A NAT conversion control method and device based on ONT gateway and ONT gateway

Abstract

The present invention relates to the field of communications technology and discloses a NAT conversion control method and device based on an optical network terminal (ONT) gateway, as well as an ONT gateway. The method aims to address the poor maintainability of existing ONT gateway data monitoring methods. The method mainly includes: selecting the WAN connection type of the ONT gateway, the port to be monitored, and the device IP address; generating NAT44 rules in the kernel's netfilter via iptables; enabling the NAT44 rules in the netfilter; upon receiving a message from a downstream device, the ONT gateway determines whether the message is a UDP message or a TCP message; if so, determines whether the message originates from the port and device IP address to be monitored; if so, performs NAT conversion on the message according to the NAT44 rules; and forwards the NAT-converted message from the WAN port to the front end. The method improves the maintainability of the Linux system in the gateway, reduces maintenance and development costs, and is particularly suitable for data monitoring in public scenarios.

Description

Technical Field

[0001] The present invention relates to the field of communication technology, and in particular to an ONT gateway-based NAT conversion control method and device, and the ONT gateway. Background Art

[0002] To monitor devices connected to ONT (Optical Network Terminal) gateway products in public scenarios such as hotels, ONTs are required to support security audit functions to monitor and track data.

[0003] Currently, there's a data tracking solution based on NAT translation control. This solution monitors data sent and received by users within the gateway by converting the "IP" of devices connected to the gateway to the "IP + port number" of the gateway's WAN port. The solution is described as follows: When monitoring the Internet data of a device connected to the gateway, the gateway performs NAT translation control on this data. After translation, the source port number of the message sent out of the gateway's WAN port must be within the MIN-MAX range. Network monitoring devices can determine the device's Internet data based on the source IP and source port number of the message sent from the WAN port.

[0004] Among them, MIN: (gateway connected device IP four-segment value - 2) * 256 + 1024, MAX: MIN + 255, IP four-segment value: For example, 100 in 192.168.10.100 requires the monitoring device DHCP to assign IP addresses starting from 192.168.10.50.

[0005] To meet this requirement, the current approach is to implement relevant control in the Linux kernel of the ONT gateway. However, this approach involves user-mode and kernel-mode maintenance, resulting in complex logic and poor maintainability. Summary of the Invention

[0006] The present invention aims to solve the problem of poor maintainability of the data monitoring method of the existing ONT gateway and proposes a NAT conversion control method and device based on the ONT gateway and the ONT gateway.

[0007] The technical solution adopted by the present invention to solve the above technical problems is:

[0008] In a first aspect, a NAT conversion control method based on an ONT gateway is provided, the method comprising:

[0009] Select the WAN connection type of the ONT gateway, and select the port and device IP to be monitored;

[0010] Generate a NAT44 rule in the kernel's netfilter according to the port and device IP through iptables, wherein the netfilter is provided with a default NAT rule;

[0011] Make the NAT44 rule effective in netfilter, and add an address masquerading rule so that the NAT translation range corresponding to the NAT44 rule does not overlap with the NAT translation range corresponding to the NAT rule;

[0012] When the ONT gateway receives a message from a downstream device, it determines whether the message is a UDP message or a TCP message. If so, it further determines whether the message comes from the port and device IP that need to be monitored. If so, it performs NAT conversion on the message according to the NAT44 rule;

[0013] Forward the NAT-converted packets from the WAN port to the front end.

[0014] Further, the selecting the WAN connection type of the ONT gateway specifically includes: selecting the WAN connection type of the ONT gateway as INTERNET connection, and defining the device interface corresponding to the INTERNET WAN connection as nbif0;

[0015] The ports to be monitored include LAN and WIFI. The LAN port to be monitored is defined as eth0, and the WIFI SSID to be monitored is defined as wlan0.

[0016] The IP of the device to be monitored is an IP network segment, the starting IP of the IP network segment is defined as the address ip_src, and the starting IP of the IP network segment is defined as the address ip_dst.

[0017] Furthermore, the NAT44 rules are as follows:

[0018] iptables-t nat-Am iprange--src-range ip_src-ip_dst-s eth0-p tcp-onbif0-j NAT44;

[0019] iptables-t nat-Am iprange--src-range ip_src-ip_dst-p udp-o nbif0-jNAT44;

[0020] iptables-t nat-As wlan0-p udp-o nbif0-j NAT44.

[0021] Furthermore, the method further comprises:

[0022] When the message is not a UDP message or a TCP message, processing the message according to a protocol stack process corresponding to the message;

[0023] When the message does not come from the port and device IP that need to be monitored, the message is processed according to the default NAT rule.

[0024] A second aspect provides a NAT conversion control device based on an ONT gateway, the device comprising:

[0025] A rule configuration unit is configured to select the WAN connection type of the ONT gateway and the port and device IP to be monitored; generate a NAT44 rule in the kernel's netfilter based on the port and device IP through iptables, wherein the netfilter has a default NAT rule; and enable the NAT44 rule in the netfilter and add an address masquerading rule so that the NAT translation range corresponding to the NAT44 rule does not overlap with the NAT translation range corresponding to the NAT rule;

[0026] The data processing unit is used to determine whether the message is a UDP message or a TCP message when the ONT gateway receives the message from the downstream device. If so, further determine whether the message comes from the port and device IP that need to be monitored. If so, perform NAT conversion on the message according to the NAT44 rule; and forward the NAT-converted message from the WAN port to the front end.

[0027] Further, the selecting the WAN connection type of the ONT gateway specifically includes: selecting the WAN connection type of the ONT gateway as INTERNET connection, and defining the device interface corresponding to the INTERNET WAN connection as nbif0;

[0028] The ports to be monitored include LAN and WIFI. The LAN port to be monitored is defined as eth0, and the WIFI SSID to be monitored is defined as wlan0.

[0029] The IP of the device to be monitored is an IP network segment, the starting IP of the IP network segment is defined as the address ip_src, and the starting IP of the IP network segment is defined as the address ip_dst.

[0030] Furthermore, the NAT44 rules are as follows:

[0031] iptables-t nat-Am iprange--src-range ip_src-ip_dst-s eth0-p tcp-onbif0-j NAT44;

[0032] iptables-t nat-Am iprange--src-range ip_src-ip_dst-p udp-o nbif0-jNAT44;

[0033] iptables-t nat-As wlan0-p udp-o nbif0-j NAT44.

[0034] Furthermore, the data processing unit is further configured to:

[0035] When the message is not a UDP message or a TCP message, processing the message according to a protocol stack process corresponding to the message;

[0036] When the message does not come from the port and device IP that need to be monitored, the message is processed according to the default NAT rule.

[0037] In a third aspect, another NAT conversion control device based on an ONT gateway is provided, the device including a processor and a memory storing program instructions, characterized in that the processor is configured to execute the NAT conversion control method based on the ONT gateway as described in the first aspect when executing the program instructions.

[0038] In a fourth aspect, an ONT gateway is provided, comprising: a gateway body and the ONT gateway-based NAT conversion control device as described in the second aspect or the third aspect, wherein the ONT gateway-based NAT conversion control device is installed in the gateway body.

[0039] The beneficial effects of the present invention are as follows: the NAT translation control method and device based on an ONT gateway, as well as the ONT gateway, control the NAT translation relationships of devices connected to the ONT gateway through iptables and netfilter, and monitor data sent and received by users within the gateway based on the source IP address and source port number of the gateway-forwarded messages. This invention, based on the expansion and development of iptables and netfilter, does not involve user-mode and kernel-mode maintenance. The ONT gateway can directly control data forwarding through iptables command rule maintenance, improving the maintainability of the Linux system in the gateway and reducing maintenance and development costs. BRIEF DESCRIPTION OF THE DRAWINGS

[0040] Figure 1 Schematic diagram of the process of the NAT conversion control method based on the ONT gateway according to an embodiment of the present invention;

[0041] Figure 2 A schematic diagram of the process of configuring NAT44 rules according to an embodiment of the present invention;

[0042] Figure 3 A schematic diagram of the data forwarding process according to an embodiment of the present invention;

[0043] Figure 4 A schematic structural diagram of a NAT conversion control device based on an ONT gateway according to an embodiment of the present invention;

[0044] Figure 5 A schematic structural diagram of a NAT conversion control device based on an ONT gateway according to an embodiment of the present invention;

[0045] Figure 6 The figure is a schematic diagram of the structure of an ONT gateway according to an embodiment of the present invention. DETAILED DESCRIPTION

[0046] The embodiments of the present invention will be described in detail below with reference to the accompanying drawings.

[0047] The present invention aims to realize data monitoring of devices connected to an ONT gateway and improve the maintainability of a Linux system. A NAT conversion control method, device, and ONT gateway based on the ONT gateway are proposed. The main technical scheme includes: selecting the WAN connection type of the ONT gateway and selecting the port and device IP address to be monitored; generating a NAT44 rule in the kernel's netfilter according to the port and device IP address through iptables, wherein the netfilter is provided with a default NAT rule; making the NAT44 rule effective in the netfilter, and adding an address masquerading rule so that the NAT conversion range corresponding to the NAT44 rule does not overlap with the NAT conversion range corresponding to the NAT rule; when the ONT gateway receives a message from a connected device, determining whether the message is a UDP message or a TCP message, and if so, further determining whether the message comes from the port and device IP address to be monitored, and if so, performing NAT conversion on the message according to the NAT44 rule; and forwarding the NAT-converted message from the WAN port to the front end.

[0048] Specifically, the present invention primarily includes two processes: NAT44 rule configuration and data forwarding. The NAT44 rule configuration process primarily involves configuring NAT44 rules on the ONT gateway. Specifically, the process involves selecting the ONT gateway's WAN connection type and the ports and device IP addresses to be monitored. As required, the ONT gateway does not monitor all Internet data, but rather monitors the devices connected to the gateway. Using the -j MASQUERADE command in iptables cannot meet NAT44 requirements because this rule performs conversion based on the source IP address of the Internet access WAN. Therefore, the present invention requires expanding and developing iptables rules, generating NAT44 rules in the kernel's Netfilter through iptables to implement custom -j NAT44 rules. The kernel then customizes the NAT conversion function within Netfilter to enable the NAT44 rules within the kernel's Netfilter. Specifically, NAT44 conversion range control is performed based on the IP address of the connected device. Data matching the NAT44 rule is forwarded according to the NAT44 rule, while data not matching the NAT44 rule is forwarded according to the standard NAT rules. A new MASQUERADE rule is added to ensure that the regular NAT data translation range does not overlap with the NAT44 forwarding range. The data forwarding process specifically involves the following: When the ONT gateway receives a message from a downstream device, it first determines whether the message is a UDP or TCP message. If so, it then determines whether the message matches the monitoring rules, which include whether the message originates from the required monitoring port and the message's source IP address. If the monitoring rules do not match, the message is mapped and forwarded according to standard NAT rules. If it does, the Linux kernel configures the NAT translation range according to the NAT44 rules and forwards the Internet traffic to the front-end via the WAN based on the default route and NAT translation range. After receiving the Internet traffic returned by the front-end, the ONT gateway processes and forwards it to the downstream device according to the normal process, eliminating the need for custom development.

[0049] Example

[0050] See also Figure 1 The NAT conversion control method based on the ONT gateway described in the embodiment of the present invention includes a NAT44 rule configuration process and a data forwarding processing process, wherein the NAT44 rule configuration process mainly configures NAT44 rules in the ONT gateway, and the data forwarding processing process mainly controls the NAT conversion of the message by the ONT gateway according to the corresponding rules.

[0051] See also Figure 2 The NAT44 rule configuration process includes the following steps:

[0052] Step S1: Select the WAN connection type of the ONT gateway and select the port and device IP to be monitored.

[0053] It is understood that there are multiple WAN connection types for the ONT gateway. In this embodiment, NAT needs to select a WAN connection type of INTERNET. The device interface corresponding to the INTERNET WAN connection is defined as nbif0.

[0054] In this embodiment, the ports to be monitored include the gateway LAN and WIFI. In actual application, you can choose to monitor all ports or some ports. Define the LAN port to be monitored as eth0 and the WIFI SSID to be monitored as wlan0.

[0055] In this embodiment, the device IP address to be monitored can be a single IP address or an IP network segment. The IP network segment refers to the IP address segment of the devices connected to the ONT gateway. The gateway assigns DHCP IP addresses to the devices starting from 192.168.10.50. Define the starting IP address as ip_src and the ending IP address as ip_dst.

[0056] Step S2: Generate NAT44 rules in the kernel's netfilter according to the port and device IP through iptables, wherein the netfilter is provided with a default NAT rule.

[0057] As required, the ONT gateway does not monitor all Internet data, but rather monitors the devices connected to ONT gateway D. Using -j MASQUERADE in iptables cannot meet NAT44 requirements because this rule translates data based on the source IP address of the WAN. Therefore, the iptables rules need to be expanded and developed to add a custom -j NAT44 rule.

[0058] An example of adding NAT44 rules to iptables is as follows:

[0059] iptables-t nat-Am iprange--src-range ip_src-ip_dst-s eth0-p tcp-onbif0-j NAT44;

[0060] iptables-t nat-Am iprange--src-range ip_src-ip_dst-p udp-o nbif0-jNAT44;

[0061] iptables-t nat-As wlan0-p udp-o nbif0-j NAT44.

[0062] Step S3: Make the NAT44 rule effective in netfilter, and add an address masquerading rule so that the NAT conversion range corresponding to the NAT44 rule does not overlap with the NAT conversion range corresponding to the NAT rule.

[0063] Although iptables generates NAT44 configuration rules in step S4, there is no corresponding processing in the kernel. Therefore, the kernel needs to customize the NAT translation function in netfilter and complete the NAT44 translation range control based on the IP address of the downstream device. The specific customization is as follows:

[0064] Data that matches NAT44 rules is forwarded according to NAT44 rules. Data that does not match NAT44 rules is forwarded according to regular NAT rules. And by adding MASQUERADE rules, we ensure that the regular NAT data translation range does not overlap with the NAT44 forwarding range.

[0065] After completing the above configuration, you can monitor the data sent and received by users inside the gateway through the data forwarding process. Figure 3 , the data forwarding process specifically includes the following steps:

[0066] Step T1: When the ONT gateway receives a message from a downstream device, it determines whether the message is a UDP message or a TCP message. If so, it further determines whether the message comes from the port and device IP that need to be monitored. If so, it performs NAT conversion on the message according to the NAT44 rule.

[0067] UDP and TCP packets represent messages of different protocols. UDP (User Datagram Protocol) provides a way for applications to send encapsulated IP packets without establishing a connection. TCP (Transmission Control Protocol) is a connection-oriented, reliable, byte-stream-based transport layer communication protocol.

[0068] When the ONT gateway receives a message from a connected device, it first determines whether the message is a UDP or TCP message. If so, it then determines whether the message matches the monitoring rules. The monitoring rules include whether the message comes from the port to be monitored and the source IP address of the message. If the monitoring rules do not match, the message is mapped and forwarded according to the normal NAT rules. If it does match, the Linux kernel configures the NAT translation range according to the NAT44 rules and completes the NAT translation.

[0069] Step T2: forward the NAT-converted message from the WAN port to the front end.

[0070] Specifically, after completing NAT conversion, the NAT-converted message is forwarded to the front-end according to the default route and NAT conversion range. After the ONT gateway receives the Internet access data returned by the front-end, it is processed and forwarded to the downstream device according to the normal process, without the need for customized development.

[0071] iptables and netfilter are used to control the NAT translation relationships of devices connected to the ONT gateway, and data sent and received by users within the gateway is monitored based on the source IP and source port numbers of packets forwarded by the gateway. Extended development based on iptables and netfilter eliminates the need for user-mode and kernel-mode maintenance. The ONT gateway can directly control data forwarding through iptables command rule maintenance, improving the maintainability of the Linux system in the ONT gateway and reducing maintenance and development costs.

[0072] Based on the above technical solution, this embodiment also proposes a NAT conversion control device based on an ONT gateway, see Figure 4 , the device comprises:

[0073] A rule configuration unit is configured to select the WAN connection type of the ONT gateway and the port and device IP to be monitored; generate a NAT44 rule in the kernel's netfilter based on the port and device IP through iptables, wherein the netfilter has a default NAT rule; and enable the NAT44 rule in the netfilter and add an address masquerading rule so that the NAT translation range corresponding to the NAT44 rule does not overlap with the NAT translation range corresponding to the NAT rule;

[0074] The data processing unit is used to determine whether the message is a UDP message or a TCP message when the ONT gateway receives the message from the downstream device. If so, further determine whether the message comes from the port and device IP that need to be monitored. If so, perform NAT conversion on the message according to the NAT44 rule; and forward the NAT-converted message from the WAN port to the front end.

[0075] Based on the above technical solution, this embodiment also proposes another NAT conversion control device based on ONT gateway, please refer to Figure 5 The device includes a processor and a memory storing program instructions, and the processor is configured to execute the above-mentioned NAT conversion control method based on the ONT gateway when executing the program instructions.

[0076] Based on the above technical solution, this embodiment also proposes an ONT gateway, see Figure 6 , including: a gateway body and the above-mentioned NAT conversion control device based on the ONT gateway, the NAT conversion control device based on the ONT gateway is installed in the gateway body.

[0077] It can be understood that since the NAT conversion control device based on the ONT gateway and the ONT gateway described in the embodiment of the present invention are devices and gateways used for the NAT conversion control method based on the ONT gateway described in the embodiment, for the device and gateway disclosed in the embodiment, since they correspond to the method disclosed in the embodiment, the description is relatively simple, and the relevant parts can be referred to the partial description of the method.

Claims

1. A NAT conversion control method based on an ONT gateway, characterized in that: The method comprises: Select the WAN connection type of the ONT gateway, and select the port and device IP to be monitored; Generate a NAT44 rule in the kernel's netfilter according to the port and device IP through iptables, wherein the netfilter is provided with a default NAT rule; Make the NAT44 rule effective in netfilter, and add an address masquerading rule so that the NAT translation range corresponding to the NAT44 rule does not overlap with the NAT translation range corresponding to the NAT rule; When the ONT gateway receives a message from a downstream device, it determines whether the message is a UDP message or a TCP message. If so, it further determines whether the message comes from the port and device IP that need to be monitored. If so, it performs NAT conversion on the message according to the NAT44 rule; Forward the NAT-converted packets from the WAN port to the front end.

2. The NAT conversion control method based on the ONT gateway as claimed in claim 1, wherein The WAN connection type of the ONT gateway is selected as follows: the WAN connection type of the ONT gateway is selected as INTERNET connection, and the corresponding device interface of the INTERNET WAN connection is defined as nbif0; The ports to be monitored include LAN and WIFI. The LAN port to be monitored is defined as eth0, and the WIFI SSID to be monitored is defined as wlan0. The IP of the device to be monitored is an IP network segment, the starting IP address of the IP network segment is defined as ip_src, and the ending IP address of the IP network segment is defined as ip_dst.

3. The NAT conversion control method based on the ONT gateway as claimed in claim 2, wherein The NAT44 rules are as follows: iptables-t nat-Am iprange--src-range ip_src-ip_dst-s eth0-p tcp-o nbif0-j NAT44; iptables-t nat-Am iprange--src-range ip_src-ip_dst-p udp-o nbif0-jNAT44; iptables-t nat-As wlan0-p udp-o nbif0-j NAT44.

4. The NAT conversion control method based on the ONT gateway as claimed in claim 1, wherein The method further comprises: When the message is not a UDP message or a TCP message, processing the message according to a protocol stack process corresponding to the message; When the message does not come from the port and device IP that need to be monitored, the message is processed according to the default NAT rule.

5. A NAT conversion control device based on an ONT gateway, characterized in that: The device comprises: A rule configuration unit is configured to select the WAN connection type of the ONT gateway and the port and device IP to be monitored; generate a NAT44 rule in the kernel's netfilter based on the port and device IP through iptables, wherein the netfilter has a default NAT rule; and enable the NAT44 rule in the netfilter and add an address masquerading rule so that the NAT translation range corresponding to the NAT44 rule does not overlap with the NAT translation range corresponding to the NAT rule; The data processing unit is used to determine whether the message is a UDP message or a TCP message when the ONT gateway receives the message from the downstream device. If so, further determine whether the message comes from the port and device IP that need to be monitored. If so, perform NAT conversion on the message according to the NAT44 rule; and forward the NAT-converted message from the WAN port to the front end.

6. The NAT conversion control device based on the ONT gateway according to claim 5, characterized in that The WAN connection type of the ONT gateway is selected as follows: the WAN connection type of the ONT gateway is selected as INTERNET connection, and the corresponding device interface of the INTERNET WAN connection is defined as nbif0; The ports to be monitored include LAN and WIFI. The LAN port to be monitored is defined as eth0, and the WIFI SSID to be monitored is defined as wlan0. The IP of the device to be monitored is an IP network segment, the starting IP address of the IP network segment is defined as ip_src, and the ending IP address of the IP network segment is defined as ip_dst.

7. The NAT conversion control device based on the ONT gateway according to claim 6, wherein The NAT44 rules are as follows: iptables-t nat-Am iprange--src-range ip_src-ip_dst-s eth0-p tcp-o nbif0-j NAT44; iptables-t nat-Am iprange--src-range ip_src-ip_dst-p udp-o nbif0-jNAT44; iptables-t nat-As wlan0-p udp-o nbif0-j NAT44.

8. The NAT conversion control device based on the ONT gateway according to claim 5, characterized in that The data processing unit is further configured to: When the message is not a UDP message or a TCP message, processing the message according to a protocol stack process corresponding to the message; When the message does not come from the port and device IP that need to be monitored, the message is processed according to the default NAT rule.

9. A NAT conversion control device based on an ONT gateway, characterized in that: The device includes a processor and a memory storing program instructions, wherein the processor is configured to execute the NAT conversion control method based on the ONT gateway according to any one of claims 1 to 4 when executing the program instructions.

10. An ONT gateway, characterized in that: include: A gateway body and the NAT conversion control device based on the ONT gateway according to any one of claims 5 to 9, wherein the NAT conversion control device based on the ONT gateway is installed in the gateway body.

Images