Summary of the invention

[0005] To this end, the technical problem to be solved by the present invention is to provide a website access method and system during the website IPv6 transformation process. Through the combination of target address translation, virtual address, reverse proxy and source-in and source-out strategies, the purpose of multiple websites flexibly using multiple operator address spaces to perform parallel IPv6 upgrades through multiple different network exits is achieved, and the normal access of users to IPv4 websites through routes provided by different operators during the website IPv6 transformation process is also achieved.

[0006] In order to solve the above technical problems, the present invention provides the following technical solutions:

[0007] A website access method during the website IPv6 transformation process includes the following steps:

[0008] S1) randomly selecting an IPv6 address from the address pool of the website IPv6 upgrade conversion as the IPv6 address published when the website IPv6 agent is upgraded, wherein the address pool of the website IPv6 upgrade conversion is any IPv6 service address space routed to the protocol conversion device by multiple operators;

[0009] S2) performing target address mapping of the IPv6 address selected in step S1) and the listening address of the protocol conversion device, wherein the listening address of the protocol conversion device is the IPv6 ULA address configured by the LOOPBACK virtual network card of the protocol conversion device, the target server represented by the protocol conversion device is an IPv4 website, and the access source address obtained by tracing the source of the protocol conversion device is the real IPv6 address of the user; wherein the IPv6 ULA is a private IPv6 address and can only be used in the intranet. The address is not routed on the IPv6 public network, and therefore cannot directly access the public network;

[0010] S3) establishing a mapping relationship between the IPv4 website domain name represented by the protocol conversion device and the IPv6 ULA address, and locking an independent translation conversion rule by accurately configuring the target conversion address / port before and after the conversion, wherein the IPv6 ULA address is randomly generated on the LOOPBACK virtual network card;

[0011] S4) The website returns response data through the user access request routing.

[0012] In the above method, in step S1), the IPv6 service address spaces of different operators are routed to different and interconnected interface addresses of the protocol conversion device.

[0013] In the above method, in step S2), the IPv6 address selected in step S1) is used as the target address before conversion, and the target address conversion is performed on the IPv6 address, and the target address after conversion is the IPv6 ULA address monitored by the protocol conversion device.

[0014] In the above method, in step S3), each time a new translation conversion rule is added, a 128-bit prefix IPv6 ULA address is randomly generated on LOOPBACK, and the IPv6 ULA address is specified to be uniquely applied to a reverse proxy service of a specified IPv4 website domain name, and the website publishing port is controlled by configuring the conversion target address plus the port.

[0015] In the above method, in step S1), the number of publishing addresses belonging to different operators that can be added to the same website is greater than or equal to 2.

[0016] In the above method, in step S3), when multiple websites publish IPv6 addresses in parallel, a corresponding number of random IPv6 ULA addresses are generated on LOOPBACK, each IPv6 ULA address corresponds to a website, and target address mappings are established one by one with the published IPv6 addresses, and reverse proxy relationships are established one by one with the website domain names.

[0017] The above method further includes:

[0018] S5) One-click start and stop of website translation service is achieved by deleting and re-adding translation conversion rules.

[0019] The system for accessing an IPv4 website by using the website access method in the process of IPv6 transformation of the website comprises:

[0020] An address pool is used to randomly select an IPv6 address when the website IPv6 conversion is upgraded as the IPv6 address published when the website IPv6 agent is upgraded, wherein the address pool for website IPv6 upgrade conversion is any IPv6 service address space routed to the protocol conversion device by multiple operators;

[0021] A protocol conversion device, used to provide reverse proxy services; the protocol conversion device includes a target address conversion module, a translation conversion module and a LOOPBACK virtual network card, wherein the target address conversion module is used to map the selected IPv6 address to the reverse proxy device listening address, the translation conversion module is used to establish a mapping relationship between the IPv4 website represented by the protocol conversion device and the IPv6 ULA address, and the LOOPBACK virtual network card is used to configure the IPv6 ULA address;

[0022] The address pool is communicatively connected to the protocol conversion device; the user accesses the IPv4 website through the protocol conversion device.

[0023] In the above system, IPv6 service address spaces of different operators are routed to different and interconnected interface addresses of the protocol conversion device.

[0024] In the above system, the number of publishing addresses belonging to different operators that can be added to the same website is greater than or equal to 2.

[0025] The technical solution of the present invention achieves the following beneficial technical effects:

[0026] The present invention comprehensively applies the combined method of NAT66 target address translation, virtual address, reverse proxy, and source-in and source-out routing strategies, realizes the purpose of multiple websites flexibly using multiple operator address spaces to perform parallel IPv6 upgrades through multiple different network exits, and can effectively control the release strategy and realize one-key rapid start and stop translation services, with clearer configuration, more convenient operation, more convenient management, more accurate tracing, more flexible use, and more practical scenarios. The method is more suitable for operating website IPv6 translation and conversion cloud service business or large enterprise network multi-website parallel IPv6 conversion and upgrade business, and can make full use of IPv6 massive address space to provide different service addresses for different applications. BRIEF DESCRIPTION OF THE DRAWINGS

[0027] Figure 1 This is a working principle diagram of the website access system during the website IPv6 transformation process in the present invention;

[0028] Figure 2 A flowchart of implementing IPv4 website access during website IPv6 transformation in the present invention;

[0029] Figure 3 A routing relationship diagram between the IPv6 service address space and the interconnection interface address published by the IPv4 website during the IPv6 proxy upgrade;

[0030] Figure 4 A schematic diagram of a protocol conversion device performing target address conversion;

[0031] Figure 5 Form a flow chart for the mapping relationship between the publishing address, port and domain name information;

[0032] Figure 6 This is a schematic diagram of the source-in and source-out of request and return data packets when a user accesses an IPv4 website through a protocol conversion device. DETAILED DESCRIPTION

[0033] The present invention is further described below with reference to examples.

[0034] like Figure 1As shown, a system for accessing an IPv4 website using the website access method during the above-mentioned website IPv6 transformation process includes an address pool and a protocol conversion device, and the address pool and the protocol conversion device are in communication connection; the user accesses the IPv4 website through the protocol conversion device. In this embodiment, the address pool is used to randomly select an IPv6 address when the website IPv6 conversion is upgraded as the IPv6 address published when the website IPv6 agent is upgraded, wherein the address pool converted by the website IPv6 upgrade is any IPv6 service address space routed to the protocol conversion device by multiple operators; the protocol conversion device is used to provide reverse proxy services; the protocol conversion device includes a target address conversion module, a translation conversion module and a LOOPBACK virtual network card, wherein the target address conversion module is used to map the selected IPv6 address to the reverse proxy device listening address for the target address, the translation conversion module is used to establish a mapping relationship between the proxy domain name and the IPv6 ULA address, and the LOOPBACK virtual network card is used to configure the IPv6 ULA address.

[0035] like Figure 2 As shown, when a user uses the system to access an IPv4 website, an access path should be constructed first, and then the IPv4 website is accessed through the path. The specific steps are as follows:

[0036] S1) Randomly select an IPv6 address from the website IPv6 upgrade conversion address pool as the IPv6 address published when the website IPv6 agent is upgraded, wherein the website IPv6 upgrade conversion address pool is any IPv6 service address space routed to the protocol conversion device by multiple operators.

[0037] like Figure 3As shown, the multi-operator IPv6 service address space (such as / 64, / 96) is routed to multiple different and interconnected interface addresses of the protocol conversion device, and any one or more IPv6 GUA addresses belonging to different operators can be randomly selected in the IPv6 service address space as the publishing address of the website after the IPv6 upgrade conversion, that is, the IPv6 address pointed to by the domain name AAAA record. When the traditional nginx reverse proxy method is used to convert an IPv4 website to an IPv6 website, the website IPv6 publishing address usually uses the network card interface address, and the address space cannot be flexibly specified, which has certain limitations. In this embodiment, any one or more IPv6 GUA addresses belonging to different operators are randomly selected in the IPv6 service address space as the publishing address of the website after the IPv6 upgrade conversion, and any address in the address space can be specified for the upgraded website to perform IPv6 resolution and release, which is more suitable for the IPv6 translation and conversion platform business of the operating website or the parallel IPv6 conversion and upgrade business of multiple websites in a large enterprise network, and can make full use of the massive IPv6 address space to provide different service addresses for different applications. Among them, the GUA address - global unicast address is equivalent to the public network address in IPV4. It can be routed by operators and interconnected across the entire network.

[0038] S2) performs target address mapping on the IPv6 address selected in step S1) and the listening address of the protocol conversion device, the listening address of the protocol conversion device is the IPv6 ULA address configured by the LOOPBACK virtual network card of the protocol conversion device, the target server of the protocol conversion device agent is the IPv4 website, and the access source address obtained by tracing the protocol conversion device is the user's real IPv6 address.

[0039] like Figure 4 As shown, using NAT66 target address conversion technology, one or more IPv6 published addresses belonging to different operators randomly selected from the IPv6 business address space are used as the target address before conversion, and the target address conversion is performed. The converted target address is the IPv6ULA address monitored by the reverse proxy service of the Nginx proxy service module in the protocol conversion device. The address used by the reverse proxy service of the Nginx proxy service module is the IPv6 ULA address configured by the LOOPBACK virtual network card of the protocol conversion device. The protocol supported by the website before the Nginx proxy service module reverse proxy is IPv4. Through the above NAT66+ reverse proxy method, the conversion and upgrade of IPv4 websites are realized and published as random addresses in the address space of different operators. Since only the target address conversion is used, the source address and port actually accessed by the client are not converted. Therefore, the Nginx proxy service module can record the real IP address and port information accessed by the client, which is convenient for tracing and auditing.

[0040] Configuration example:

[0041] ip6tables-t nat-A PREROUTING-d 2408::Ap tcp-m tcp --dport 80-j DNAT --to[FC01::A]:80 / / Redirect the destination address of the A operator's address 2408::A port 80 to the Nginx listening address FC01::A port 80.

[0042] ip6tables-t nat-A PREROUTING-d 2409::Ap tcp-m tcp --dport 80-j DNAT --to[FC01::B]:80 / / Redirect the destination address of port 80 of 2409::A of operator B to port 80 of Nginx listening address FC01::B.

[0043] S3) establishing a mapping relationship between the IPv4 website domain name represented by the protocol conversion device and the IPv6 ULA address, and locking an independent translation conversion rule by accurately configuring the target conversion address / port before and after the conversion, wherein the IPv6 ULA address is randomly generated on the LOOPBACK virtual network card.

[0044] To ensure that the IPv6 published address and port only serve the conversion upgrade of a specified website, accurately control the correspondence between the address, port and domain name, and avoid multiple domain names sharing the published address or port and affecting security management and traceability, each time a translation conversion rule is added, a 128-bit prefix IPv6 ULA address is randomly generated on LOOPBACK, and the IPv6 ULA address is specified to be uniquely applied to the Nginx proxy service module reverse proxy service of a specified website domain name, and the website publishing port is controlled by configuring the NAT66 conversion target address plus port. That is, configure a website IPv6 conversion rule, such as Figure 5 The method shown ensures a one-to-one correspondence between the publishing address, port, and domain name information.

[0045] Add conversion rule configuration input information:

[0046]

[0047] Figure 5 In the domain name AAAA record: points to the IPv6 application publishing address. Multiple record values ​​can be added to point to the publishing addresses of different operators.

[0048] IPv6 publishing address and port: a unique GUA address and application service port randomly selected in the routed address space as the target address and port before NAT66 conversion. Ports generally use 80 or 443. When the website uses the http protocol, the default port is 80. When the website uses the HTTPS protocol, the default port is 443. Other ports can also be customized. The same website can add multiple publishing addresses belonging to different operators.

[0049] Intermediate address (NGINX proxy service module release address): Randomly generate an IPv6 ULA address on LOOPBACK as the intermediate address (reverse proxy address), and assign a specified IPv6 ULA address to a specified website domain name. This address is used as the target address after NAT66 conversion, and the address is used as the reverse proxy listening address of the website conversion rule. When multiple websites publish IPv6 in parallel, multiple random IPv6 ULA addresses are generated on LOOPBACK, each IPv6 ULA corresponds to a website, and establishes a target address mapping with the IPv6 release address one by one, and establishes a reverse proxy relationship with the website domain name one by one.

[0050] Proxy domain name: Each domain name is bound to an NGINX reverse proxy service and specifies a unique IPv6 ULA service address.

[0051] S4) The website returns response data through the user access request routing.

[0052] In order to ensure that the IPv4 website upgraded by the same protocol conversion device supports the release of IPv6 addresses of multiple different operators, that is, the same domain name has multiple different AAAA records, each AAAA record is an address randomly selected in the IPv6 service address space of the different operators, and the subnet where the address is located has been assigned a route by the upper-layer device, in order to ensure the accuracy of the outbound routing of the translation device, the present invention adopts a source-in-source-out routing strategy, such as Figure 6 As shown, it is ensured that the requests from different users accessing through different interconnection interfaces can accurately return the data packets through the original entry path, thereby achieving the goal of using the same conversion device to publish multiple different operator addresses for the same website and being able to correctly route and access the destination website without the access failure problem caused by inconsistent entry and exit paths.

[0053] Add a routing table alias:

[0054] echo "102isp2">> / etc / iproute2 / rt_tables

[0055] echo "103isp3">> / etc / iproute2 / rt_tables

[0056] Configure the newly added routing table to respond to different interfaces:

[0057] ip-6 route add default via FD00::2 dev ens34:02table isp3

[0058] ip-6 route add default via FD01::2 dev ens33:01table isp2 / / / / Configuration

[0059] Add the original return rule so that data from different interfaces are forwarded through different routing tables:

[0060] ip-6 rule add from FD00::1 table isp2

[0061] ip-6 rule add from FD01::1 table isp3

[0062] S5) One-click start and stop of website translation service is achieved by deleting and re-adding target address translation rules.

[0063] By deleting the target address translation rule, the website translation service can be suspended with one click. When the website translation service needs to be restored, only the target address translation rule needs to be added again without modifying any rules in the website reverse proxy service. By controlling the rules of the network layer translation plane, the website translation service can be started and stopped with one click.

[0064] When upgrading and transforming an IPv4 website, an IPv6 address is randomly selected from any IPv6 service address space routed to the protocol conversion device by multiple operators as the IPv6 address published when the website's IPv6 agent is upgraded, and then the selected IPv6 address and the listening address of the protocol conversion device are converted to the target address, and then a mapping relationship between the IPv4 website domain name represented by the protocol conversion device and the IPv6 ULA address is established, and an independent translation conversion rule is locked by accurately configuring the target conversion address / port before and after the conversion, forming a route that can access the IPv website. The user initiates a request to access the IPv4 website through this route, and the IPv4 website feeds back the corresponding data packet through the route where the user sends the access request, thereby realizing the source-in and source-out routing policy.

[0065] Obviously, the above embodiments are merely examples for the purpose of clear explanation, and are not intended to limit the implementation methods. For those skilled in the art, other different forms of changes or modifications can be made based on the above description. It is not necessary and impossible to list all the implementation methods here. The obvious changes or modifications derived therefrom are still within the scope of protection of the claims of this patent application.

Claims

1. A website access method during the website IPv6 transformation process, characterized in that: The steps include: S1) randomly selecting an IPv6 address from the address pool of the website IPv6 upgrade conversion as the IPv6 address published when the website IPv6 agent is upgraded, wherein the address pool of the website IPv6 upgrade conversion is any IPv6 service address space routed to the protocol conversion device by multiple operators; S2) performing target address mapping of the IPv6 address selected in step S1) and the listening address of the protocol conversion device, the listening address of the protocol conversion device is the IPv6 ULA address configured by the LOOPBACK virtual network card of the protocol conversion device, the target server of the protocol conversion device proxy is the IPv4 website, and the access source address obtained by tracing the source of the protocol conversion device is the real IPv6 address of the user; S3) establishing a mapping relationship between the IPv4 website domain name and the IPv6 ULA address represented by the protocol conversion device, and locking an independent translation conversion rule by accurately configuring the target conversion address / port before and after the conversion, wherein the IPv6 ULA address is randomly generated on the LOOPBACK virtual network card; when a new translation conversion rule is added, a 128-bit prefix IPv6 ULA address is randomly generated on the LOOPBACK, and the IPv6 ULA address is specified to be uniquely applied to a reverse proxy service of a specified IPv4 website domain name, and the website publishing port is controlled by configuring the conversion target address plus the port; S4) The website returns response data through the user access request routing.

2. The method according to claim 1, characterized in that In step S1), IPv6 service address spaces of different operators are routed to different and interconnected interface addresses of a protocol conversion device.

3. The method according to claim 1, characterized in that In step S2), the IPv6 address selected in step S1) is used as the target address before conversion, and the target address conversion is performed on the IPv6 address, and the target address after conversion is the IPv6 ULA address monitored by the protocol conversion device.

4. The method according to claim 1, characterized in that: In step S1), the number of publishing addresses belonging to different operators that can be added to the same website is greater than or equal to 2.

5. The method according to claim 1, characterized in that In step S3), when multiple websites publish IPv6 addresses in parallel, a corresponding number of random IPv6 ULA addresses are generated on LOOPBACK, each IPv6 ULA address corresponds to a website, and target address mappings are established one by one with the published IPv6 addresses, and reverse proxy relationships are established one by one with the website domain names.

6. The method according to any one of claims 1 to 5, characterized in that: Also includes: S5) One-click start and stop of website translation service is achieved by deleting and re-adding translation conversion rules.

7. A system for accessing an IPv4 website using the website access method during the website IPv6 transformation process of claim 1, characterized in that: include: An address pool is used to randomly select an IPv6 address when the website IPv6 conversion is upgraded as the IPv6 address published when the website IPv6 agent is upgraded, wherein the address pool for website IPv6 upgrade conversion is any IPv6 service address space routed to the protocol conversion device by multiple operators; A protocol conversion device for providing reverse proxy services; the protocol conversion device comprises a target address conversion module, a translation conversion module and a LOOPBACK virtual network card, wherein the target address conversion module is used to map the selected IPv6 address to the reverse proxy device listening address, the translation conversion module is used to establish a mapping relationship between the IPv4 website domain name proxied by the protocol conversion device and the IPv6 ULA address, and the LOOPBACK virtual network card is used to configure the IPv6 ULA address; The address pool is communicatively connected to the protocol conversion device; the user accesses the IPv4 website through the protocol conversion device.

8. The system according to claim 7, characterized in that The IPv6 service address spaces of different operators are routed to different and interconnected interface addresses of the protocol conversion device.

9. The system according to claim 7, characterized in that The number of publishing addresses belonging to different operators that can be added to the same website is greater than or equal to 2.

Images