DNS64 and NAT64 configuration method and device

Abstract

This embodiment discloses a method and apparatus for configuring DNS64 and NAT64. The method includes: a firewall issuing a NAT64 policy and automatically enabling an IPv6 DNS server based on the configured DNS64 prefix address; the destination IPv6 address of the NAT64 policy references the DNS64 prefix address, and the destination IPv4 address of the NAT64 policy is configured as the IPv4 DNS server address; when the firewall receives a DNS request message for the IPv6 DNS server address and the NAT64 policy successfully matches, the DNS request message is converted to a DNS conversion message and sent to the IPv4 DNS server; upon receiving a DNS response message, the message is converted and sent to the IPv6 client; and when the firewall receives a service message and has a corresponding cache, NAT64 conversion is directly performed. This method can reduce the difficulty of policy configuration and is highly user-friendly.

Description

Technical Field

[0001] The present disclosure relates to the field of computer technology, and in particular to a configuration method and device for DNS64 and NAT64. Background Art

[0002] With the rapid development of the internet, IPv4 (Internet Protocol Version 4) faced a primary challenge: address exhaustion. Available public IP addresses in my country were extremely scarce. The advent of NAT (Network Address Translation) technology temporarily alleviated the problem, but it couldn't fundamentally resolve it.

[0003] The advent of IPv6 has completely resolved the issue of IP address exhaustion, accelerating its global deployment and development. However, due to the vast number of IPv4 devices and users on the Internet, as well as the differences in protocol formats and addresses between IPv6 and IPv4 networks, it's impossible to fully upgrade existing IPv4 networks to IPv6 in a short period of time. Therefore, in an IPv4-dominated network environment, the smooth transition from IPv4 to IPv6 (i.e., NAT64 technology) determines the successful promotion and application of IPv6.

[0004] In related technologies, during the transition phase between IPv6 and IPv4 networks, IPv6 clients frequently access IPv4 servers. Firewall implementations are complex in design and difficult to use. Furthermore, separate DNS64 policy configuration is required. The IPv6 client needs to set the firewall's interface address to the IPv6 DNS server address, add the interface to the zone, and enable DNSv6 services. DNS64 policy also involves configuring the NAT64 prefix and DNSv4 server address. Separate NAT64 policy configuration is required, followed by translation of the service server address resolved by DNS. The DNS64 policy prefix and the NAT64 policy prefix must remain consistent. This policy configuration requires users to be very familiar with network topology and policy configuration methods in order to enable IPv6 clients to access IPv4-related service servers. This policy configuration method is difficult to use and challenging for users. Summary of the Invention

[0005] In view of this, the embodiments of the present disclosure provide a method and device for configuring DNS64 and NAT64, which maps the DNS server address of the IPv4 client through the DNS64 prefix, and can be directly mapped to an IPv6 address. The user can implement DNS64 and NAT64 service functions by configuring a NAT64 policy, that is, implement the function of IPv6 client accessing IPv4 service server, which can reduce the difficulty of DNS64 and NAT64 policy configuration, simplify the configuration process, and have high ease of use.

[0006] In a first aspect, the embodiments of the present disclosure provide a method for configuring DNS64 and NAT64, which adopts the following technical solutions:

[0007] The firewall issues a pre-configured NAT64 policy and automatically enables an IPv6 DNS server based on the DNS64 prefix address configured in the NAT64 policy; wherein the destination IPv6 address of the NAT64 policy references the DNS64 prefix address, and the destination IPv4 address of the NAT64 policy is configured as the IPv4 DNS server address;

[0008] When the firewall receives a DNS request message sent by an IPv6 client with a destination address being an IPv6 DNS server address, and the DNS request message successfully matches the NAT64 policy, the firewall converts the DNS request message to obtain a DNS conversion message;

[0009] Sending the DNS conversion message to the IPv4 DNS server through a router, and after receiving the DNS response message from the IPv4 DNS server, converting the DNS response message and sending it to the IPv6 client;

[0010] When the firewall receives the service message sent by the IPv6 client and there is a corresponding cache, it directly performs NAT64 conversion to convert the destination IPv6 address into the IPv4 service server address.

[0011] In some embodiments, after the firewall receives a DNS request message sent by the IPv6 client and whose destination address is the IPv6 DNS server address, the method further includes:

[0012] When the format of the IPv6 DNS server address conforms to the format of the DNS64 prefix address, querying the IPv6 routing table;

[0013] If the IPv6 routing table contains the IPv6 DNS server address, the DNS request message is directly forwarded to the IPv6 DNS server through the router;

[0014] If the IPv6 DNS server address is not found in the IPv6 routing table, the DNS request message is matched with the NAT64 policy.

[0015] In some embodiments, the method further comprises:

[0016] If the DNS request message successfully matches the NAT64 policy, query the cached correspondence between the domain name and the IPv6 DNS server address;

[0017] When a cache correspondence between the domain name and the IPv6 DNS server address is found, converting the IPv6 service server address of the DNS request message into an IPv4 service server address according to the cache correspondence;

[0018] When no cache correspondence between the domain name and the IPv6 DNS server address is found, a DNS cache table is generated and a cache status is recorded; wherein the DNS cache table includes the domain name, the IPv6 domain name server address, the IPv4 domain name server address and the cache status DNS REQ;

[0019] If the DNS request message fails to match the NAT64 policy, the DNS request message is discarded.

[0020] In some embodiments, converting the DNS request message to obtain a DNS conversion message includes:

[0021] Convert the destination address of the DNS request message to the IPv4 DNS server address configured by the NAT64 policy;

[0022] The domain name type of the DNS request message is converted from AAAA type to A type to obtain the DNS conversion message.

[0023] In some embodiments, after receiving the DNS response message from the IPv4 DNS server, the method further includes:

[0024] Update the cache state DNS REQ of the DNS cache table to DNS RESPON;

[0025] Add the IPv4 service server address and the IPv6 service server address to the DNS cache table.

[0026] In some embodiments, converting the DNS response message and sending it to the IPv6 client includes:

[0027] Convert the domain name type of the DNS response message from type A to type AAAA;

[0028] Converting the application layer address of the DNS response message from the IPv4 DNS server address to an IPv4 service server address including the DNS64 prefix address;

[0029] The DNS response message is sent to the IPv6 client, so that the IPv6 client obtains the destination address of the DNS request as the IPv6 DNS server address, and sends a service message to the IPv6 DNS server address.

[0030] In some embodiments, when the firewall receives a service message sent by the IPv6 client and there is a corresponding cache, NAT64 conversion is directly performed to convert the destination IPv6 address into an IPv4 service server address, including:

[0031] When the firewall receives the service message sent by the IPv6 client and finds that there is a correspondence between the IPv6 DNS server address and the IPv4 service server address in the DNS cache table;

[0032] The destination IPv6 address is converted from the IPv6 DNS server address to an IPv4 service server address, and the source IPv6 address of the IPv6 client is converted to a source IPv4 address.

[0033] In a second aspect, the embodiments of the present disclosure further provide a configuration device for DNS64 and NAT64, which adopts the following technical solution:

[0034] a policy configuration unit configured to issue a pre-configured NAT64 policy to the firewall and automatically enable an IPv6 DNS server according to a DNS64 prefix address configured in the NAT64 policy; wherein the destination IPv6 address of the NAT64 policy references the DNS64 prefix address, and the destination IPv4 address of the NAT64 policy is configured as an IPv4 DNS server address;

[0035] a message conversion unit configured to, when the firewall receives a DNS request message sent by an IPv6 client and whose destination address is an IPv6 DNS server address, and when the DNS request message successfully matches the NAT64 policy, convert the DNS request message to obtain a DNS conversion message;

[0036] a message sending unit configured to send the DNS conversion message to the IPv4 DNS server through a router, and after receiving the DNS reply message from the IPv4 DNS server, convert the DNS reply message and send it to the IPv6 client;

[0037] The NAT64 conversion unit is configured to directly perform NAT64 conversion when the firewall receives a service message sent by the IPv6 client and there is a corresponding cache, and convert the destination IPv6 address into an IPv4 service server address.

[0038] In a third aspect, the present disclosure also provides an electronic device that employs the following technical solution:

[0039] The electronic device comprises:

[0040] at least one processor; and,

[0041] a memory communicatively connected to the at least one processor; wherein,

[0042] The memory stores instructions that can be executed by the at least one processor, and the instructions are executed by the at least one processor to enable the at least one processor to perform any of the above-mentioned DNS64 and NAT64 configuration methods.

[0043] In a fourth aspect, an embodiment of the present disclosure further provides a computer-readable storage medium, which stores computer instructions, and the computer instructions are used to enable a computer to execute any of the above-mentioned DNS64 and NAT64 configuration methods.

[0044] The embodiments of the present disclosure provide a method and apparatus for configuring DNS64 and NAT64. The DNS server address of an IPv4 client is mapped via a DNS64 prefix, which can be directly mapped to an IPv6 address. By configuring a NAT64 policy, a user can implement DNS64 and NAT64 service functions, i.e., implement the function of an IPv6 client accessing an IPv4 service server. This method can reduce the difficulty of configuring DNS64 and NAT64 policies, simplify the configuration process, and improve ease of use.

[0045] The above description is only an overview of the technical solution of the present disclosure. In order to more clearly understand the technical means of the present disclosure, it can be implemented in accordance with the contents of the specification. In order to make the above and other purposes, features and advantages of the present disclosure more obvious and easy to understand, the following specifically cites preferred embodiments and describes them in detail with reference to the accompanying drawings. BRIEF DESCRIPTION OF THE DRAWINGS

[0046] In order to more clearly illustrate the technical solutions of the embodiments of the present disclosure, the following briefly introduces the drawings required for use in the embodiments. Obviously, the drawings described below are only some embodiments of the present disclosure. For ordinary technicians in this field, other drawings can be obtained based on these drawings without any creative work.

[0047] Figure 1 A schematic diagram of a DNS64 and NAT64 configuration method flow is provided for an embodiment of the present disclosure;

[0048] Figure 2 A schematic diagram illustrating the implementation principle of a DNS64 and NAT64 configuration method provided in an embodiment of the present disclosure;

[0049] Figure 3 A schematic diagram of the structure of a DNS64 and NAT64 configuration device provided in an embodiment of the present disclosure;

[0050] Figure 4 A schematic structural diagram of an electronic device provided in an embodiment of the present disclosure. DETAILED DESCRIPTION

[0051] The embodiments of the present disclosure are described in detail below with reference to the accompanying drawings.

[0052] It should be clear that the following embodiments of the present disclosure are described through specific concrete examples, and those skilled in the art can easily understand other advantages and effects of the present disclosure from the contents disclosed in this specification. Obviously, the described embodiments are only a part of the embodiments of the present disclosure, rather than all the embodiments. The present disclosure can also be implemented or applied through other different specific embodiments, and the details in this specification can also be modified or changed in various ways based on different viewpoints and applications without departing from the spirit of the present disclosure. It should be noted that the following embodiments and features in the embodiments can be combined with each other in the absence of conflict. Based on the embodiments in the present disclosure, all other embodiments obtained by ordinary technicians in this field without making creative work are within the scope of protection of the present disclosure.

[0053] It should be noted that various aspects of the embodiments within the scope of the appended claims are described below. It should be apparent that the aspects described herein can be embodied in a wide variety of forms, and any specific structure and / or function described herein is merely illustrative. Based on this disclosure, it should be understood by those skilled in the art that an aspect described herein can be implemented independently of any other aspect, and two or more of these aspects can be combined in various ways. For example, any number of aspects described herein can be used to implement the device and / or practice the method. In addition, other structures and / or functionalities other than one or more of the aspects described herein can be used to implement this device and / or practice this method.

[0054] It should also be noted that the illustrations provided in the following embodiments are only schematic illustrations of the basic concept of the present disclosure. The illustrations only show components related to the present disclosure and are not drawn according to the number, shape and size of components in actual implementation. In actual implementation, the type, quantity and proportion of each component can be changed at will, and the component layout type may also be more complicated.

[0055] Additionally, in the following description, specific details are provided to provide a thorough understanding of the examples. However, one skilled in the art will appreciate that the aspects described can be practiced without these specific details.

[0056] Figure 1 A schematic flow chart of a method for configuring DNS64 and NAT64 is provided for an embodiment of the present disclosure. The method for configuring DNS64 and NAT64 provided by an embodiment of the present disclosure includes the following steps:

[0057] S101. The firewall issues a pre-configured NAT64 policy and automatically enables an IPv6 DNS server based on the DNS64 prefix address configured in the NAT64 policy. The destination IPv6 address of the NAT64 policy references the DNS64 prefix address, and the destination IPv4 address of the NAT64 policy is configured as the IPv4 DNS server address.

[0058] Optionally, the DNS64 prefix address is 64::649B:: / 96.

[0059] The IPv6 DNS server address format accessed by IPv6 clients must conform to the DNS64 prefix address format. When a NAT64 policy is delivered, if the DNS64 prefix address is detected in the NAT64 policy, the DNS server is automatically enabled.

[0060] S102: When the firewall receives a DNS request message sent by the IPv6 client with the destination address being the IPv6 DNS server address, and the DNS request message successfully matches the NAT64 policy, the firewall converts the DNS request message to obtain a DNS conversion message.

[0061] S103: Send the DNS conversion message to the IPv4 DNS server through the router, and after receiving the DNS response message from the IPv4 DNS server, convert the DNS response message and send it to the IPv6 client.

[0062] S104: When the firewall receives a service message sent by the IPv6 client and has a corresponding cache, it directly performs NAT64 conversion to convert the destination IPv6 address into an IPv4 service server address.

[0063] The disclosed embodiment maps the DNS server address of the IPv4 client through the DNS64 prefix, which can be directly mapped to an IPv6 address. The user can implement the DNS64 and NAT64 service functions by configuring a NAT64 policy, that is, the function of the IPv6 client accessing the IPv4 service server. This can reduce the difficulty of configuring DNS64 and NAT64 policies, simplify the configuration process, and increase ease of use.

[0064] In some embodiments, after the firewall receives a DNS request message sent by the IPv6 client and whose destination address is the IPv6 DNS server address, the method further includes:

[0065] When the format of the IPv6 DNS server address conforms to the format of the DNS64 prefix address, the IPv6 routing table is queried;

[0066] If the IPv6 routing table contains the IPv6 DNS server address, the DNS request message is directly forwarded to the IPv6 DNS server through the router;

[0067] If the IPv6 routing table does not contain the IPv6 DNS server address, the NAT64 process is entered to match the DNS request message with the NAT64 policy.

[0068] Optionally, if the IPv6 routing table contains the IPv6 DNS server address, the DNS request message is directly forwarded. This allows the DNS request message (IPv6 message) to communicate with the IPv6 client and the IPv6 DNS server.

[0069] In some embodiments, the method further comprises:

[0070] If the DNS request message matches the NAT64 policy, the cached mapping between the domain name and the IPv6 DNS server address is queried.

[0071] When the cached correspondence between the domain name and the IPv6 DNS server address is found, the IPv6 service server address in the DNS request message is converted to the IPv4 service server address according to the cached correspondence;

[0072] When no cache correspondence between the domain name and the IPv6 DNS server address is found, a DNS cache table is generated and the cache status is recorded; wherein the DNS cache table includes the domain name, IPv6 domain name server address, IPv4 domain name server address and cache status DNS REQ;

[0073] If the DNS request packet fails to match the NAT64 policy, the DNS request packet is discarded.

[0074] In some embodiments, converting the DNS request message to obtain a DNS conversion message includes:

[0075] Translate the destination address of the DNS request message into the IPv4 DNS server address configured by the NAT64 policy;

[0076] The domain name type of the DNS request message is converted from AAAA to A to obtain a DNS conversion message.

[0077] Optionally, the DNS request message is converted into an address, a protocol, or a domain name type, and the DNS conversion message is sent to an IPv4 DNS server.

[0078] In some embodiments, after receiving the DNS response message from the IPv4 DNS server, the method further includes:

[0079] Update the cache state DNS REQ of the DNS cache table to DNS RESPON;

[0080] Add the IPv4 service server address and IPv6 service server address to the DNS cache table.

[0081] In some embodiments, converting the DNS response message and sending it to the IPv6 client includes:

[0082] Convert the domain name type of the DNS response message from type A to type AAAA;

[0083] Convert the application layer address of the DNS response message from the IPv4 DNS server address to the IPv4 service server address containing the DNS64 prefix address;

[0084] The DNS reply message is sent to the IPv6 client so that the IPv6 client obtains the destination address of the DNS request as the IPv6 DNS server address and sends the service message to the IPv6 DNS server address.

[0085] In some embodiments, when the firewall receives a service message sent by an IPv6 client and has a corresponding cache, it directly performs NAT64 conversion to convert the destination IPv6 address to the IPv4 service server address, including:

[0086] When the firewall receives a service packet from an IPv6 client and finds a correspondence between the IPv6 DNS server address and the IPv4 service server address in the DNS cache table,

[0087] The destination IPv6 address is translated from the IPv6 DNS server address to the IPv4 service server address, and the source IPv6 address of the IPv6 client is translated to the source IPv4 address.

[0088] Figure 2 A schematic diagram illustrating the implementation principle of a method for configuring DNS64 and NAT64 provided in an embodiment of the present disclosure, wherein the source IPv6 address of the IPv6 client is 1000::100, the IPv6 DNS server address configured by the IPv6 client is 64:649b::1e01:010a, and the DNS64 prefix address configured on the firewall is 64:649b:: / 96.

[0089] The firewall issues NAT64 policy A. The destination IPv6 address of NAT64 policy A references the DNS64 prefix address. The destination IPv4 address of NAT64 policy A is the IPv4 DNS server address: 30.1.1.10. The source IPv4 address of NAT64 policy A is 10.1.1.1, and the source IPv6 address is 1000::100. After NAT64 policy A is issued, the IPv6 DNS server is automatically enabled because the DNS64 prefix is ​​referenced.

[0090] If you enter www.xxxxx.com in the IPv6 client's browser, the IPv6 client will initiate a DNS request to the IPv6 DNS server: 1000::100--------64:649b::1e01:010a (DNS request, domain name type is AAAA). After receiving this DNS request, the firewall matches NAT64 policy A and translates the protocol, address, and DNS request type (domain name type) of the DNS request message: 10.1.1.10---------30.1.1.10 (DNS request, domain name type is A). The resulting DNS translation message is then forwarded to the router.

[0091] The firewall generates a DNS cache table and records the cache status as DNS REQ. The IPv6 DNS server address before translation is 64::649b::1e01:010a, and the DNS server address after translation is 30.1.1.10. The domain name is www.xxxxx.com.

[0092] After receiving the DNS request, the IPv4 DNS server finds that the domain name www.xxxxx.com corresponds to the IP address 40.1.1.10. The IPv4 DNS server then returns a DNS reply message with a source address of 30.1.1.10, a destination address of 10.1.1.10, a domain name type of A, and an address in the answer field of 40.1.1.10.

[0093] The firewall receives the DNS reply message, performs address, protocol, and domain name type translation, and sends the translated DNS reply message to the IPv6 client: 64:649b::1e01:010a------------1000::100. The domain name type is AAAA, and the address in the answer field of the DNS reply message is 64:649b::2801:010. The firewall also updates the DNS cache table, changing the cache state from DNS REQ to DNS RESPON, and adding the IPv4 and IPv6 service server addresses (i.e., the addresses in the answer field of the DNS reply message) to the DNS cache table.

[0094] After receiving the DNS response message, the IPv6 client obtains the IPv6 DNS server address corresponding to the Baidu server, which is 64:649b::2801:010. It then initiates a service message (for example, a TCP request message) to the IPv6 DNS server address.

[0095] After receiving the service packet, the firewall enters the NAT64 process and finds a mapping between the IPv6 DNS server address 64:649b::2801:010 and the IPv4 service server address 40.1.1.10 in the DNS cache table. Therefore, the firewall performs NAT64 translation, translating the IPv6 client's source IPv6 address 1000::100 into the source IPv4 address 10.1.1.10 and the IPv6 DNS server address 64:649b::2801:010 into the IPv4 service server address 40.1.1.10.

[0096] This disclosed embodiment uses a unique DNS64 prefix address (64:649b:: / 96) to directly map a known IPv4 DNS server address to an IPv6 address. Using a cache query mechanism, service packets can be directly matched with NAT64 policies for protocol and address translation. Users only need to configure a single NAT64 policy to implement DNS64 and NAT64 service functionality. This reduces the difficulty of configuring DNS64 and NAT64 policies, simplifies the configuration process, and enhances ease of use.

[0097] Figure 3 This is a schematic diagram of the structure of a DNS64 and NAT64 configuration device provided in an embodiment of the present disclosure. The embodiment of the present disclosure also provides a DNS64 and NAT64 configuration device, including:

[0098] The policy configuration unit 31 is configured to issue a pre-configured NAT64 policy to the firewall and automatically enable an IPv6 DNS server based on the DNS64 prefix address configured in the NAT64 policy; wherein the destination IPv6 address of the NAT64 policy references the DNS64 prefix address, and the destination IPv4 address of the NAT64 policy is configured as the IPv4 DNS server address;

[0099] The message conversion unit 32 is configured to, when the firewall receives a DNS request message sent by the IPv6 client with the destination address being the IPv6 DNS server address and the DNS request message successfully matches the NAT64 policy, convert the DNS request message to obtain a DNS conversion message;

[0100] The message sending unit 33 is configured to send the DNS conversion message to the IPv4 DNS server through the router, and after receiving the DNS response message from the IPv4 DNS server, convert the DNS response message and send it to the IPv6 client;

[0101] The NAT64 conversion unit 34 is configured to directly perform NAT64 conversion when the firewall receives a service message sent by the IPv6 client and there is a corresponding cache, and convert the destination IPv6 address into an IPv4 service server address.

[0102] An electronic device according to an embodiment of the present disclosure includes a memory and a processor. The memory is used to store non-transitory computer-readable instructions. Specifically, the memory may include one or more computer program products, which may include various forms of computer-readable storage media, such as volatile memory and / or non-volatile memory. The volatile memory may include, for example, random access memory (RAM) and / or cache memory. The non-volatile memory may include, for example, read-only memory (ROM), a hard disk, flash memory, etc.

[0103] The processor may be a central processing unit (CPU) or other form of processing unit with data processing capabilities and / or instruction execution capabilities, and may control other components in the electronic device to perform desired functions. In one embodiment of the present disclosure, the processor is configured to execute the computer-readable instructions stored in the memory, causing the electronic device to perform all or part of the steps of the DNS64 and NAT64 configuration method described in the aforementioned embodiments of the present disclosure.

[0104] Those skilled in the art should understand that in order to solve the technical problem of how to obtain a good user experience, this embodiment may also include well-known structures such as a communication bus and an interface, and these well-known structures should also be included in the scope of protection of this disclosure.

[0105] like Figure 4 The present invention provides a schematic structural diagram of an electronic device according to an embodiment of the present invention, which is suitable for implementing the electronic device according to an embodiment of the present invention. Figure 4 The electronic device shown is only an example and should not limit the functions and scope of use of the embodiments of the present disclosure.

[0106] like Figure 4 As shown, an electronic device may include a processor (e.g., a central processing unit, a graphics processing unit, etc.), which can perform various appropriate actions and processes based on programs stored in a read-only memory (ROM) or programs loaded from a storage device into a random access memory (RAM). The RAM also stores various programs and data required for the operation of the electronic device. The processor, ROM, and RAM are connected to each other via a bus. An input / output (I / O) interface is also connected to the bus.

[0107] Typically, the following devices can be connected to the I / O interface: input devices such as sensors or visual information acquisition devices; output devices such as display screens; storage devices such as tapes and hard disks; and communication devices. The communication device allows the electronic device to communicate with other devices (such as edge computing devices) wirelessly or by wire to exchange data. Figure 4 The electronic device is shown with various devices, but it should be understood that it is not required to implement or possess all of the devices shown. More or fewer devices may be implemented or possessed instead.

[0108] In particular, according to an embodiment of the present disclosure, the process described above with reference to the flowchart can be implemented as a computer software program. For example, an embodiment of the present disclosure includes a computer program product comprising a computer program carried on a non-transitory computer-readable medium, the computer program comprising program code for executing the method shown in the flowchart. In such an embodiment, the computer program can be downloaded and installed from a network via a communication device, or installed from a storage device, or installed from a ROM. When the computer program is executed by a processor, all or part of the steps of a method for configuring DNS64 and NAT64 of an embodiment of the present disclosure are performed.

[0109] For detailed description of this embodiment, please refer to the corresponding description in the aforementioned embodiments, which will not be repeated here.

[0110] According to an embodiment of the present disclosure, a computer-readable storage medium stores non-transitory computer-readable instructions. When the non-transitory computer-readable instructions are executed by a processor, all or part of the steps of the DNS64 and NAT64 configuration method described in each embodiment of the present disclosure are executed.

[0111] The above-mentioned computer-readable storage media include, but are not limited to, optical storage media (e.g., CD-ROMs and DVDs), magneto-optical storage media (e.g., MOs), magnetic storage media (e.g., magnetic tapes or mobile hard disks), media with built-in rewritable non-volatile memory (e.g., memory cards), and media with built-in ROM (e.g., ROM cartridges).

[0112] For detailed description of this embodiment, please refer to the corresponding description in the aforementioned embodiments, which will not be repeated here.

[0113] The basic principles of the present disclosure have been described above in conjunction with specific embodiments. However, it should be noted that the advantages, strengths, and effects mentioned in this disclosure are merely illustrative and not restrictive, and should not be construed as necessarily possessed by each embodiment of the present disclosure. Furthermore, the specific details disclosed above are provided for illustrative purposes and to facilitate understanding, rather than as limitations. These details do not limit the present disclosure to necessarily being implemented using these specific details.

[0114] In the present disclosure, relational terms such as first and second, etc. are merely used to distinguish one entity or operation from another entity or operation, and do not necessarily require or imply that there is any such actual relationship or order between these entities or operations. The block diagrams of the devices, devices, equipment, and systems involved in the present disclosure are merely illustrative examples and are not intended to require or imply that they must be connected, arranged, or configured in the manner shown in the block diagrams. As will be appreciated by those skilled in the art, these devices, devices, equipment, and systems can be connected, arranged, or configured in any manner. Words such as "including," "comprising," "having," and the like are open-ended words, meaning "including but not limited to," and can be used interchangeably therewith. The words "or" and "and" used herein refer to the words "and / or" and can be used interchangeably therewith, unless the context clearly indicates otherwise. The word "such as" used herein refers to the phrase "such as but not limited to," and can be used interchangeably therewith.

[0115] Additionally, as used herein, "or" used in a list of items beginning with "at least one" indicates a separate list, so that, for example, a list of "at least one of A, B, or C" means A or B or C, or AB or AC or BC, or ABC (i.e., A and B and C). Moreover, the word "exemplary" does not mean that the example described is preferred or better than other examples.

[0116] It should also be noted that in the system and method of the present disclosure, each component or each step can be decomposed and / or recombined. Such decomposition and / or recombination should be regarded as equivalent solutions of the present disclosure.

[0117] Various changes, substitutions, and modifications may be made to the technology described herein without departing from the teachings defined by the appended claims. Moreover, the scope of the claims of this disclosure is not limited to the specific aspects of the processes, machines, manufactures, compositions of things, means, methods, and actions described above. Currently existing or later developed processes, machines, manufactures, compositions of things, means, methods, or actions that perform substantially the same function or achieve substantially the same results as the corresponding aspects described herein may be utilized. Accordingly, the appended claims include within their scope such processes, machines, manufactures, compositions of things, means, methods, or actions.

[0118] The above description of the disclosed aspects is provided to enable any person skilled in the art to make or use the present disclosure. Various modifications to these aspects will be readily apparent to those skilled in the art, and the general principles defined herein may be applied to other aspects without departing from the scope of the present disclosure. Therefore, the present disclosure is not intended to be limited to the aspects shown herein, but rather to be accorded the widest scope consistent with the principles and novel features disclosed herein.

[0119] The above description has been provided for the purpose of illustration and description. In addition, this description is not intended to limit the embodiments of the present disclosure to the forms disclosed herein. Although a number of example aspects and embodiments have been discussed above, those skilled in the art will recognize certain variations, modifications, alterations, additions, and sub-combinations thereof.

Claims

1. A method for configuring DNS64 and NAT64, characterized in that: include: The firewall issues a pre-configured NAT64 policy and automatically enables an IPv6 DNS server based on the DNS64 prefix address configured in the NAT64 policy; wherein the destination IPv6 address of the NAT64 policy references the DNS64 prefix address, and the destination IPv4 address of the NAT64 policy is configured as the IPv4 DNS server address; When the firewall receives a DNS request message sent by an IPv6 client with a destination address being an IPv6 DNS server address, and the DNS request message successfully matches the NAT64 policy, the firewall converts the DNS request message to obtain a DNS conversion message; Sending the DNS conversion message to the IPv4 DNS server through a router, and after receiving the DNS response message from the IPv4 DNS server, converting the DNS response message and sending it to the IPv6 client; When the firewall receives the service message sent by the IPv6 client and there is a corresponding cache, it directly performs NAT64 conversion to convert the destination IPv6 address into the IPv4 service server address; After the firewall receives a DNS request message sent by the IPv6 client and whose destination address is the IPv6 DNS server address, the method further includes: When the format of the IPv6 DNS server address conforms to the format of the DNS64 prefix address, querying the IPv6 routing table; If the IPv6 routing table contains the IPv6 DNS server address, the DNS request message is directly forwarded to the IPv6 DNS server through the router; If the IPv6 DNS server address is not found in the IPv6 routing table, matching the DNS request message with the NAT64 policy; The method further comprises: If the DNS request message successfully matches the NAT64 policy, query the cached correspondence between the domain name and the IPv6 DNS server address; When a cache correspondence between the domain name and the IPv6 DNS server address is found, converting the IPv6 service server address of the DNS request message into an IPv4 service server address according to the cache correspondence; When no cache correspondence between the domain name and the IPv6 DNS server address is found, a DNS cache table is generated and a cache status is recorded; wherein the DNS cache table includes the domain name, the IPv6 domain name server address, the IPv4 domain name server address and the cache status DNS REQ; If the DNS request message fails to match the NAT64 policy, discard the DNS request message; When the firewall receives the service message sent by the IPv6 client and there is a corresponding cache, it directly performs NAT64 conversion to convert the destination IPv6 address into the IPv4 service server address, including: When the firewall receives the service message sent by the IPv6 client and finds that there is a correspondence between the IPv6 DNS server address and the IPv4 service server address in the DNS cache table; The destination IPv6 address is converted from the IPv6 DNS server address to an IPv4 service server address, and the source IPv6 address of the IPv6 client is converted to a source IPv4 address.

2. The method for configuring DNS64 and NAT64 according to claim 1, wherein: Converting the DNS request message to obtain a DNS conversion message includes: Convert the destination address of the DNS request message to the IPv4 DNS server address configured by the NAT64 policy; The domain name type of the DNS request message is converted from AAAA type to A type to obtain the DNS conversion message.

3. The method for configuring DNS64 and NAT64 according to claim 2, wherein: After receiving the DNS response message from the IPv4 DNS server, the method further includes: Update the cache state DNS REQ of the DNS cache table to DNS RESPON; Add the IPv4 service server address and the IPv6 service server address to the DNS cache table.

4. The method for configuring DNS64 and NAT64 according to claim 3, wherein: Converting the DNS response message and sending it to the IPv6 client includes: Convert the domain name type of the DNS response message from type A to type AAAA; Converting the application layer address of the DNS response message from the IPv4 DNS server address to an IPv4 service server address including the DNS64 prefix address; The DNS response message is sent to the IPv6 client, so that the IPv6 client obtains the destination address of the DNS request as the IPv6 DNS server address, and sends a service message to the IPv6 DNS server address.

5. A configuration device for DNS64 and NAT64, characterized in that: include: a policy configuration unit configured to issue a pre-configured NAT64 policy to the firewall and automatically enable an IPv6 DNS server according to a DNS64 prefix address configured in the NAT64 policy; wherein the destination IPv6 address of the NAT64 policy references the DNS64 prefix address, and the destination IPv4 address of the NAT64 policy is configured as an IPv4 DNS server address; a message conversion unit configured to, when the firewall receives a DNS request message sent by an IPv6 client and whose destination address is an IPv6 DNS server address, and when the DNS request message successfully matches the NAT64 policy, convert the DNS request message to obtain a DNS conversion message; a message sending unit configured to send the DNS conversion message to the IPv4 DNS server through a router, and after receiving the DNS reply message from the IPv4 DNS server, convert the DNS reply message and send it to the IPv6 client; a NAT64 conversion unit configured to directly perform NAT64 conversion to convert the destination IPv6 address into an IPv4 service server address when the firewall receives a service message sent by the IPv6 client and a corresponding cache exists; After the firewall receives a DNS request message sent by an IPv6 client and whose destination address is an IPv6 DNS server address, the configuration device is further configured to: When the format of the IPv6 DNS server address conforms to the format of the DNS64 prefix address, querying the IPv6 routing table; If the IPv6 routing table contains the IPv6 DNS server address, the DNS request message is directly forwarded to the IPv6 DNS server through the router; If the IPv6 DNS server address is not found in the IPv6 routing table, matching the DNS request message with the NAT64 policy; The configuration device is also used for: If the DNS request message successfully matches the NAT64 policy, query the cached correspondence between the domain name and the IPv6 DNS server address; When a cache correspondence between the domain name and the IPv6 DNS server address is found, converting the IPv6 service server address of the DNS request message into an IPv4 service server address according to the cache correspondence; When no cache correspondence between the domain name and the IPv6 DNS server address is found, a DNS cache table is generated and a cache status is recorded; wherein the DNS cache table includes the domain name, the IPv6 domain name server address, the IPv4 domain name server address and the cache status DNS REQ; If the DNS request message fails to match the NAT64 policy, discard the DNS request message; When the firewall receives the service message sent by the IPv6 client and there is a corresponding cache, it directly performs NAT64 conversion to convert the destination IPv6 address into the IPv4 service server address, including: When the firewall receives the service message sent by the IPv6 client and finds that there is a correspondence between the IPv6 DNS server address and the IPv4 service server address in the DNS cache table; The destination IPv6 address is converted from the IPv6 DNS server address to an IPv4 service server address, and the source IPv6 address of the IPv6 client is converted to a source IPv4 address.

6. An electronic device, characterized in that: The electronic device comprises: at least one processor; and, a memory communicatively connected to the at least one processor; wherein, The memory stores instructions that can be executed by the at least one processor, and the instructions are executed by the at least one processor to enable the at least one processor to perform the DNS64 and NAT64 configuration method described in any one of claims 1 to 4.

7. A computer-readable storage medium, characterized in that The computer-readable storage medium stores computer instructions, which are used to enable a computer to execute the DNS64 and NAT64 configuration method according to any one of claims 1 to 4.

Images