Method for constructing and managing a virtual private network environment based on wireguard

Abstract

The application discloses a kind of virtual private network construction and management method based on Wireguard, mainly solve the problems that existing technology builds virtual private network process is complex, commonality and portability are poor and network management operation and maintenance is difficult, its implementation scheme is: 1) according to geographical location, network environment is divided into network segment, to improve network flexibility;2) for the network segment that exists network restriction, through traffic penetration technology combined with custom routing rules to bypass limit, improve network commonality and portability;3) using Wireguard configures each network segment server, client and traffic relay end to build virtual private network, realize multi-network segment interconnection and network traffic proxy;4) build and deploy the online management interface of virtual private network, effectively reduce the cost of manual maintenance network.The transmission performance and security of the application are superior to conventional virtual private network, can meet the use demand of different scenes, can be applied to the custom networking of server.

Description

Technical Field

[0001] This invention belongs to the field of computer network technology, and further relates to a method for constructing a virtual private network environment, which can be applied to the custom networking of servers to achieve unified network connection management for servers located in different geographical locations and network environments. Background Technology

[0002] In computer networks, different types of applications can be installed on physical and virtual servers. These applications need to communicate with other servers to perform their functions. For example, an application on one server might require data stored on another server. To enable communication between different servers, data needs to be placed in network packets and transmitted to the required servers. While this network packet method provides a way for servers to communicate, it presents challenges in terms of network transmission performance and security.

[0003] The emergence of Virtual Private Networks (VPNs) overcomes the shortcomings of network communication in terms of transmission performance and security. It is an encrypted communication technology used to create private network connections over public networks. Many enterprises and schools use VPNs to build internal networks spanning different geographical locations and network environments, and to manage all servers and users uniformly through these internal networks. Although mature solutions exist in the industry, the VPN protocols they use, such as IPsec and OpenVPN, are older and have relatively poor performance. Furthermore, traditional VPN protocols contain many security vulnerabilities, especially the OpenSSL heartbleed vulnerability exposed in 2014, which seriously threatened the security of many enterprise VPNs.

[0004] Cheng Shanshan from Harbin Institute of Technology proposed a method for constructing and dynamically networking a Virtual Private Network (VPN) based on IPsec VPN in her paper "Design and Implementation of Secure Interconnection System for Virtual Private Cloud" (Harbin Institute of Technology, 2020. DOI:10.27061 / d.cnki.ghgdu.2020.006569.). The specific implementation of this method is as follows: First, deploy an IPsec VPN server on a public network server and generate public-private key pairs for data encryption. Second, deploy an IPsec VPN client on a user server, generate configuration files, and establish a virtual intranet connection. Third, configure a GRE tunnel on the server and manually modify firewall rules to achieve intranet penetration. Fourth, design and implement a web-based management interface for the VPN environment. While this method can construct a VPN, its problems include the relatively outdated VPN technology used, resulting in poor network transmission performance and security for IPsec. Furthermore, when firewall restrictions exist, this method requires manual modification of firewall management rules, rather than directly bypassing firewall limitations, leading to a cumbersome and complex network setup process.

[0005] Hundsun Technologies Inc. disclosed a "Multi-Cloud Interconnection Method and Apparatus" in its patent application CN202111575823.3. The method comprises the following steps: First, a core management cluster is pre-maintained, CRD monitoring resources are deployed, and network configuration information of each service cluster is monitored and collected. Second, the initial network configuration information is distributed to each service cluster, and a network communication tunnel is built between the core management cluster and each edge service cluster based on Wireguard. Third, upon receiving an access request from an edge service cluster to be accessed, the network communication tunnel between the core management cluster and the edge service cluster to be accessed is established, and the configuration information of the edge service cluster to be accessed is obtained. Fourth, each edge service cluster sends routing change information to the core management cluster by configuring its own routing rules, and the core management cluster distributes and changes resources to all edge service clusters to achieve multi-cloud interconnection. This method can build a multi-interconnected virtual intranet environment for different business groups, but its problem is that the design and construction steps of the virtual private network are complicated and it is not convenient to deploy quickly on small-scale server clusters. In addition, this method only provides the construction process of the virtual private network and does not provide an online virtual private network management interface, which makes the network management and maintenance process cumbersome. Summary of the Invention

[0006] The purpose of this invention is to address the shortcomings of the prior art by proposing a method for constructing a virtual private network environment, thereby simplifying the construction process of a virtual private network, improving network transmission performance and security, and reducing the difficulty and complexity of network management and maintenance.

[0007] The technical solution of this invention is as follows: by avoiding manual modification of the firewall, the process of building a virtual private network (VPN) is simplified; by using the newly developed kernel-level VPN protocol Wireguard, the transmission performance and security of the network are improved; and by providing an online VPN management interface, the difficulty and complexity of network management and maintenance are reduced. The implementation steps include the following:

[0008] (1) Divide the virtual intranet segments:

[0009] 1a) Divide the virtual intranet into segments based on the server's geographical location, physical network environment, and server functions. Servers in the same physical network environment and with the same functions are divided into the same segment, and servers under firewall network restrictions are divided into the same segment.

[0010] 1b) For servers located in firewall-restricted network segments, select any one server as the server, any one server as the traffic relay, and the other servers as clients; in the remaining network segments, select a server with a fixed public IP address as the server, any one server as the traffic relay, and the other servers as clients. The traffic relay acts as a bridge for traffic forwarding and communication between the two network segments, and is used to access two internal network segments simultaneously.

[0011] (2) Generate public and private key pairs on all servers;

[0012] (3) Select a server outside the network segment restricted by the firewall as a jump server. On the server side of the current virtual network segment, use Pingtunnel traffic tunneling technology to convert the TCP / UDP traffic of the transport layer into ICMP traffic of the network layer, and map the Wireguard listening port of the server side to the port of the jump server to bypass the port usage restrictions of the firewall.

[0013] (4) Configure the Wireguard server for each network segment:

[0014] 4a) Create a Wireguard configuration file in the / etc / wireguard folder on the server, which includes two types of information: Interface and Peer. Interface represents the virtual network interface configuration of the current server, and Peer represents other clients connected to the server.

[0015] 4b) In the Interface, set the internal IP address, service listening port, encryption private key and custom routing rules for the current internal network segment. In the custom routing rules, enable the IPv4 traffic forwarding mechanism and source address forwarding function. Based on the destination address of the traffic, forward the traffic from the current network segment to other internal network segments to the traffic relay end.

[0016] 4c) Add the public keys of the client and traffic relay to the Peer, as well as the range of traffic addresses that are allowed to be forwarded to this client or traffic relay. Each added Peer represents a network connection.

[0017] 4d) Select the server located in the network segment restricted by the firewall, and make special configurations on the Interface based on step 4b). That is, first enable the configuration routing table mechanism in the configuration file and create a new routing table, and then add custom routing rules in this routing table to forward all traffic in the network segment that accesses the public network to the traffic relay end, so as to bypass the firewall's network traffic access restrictions on the server.

[0018] (5) Configure Wireguard clients for each network segment:

[0019] 5a) Create a Wireguard configuration file in the / etc / wireguard folder on the client. Configure the Interface and Peer information. In the Interface, set the internal IP address, domain name resolution address and private key information generated in step (2) assigned to the current client. In the Peer, set the server information of the current internal network segment, including the server public key and the internal network segment traffic that needs to be forwarded to the server.

[0020] 5b) Select the client that is under the network restriction of the firewall, and modify the Peer information based on step 5a), that is, forward the network traffic of the client to the public network to the server of the current network segment, so as to bypass the firewall's restriction on the client's network traffic access;

[0021] (6) Configure Wireguard traffic relays for each network segment to achieve multi-segment connectivity and network traffic proxying:

[0022] 6a) Create two Wireguard configuration files in the / etc / wireguard folder on the traffic relay end. Their initial contents are the same as the client configuration file in 5a). They correspond to the network connections of the traffic relay end in the two internal network segments, respectively.

[0023] 6b) Modify the Interface information in the configuration file according to the network interface and destination IP address of the receiving traffic in step 4b) to forward the traffic in the current network segment to other network segments to the server of the corresponding network segment, so as to realize network connectivity between different internal network segments.

[0024] 6c) Select a traffic relay terminal located in a network segment restricted by the firewall, forward the traffic accessing the public network in that network segment to the physical network port on this server, and send this traffic to the public network to realize network traffic proxy and complete the construction of the virtual private network;

[0025] (7) Build and deploy the online management interface for the virtual private network:

[0026] 7a) Build front-end and back-end services for managing Wireguard virtual private networks. The back-end service parses the Wireguard server configuration file to obtain network structure information, and the front-end page displays the network structure and provides network management operations. When performing management operations, the back-end service will automatically modify the Wireguard server configuration file to realize network structure changes. After the front-end and back-end services are built, they are packaged into a Docker image.

[0027] 7b) Configure Wireguard auto-reload mechanism on the server, that is, when the server detects that the Wireguard configuration file has been modified, it will automatically reload the configuration file information to modify the network structure;

[0028] 7c) On the server, run the Wireguard UI image built in 7a) to generate a container using Docker, map the / etc / wireguard folder on the server into the container and set the network port to be used, and start the online network management service.

[0029] Compared with the prior art, the present invention has the following advantages:

[0030] First, because this invention uses Wireguard, the most advanced kernel-level virtual private network protocol, to build virtual private networks, it outperforms networks built with traditional protocols such as IPsec and OpenVPN in terms of network transmission performance and security.

[0031] Secondly, when constructing a Wireguard virtual private network, this invention uses Pingtunnel traffic traversal technology combined with custom routing rules to bypass port restrictions and network traffic access restrictions for servers under firewall network restrictions. This overcomes the shortcomings of existing technologies that cannot achieve universality due to physical network limitations when constructing virtual private networks, making this invention portable. It can include servers in different locations and network environments into a unified virtual private network environment for management.

[0032] Third, because this invention divides the internal network segments according to the server's function, geographical location, and network environment factors when constructing the Wireguard virtual private network, and realizes multi-segment connectivity based on the construction of each subnet, the constructed virtual private network has a clear structure, is easy to manage, and has high flexibility and scalability, which can meet the network usage needs in different scenarios. Administrators can uniformly manage and monitor different subnets according to the actual situation, realize centralized control and management of the entire network, and improve network security and stability.

[0033] Fourth, since this invention provides an online interface for network management based on the construction of a Wireguard virtual private network environment, administrators can view and manage the current network structure configuration in real time from the online UI interface, which greatly simplifies the virtual private network management and maintenance process; it not only overcomes the problem of the existing Wireguard network structure being difficult to maintain and change, but also realizes intelligent and efficient generation of Wireguard configuration, thereby effectively reducing the cost of manual network maintenance, and has good practicality and application prospects. Attached Figure Description

[0034] Figure 1 Flowchart of the implementation of this invention;

[0035] Figure 2 A schematic diagram of the existing Pingtunnel flow tunneling technology used in this invention;

[0036] Figure 3 A schematic diagram of the Wireguard virtual private network structure constructed in this invention. Detailed Implementation

[0037] The embodiments of the present invention will be further described in detail below with reference to the accompanying drawings.

[0038] Reference Figure 1 The implementation steps for this example are as follows:

[0039] Step 1: Divide the virtual intranet segments and assign roles to the servers.

[0040] 1.1) Divide the virtual intranet into segments based on the server's geographical location, physical network environment, and server functions. Servers in the same physical network environment and with the same functions are divided into the same segment, and servers under firewall network restrictions are divided into the same segment.

[0041] 1.2) For servers located in firewall-restricted network segments, select any one server as the server, any one server as the traffic relay, and the other servers as clients; in the remaining network segments, select a cloud server with a fixed public IP address as the server, any one server as the traffic relay, and the other servers as clients. The traffic relay acts as a bridge for traffic forwarding and communication between the two network segments, and is used to access two internal network segments simultaneously.

[0042] Step 2: Generate different public and private key pairs on each server.

[0043] On all servers, execute the command "wg genkey|tee private.key|wg pubkey>public.key" to randomly generate different public and private key pairs.

[0044] Step 3: Configure Pingtunnel, an encrypted tunnel, for the server that is restricted by the firewall to bypass the port usage restrictions of the firewall.

[0045] like Figure 2 As shown; the principle of the encrypted tunnel Pingtunnel traffic traversal technology is as follows: Pingtunnel can establish a traffic obfuscation tunnel between two servers. By encapsulating TCP / UDP data information of the transport layer in the data packet of the ping command through the ICMP protocol, it is converted into ICMP traffic of the network layer, bypassing the firewall's network access restrictions on the transport layer, and realizing traffic traversal and port mapping.

[0046] The implementation steps of this invention, which uses Pingtunnel traffic traversal technology to bypass firewall network restrictions, are as follows:

[0047] 3.1) Execute the command "pingtunnel-type server" on the Wireguard server to run Pingtunnel in server mode to listen for Pingtunnel connection requests from the jump host;

[0048] 3.2) Select a server outside the network segment restricted by the firewall as a jump server. Execute the command "pingtunnel-type client-l:port-s ip-t ip:port" on the jump server to establish a communication tunnel with the Pingtunnel server. Map the Wireguard listening port of the server to the port of the jump server to achieve traffic tunneling and port mapping.

[0049] Step 4: Configure the Wireguard server for each network segment to implement the traffic forwarding mechanism.

[0050] 4.1) Create a Wireguard configuration file in the / etc / wireguard folder on the server. It mainly contains two types of information: Interface and Peer. Interface represents the virtual network interface configuration of the current server, and Peer represents other clients connected to the server.

[0051] 4.2) In the Interface, set the internal IP address used by the current internal network segment, the UDP listening port of the Wireguard service, and the encrypted private key generated locally. Use the ip rule command to customize the routing forwarding rules to enable the IPv4 traffic forwarding mechanism and source address forwarding function. Based on the destination IP address of the traffic, forward the traffic from the current network segment to other network segments to the traffic relay end. Add the public key information of the client and the traffic relay end under the current network segment and the range of traffic addresses allowed to be forwarded to this client or traffic relay end in the Peer. Each added Peer represents a network connection.

[0052] 4.3) Select the server located in the network segment restricted by the firewall and configure the Interface information in a special way. First, set the Table parameter to off in the server configuration file to disable the automatic route creation mechanism and allow control over the traffic sending and receiving rules in the routing table. Then, create a new routing table with the number 51800 using the ip route command so that multiple routing tables can be distinguished when managing them.

[0053] 4.4) Select a server located in a network segment restricted by the firewall. In the configuration file, use the ip rule command to specify traffic destined for the local IP address and send this traffic using the local physical network port. Send the remaining traffic through the server's Wireguard network port and add these two traffic sending methods to the 51800 routing table. This will forward all traffic in this network segment that accesses the public network to the traffic relay end, thereby bypassing the firewall's network traffic access restrictions on the server.

[0054] Step 5: Configure the Wireguard client for each network segment to establish a virtual private network connection with the server.

[0055] 5.1) Create a Wireguard configuration file in the / etc / wireguard folder on the client. Configure two types of information: Interface and Peer. In the Interface section, set the internal IP address assigned to the current client, the domain name resolution address, and the private key information generated locally. In the Peer section, set the server information for the current internal network segment, including the server's public key and the range of internal network segment traffic addresses to be forwarded to the server.

[0056] 5.2) Select a client that is under firewall network restrictions and perform special configuration. On the client, modify the / etc / sysctl.conf system management file to enable the IPv4 traffic forwarding mechanism, and set the IP range of traffic allowed to be sent to the server in the Wireguard configuration file to 0.0.0.0 / 0. This will forward all traffic from the client to the server in the current network segment, thereby bypassing the firewall's network traffic access restrictions on the client.

[0057] Step 6: Configure Wireguard traffic relays for each network segment to enable multi-segment connectivity and network traffic proxying.

[0058] 6.1) Create two Wireguard configuration files in the / etc / wireguard folder on the traffic relay end. Their initial contents are the same as the client configuration file. They correspond to the network connections of the traffic relay end in the two internal network segments, respectively.

[0059] 6.2) Add the ip rule command to the configuration file of the traffic relay end to enable the NAT network address translation function, and distinguish the traffic received by the current Wireguard interface. Forward the traffic whose destination IP address is other internal network segments to another Wireguard interface, and forward the traffic in the current network segment to other network segments to the corresponding network segment server to achieve network connectivity between different network segments.

[0060] 6.3) Select the traffic relay end under the firewall-restricted network segment, add the ip rule command in the configuration file to forward the traffic received by the current Wireguard network interface to the physical network interface on the local machine, and send this traffic to the public network, thereby realizing network traffic proxy and completing the construction of the virtual private network.

[0061] The Wireguard virtual private network structure built in this step, as follows: Figure 3As shown, this network structure includes four types of servers: high-performance computing servers located in the center of the data center, local servers located in the laboratory, cloud servers located in the Alibaba Cloud environment, and user servers. Among them, the data center servers are subject to port usage restrictions and traffic access restrictions by the data center firewall, the laboratory servers and data center servers are located in the campus network environment, the Alibaba Cloud servers have fixed public IP addresses, and the user servers can be located in any network environment with Internet connectivity. Based on the geographical location and network environment of the servers, the following three internal network segments are divided.

[0062] wg7 network segment: This network segment includes two types of machines: Alibaba Cloud servers and local servers. These servers are used to deploy system services and are therefore managed as a single network segment. One Alibaba Cloud server acts as the server in this network segment, and the remaining servers act as clients, connecting to the Alibaba Cloud server's fixed IP address and port via the public network to achieve internal network access.

[0063] The wg8 network segment primarily consists of high-performance computing servers located in the computer room. Due to firewall restrictions at the center of the computer room, it cannot freely connect to external networks and can only be accessed through the campus network in the physical network environment. Therefore, it is divided into a separate network segment. One server in the cluster is selected as the server, and the remaining servers act as clients to establish intranet network connections through the campus network.

[0064] wg9 network segment: This network segment is the user network segment, mainly consisting of an Alibaba Cloud server and the system developer's machine. The Alibaba Cloud server has a fixed public IP address to serve as the server and accept connections from user machines. The system developer's machine can access the intranet network in any environment with a stable Internet connection.

[0065] The virtual private network structure built on the above network segmentation is clear and easy to manage. It realizes the functions of internal network segmentation, multi-segment interconnection and traffic proxy. At the same time, combined with Pingtunnel encrypted tunnel and custom routing rules, it bypasses the physical network restrictions of the data center server and realizes free access to ports and public network.

[0066] Step 7: Build and deploy the online management interface for the Virtual Private Network:

[0067] 7.1) Build front-end and back-end services for managing Wireguard virtual private networks. The back-end service parses the Wireguard server configuration file to obtain network structure information, and the front-end page displays the network structure and provides network management operations. When performing management operations, the back-end service will automatically modify the Wireguard server configuration file to realize network structure changes. After the front-end and back-end services are built, they are packaged into a Docker image.

[0068] 7.2) Create the system task file / etc / systemd / system / wgui.service on the server and set up the Wireguard automatic reload mechanism. That is, when the server detects that the Wireguard configuration file has been modified, it will automatically reload the configuration file information to modify the network structure.

[0069] 7.3) On the server, run the Wireguard UI image built using Docker to generate a container, map the / etc / wireguard folder on the server into the container and set the network port to be used, and start the online network management service.

[0070] Terminology Explanation:

[0071] Wireguard is currently the most advanced kernel-level virtual private network protocol;

[0072] IPsec and OpenVPN are two traditional virtual private network protocols;

[0073] VPN stands for Virtual Private Network;

[0074] Pingtunnel is a traffic encryption tunneling technology;

[0075] TCP / UDP are protocols at the transport layer in a network model;

[0076] ICMP is a protocol at the network layer in a network model.

[0077] Interface is the Wireguard virtual network interface;

[0078] Peer is the peer connection device of Wireguard;

[0079] Docker is a lightweight virtualization technology.

Claims

1. A method for constructing and managing a virtual private network based on Wireguard, characterized in that, Includes the following steps: (1) Divide the virtual intranet segments: 1a) Divide the virtual intranet into segments based on the server's geographical location, physical network environment, and server functions. Servers in the same physical network environment and with the same functions are divided into the same segment, and servers under firewall network restrictions are divided into the same segment. 1b) For servers located in firewall-restricted network segments, select any one of the servers as the server, any one of the servers as the traffic relay, and the other servers as the client. Select a server with a fixed public IP address from the remaining network segments as the server, any server as the traffic relay, and the other servers as clients. The traffic relay serves as a bridge for traffic forwarding and communication between the two network segments, and is used to access two internal network segments simultaneously. (2) Generate public and private key pairs on all servers; (3) Select a server outside the network segment restricted by the firewall as a jump server. On the server side of the current virtual network segment, use Pingtunnel traffic tunneling technology to convert the TCP / UDP traffic of the transport layer into ICMP traffic of the network layer, and map the Wireguard listening port of the server side to the port of the jump server to bypass the port usage restrictions of the firewall. (4) Configure the Wireguard server for each network segment: 4a) Create a Wireguard configuration file in the / etc / wireguard folder on the server, which includes two types of information: Interface and Peer. Interface represents the virtual network interface configuration of the current server, and Peer represents other clients connected to the server. 4b) In the Interface, set the internal IP address, service listening port, encryption private key and custom routing rules for the current internal network segment. In the custom routing rules, enable the IPv4 traffic forwarding mechanism and source address forwarding function. Based on the destination address of the traffic, forward the traffic from the current network segment to other internal network segments to the traffic relay end. 4c) Add the public keys of the client and traffic relay to the Peer, as well as the range of traffic addresses that are allowed to be forwarded to this client or traffic relay. Each added Peer represents a network connection. 4d) Select the server located in the network segment restricted by the firewall, and make special configurations on the Interface based on step 4b). That is, first enable the configuration routing table mechanism in the configuration file and create a new routing table, and then add custom routing rules in this routing table to forward all traffic in the network segment that accesses the public network to the traffic relay end, so as to bypass the firewall's network traffic access restrictions on the server. (5) Configure Wireguard clients for each network segment: 5a) Create a Wireguard configuration file in the / etc / wireguard folder on the client. Configure the Interface and Peer information. In the Interface, set the internal IP address, domain name resolution address and private key information generated in step (2) assigned to the current client. In the Peer, set the server information of the current internal network segment, including the server public key and the internal network segment traffic that needs to be forwarded to the server. 5b) Select the client that is under the network restriction of the firewall, and modify the Peer information based on step 5a), that is, forward the network traffic of the client to the public network to the server of the current network segment, so as to bypass the firewall's restriction on the client's network traffic access; (6) Configure Wireguard traffic relays for each network segment to achieve multi-segment connectivity and network traffic proxying: 6a) Create two Wireguard configuration files in the / etc / wireguard folder on the traffic relay end. Their initial contents are the same as the client configuration file in 5a). They correspond to the network connections of the traffic relay end in the two internal network segments, respectively. 6b) Modify the Interface information in the configuration file according to the network interface and destination IP address of the receiving traffic in step 4b) to forward the traffic in the current network segment to other network segments to the server of the corresponding network segment, so as to realize network connectivity between different internal network segments. 6c) Select a traffic relay terminal located in a network segment restricted by the firewall, forward the traffic accessing the public network in that network segment to the physical network port on this server, and send this traffic to the public network to realize network traffic proxy and complete the construction of the virtual private network; (7) Build and deploy the online management interface for the virtual private network: 7a) Build front-end and back-end services for managing Wireguard virtual private networks. The back-end service parses the Wireguard server configuration file to obtain network structure information, and the front-end page displays the network structure and provides network management operations. When performing management operations, the back-end service will automatically modify the Wireguard server configuration file to realize network structure changes. After the front-end and back-end services are built, they are packaged into a Docker image. 7b) Configure Wireguard auto-reload mechanism on the server, that is, when the server detects that the Wireguard configuration file has been modified, it will automatically reload the configuration file information to modify the network structure; 7c) On the server, run the Wireguard UI image built in 7a) to generate a container using Docker, map the / etc / wireguard folder on the server into the container and set the network port to be used, and start the online network management service.

2. The method according to claim 1, characterized in that, In step (2), public and private key pairs are generated on all servers by using the command "wg genkey|tee private.key|wg pubkey>public.key" to randomly generate different public and private key pairs on each server.

3. The method according to claim 1, characterized in that, In step (3), the transport layer TCP / UDP traffic is converted into network layer ICMP traffic using Pingtunnel traffic tunneling technology, as follows: Execute the "pingtunnel-type server" command on the Wireguard server to run Pingtunnel in server mode to listen for Pingtunnel connection requests from the jump host; Executing the command "pingtunnel-type client-l:port-s ip-t ip:port" on the jump server encapsulates TCP / UDP data from the transport layer into the payload of the ping packet using the ICMP protocol, and establishes a communication tunnel with the Pingtunnel server to achieve traffic tunneling.

4. The method according to claim 1, characterized in that, In step 4d), enable the routing table configuration mechanism on the server side and create a new routing table as follows: First, set the Table parameter to off in the server configuration file to disable the automatic route creation mechanism and allow control over the traffic sending and receiving rules in the routing table; Then, create a new routing table with the number 51800 using the ip route command so that it can be distinguished when managing multiple routing tables.

5. The method according to claim 1, characterized in that, In step 4d), a custom routing rule is added. This involves specifying the destination address of traffic as the local IP address in the configuration file using the ip rule command. This traffic is sent using the local physical network port, while other traffic is sent through the server's Wireguard network port. Both traffic sending methods are then added to the 51800 routing table.

6. The method according to claim 1, characterized in that, In step 5b), the traffic from the client accessing the public network is forwarded to the server in the current network segment. This is done by modifying the / etc / sysctl.conf system management file on the client to enable the IPv4 traffic forwarding mechanism, setting the allowed IP range for traffic sent to the server in the configuration file to 0.0.0.0 / 0, and then forwarding all traffic from the client to the server.

7. The method according to claim 1, characterized in that, In step 6b), the Interface information in the traffic relay configuration file is modified by adding the ip rule command to the configuration file to enable the NAT network address translation function, and distinguishing the traffic received by the current Wireguard interface. Traffic with destination IP addresses in other internal network segments is forwarded to another Wireguard interface to achieve network connectivity between different network segments.

Images