Port forwarding method and device and storage medium
Through adaptive generation and forwarding configuration and real-time monitoring, the problems of complex configuration, security risks and limited performance in port forwarding technology are solved, efficient and secure port forwarding are achieved, and the risk of single point of failure and illegal access is reduced.
Patent Information
- Application Number
- CN202411442188.5
- Authority / Receiving Office
- CN · China
- Patent Type
- Applications(China)
- Current Assignee / Owner
- Filing Date
- 2024-10-16
- Publication Date
- 2024-12-31
AI Technical Summary
The existing port forwarding technology has complex configuration, security risks, limited performance and single point of failure risks, lack of security monitoring and port auditing, resulting in resource consumption, information leakage and illegal access.
Adaptive generation and forwarding configuration is adopted, and configuration scripts are generated by parsing the forwarding topology, forwarding tunnels are established and managed, data encapsulation and encryption, request legitimacy, real-time monitoring and statistics, and tunnel establishment and destruction are automatically established and destroyed.
Simplifies port forwarding configuration, reduces the risk of configuration errors, improves network security and tunnel reliability, avoids illegal access and data leakage, supports multiple policies and configuration methods, and adapts to different network environments.
Smart Images
Figure CN119232578A_ABST
Abstract
Description
Technical Field
[0001] The invention relates to a port forwarding method, device and storage medium, and belongs to the technical field of computer network. Background Art
[0002] In computer networks, port forwarding is a common technology used to forward access requests for specific ports from an external network to a specific device or service in an internal network.
[0003] SSH tunneling is an effective port forwarding technology that allows us to establish a secure connection on an insecure network: encrypt data communications between the SSH client and the SSH server; and break through firewall restrictions to complete some TCP connections that could not be established before.
[0004] With the help of port forwarding, a secure channel is established between the external network and the internal network to realize data forwarding between ports. Through appropriate configuration and implementation, we can achieve flexible, secure and efficient network communication. However, there are still some problems: (1) Port forwarding configuration is complex. Improper port forwarding settings will cause port exposure. Malicious attacks will consume the resources and bandwidth of the destination host, thus paralyzing it. (2) Lack of security monitoring. Attackers may obtain information transmitted through the port forwarding channel, which may lead to security risks such as sensitive information leakage and data tampering. (3) Port forwarding relies on a forwarding server, which has limited performance and bandwidth and poses a single point of failure risk; (4) Lack of port auditing and incorrect port forwarding may allow unauthorized clients to bypass network defenses and illegally access data or services on the intranet.
[0005] These issues show that while port forwarding technology provides a method for secure network communication, it must be set up and used with caution to avoid potential security risks. Proper configuration and management are key to ensuring network security. Summary of the invention
[0006] The purpose of the present invention is to overcome the deficiencies in the prior art and provide a port forwarding method, device and storage medium, which replaces manual configuration by adaptively generating forwarding configuration, simplifies the port forwarding configuration, and reduces the risk of port exposure caused by improper configuration.
[0007] To achieve the above object, the present invention is implemented by adopting the following technical solutions: In a first aspect, the present invention provides a port forwarding method, comprising: In response to receiving a forwarding request from a client, obtaining a source address, a destination address, a forwarding type, and a forwarding topology included in the forwarding request; wherein the forwarding topology is used to describe a network connection relationship between the client and the server; By parsing the forwarding topology, a configuration script for establishing a forwarding tunnel between the client and the server is generated; Run the configuration script on the forwarding device, generate a forwarding configuration, and establish a forwarding tunnel between the client and the server; According to the source address, the destination address and the forwarding type included in the forwarding request, data is forwarded between the client and the server through the forwarding tunnel until the forwarding of the data to be forwarded is completed.
[0008] Furthermore, the configuration script is adaptively generated according to the type and implementation mechanism of the forwarding device.
[0009] Furthermore, running the configuration script on the forwarding device includes: installing a forwarding tool corresponding to the configuration script on the client and the server, and starting the service corresponding to the forwarding tool.
[0010] Furthermore, before parsing the forwarding topology, the method further includes: verifying whether the forwarding request complies with a forwarding strategy preset by a forwarding device according to the source address, the target address and the forwarding topology included in the forwarding request, In response to the forwarding policy preset by the forwarding device being met, the forwarding request is accepted; In response to not complying with the forwarding policy preset by the forwarding device, the forwarding request is rejected.
[0011] Furthermore, the client and the server forward the data to be forwarded through the forwarding tunnel, including: encapsulating and encrypting the data to be forwarded at the data sending end; and decapsulating and decrypting the received data at the data receiving end.
[0012] Furthermore, the configuration script also includes: an execution logic for destroying the tunnel; after the forwarding of the data to be forwarded is completed, it also includes: destroying the forwarding tunnel by running the execution logic for destroying the tunnel in the configuration script on the forwarding device.
[0013] In a second aspect, the present invention provides a port forwarding device, comprising: Receiving module: used to receive a forwarding request from a client and obtain the source address, destination address, forwarding type and forwarding topology contained in the forwarding request; Configuration script generation module: used to parse the forwarding topology and generate a configuration script for establishing a forwarding tunnel between the client and the server; Configuration script running module: used to run the configuration script on the forwarding device, generate forwarding configuration, and establish a forwarding tunnel between the client and the server; Data forwarding module: used to forward data between the client and the server through the forwarding tunnel.
[0014] Further, the device also includes: a verification module: used to verify whether the forwarding request complies with the forwarding strategy preset by the forwarding device according to the source address, target address and forwarding topology included in the forwarding request; Data processing module: used to encapsulate and encrypt the data to be forwarded at the data sending end, and to decapsulate and decrypt the received data at the data receiving end; The configuration script running module is further used to: destroy the forwarding tunnel by running the execution logic of destroying the tunnel in the configuration script on the forwarding device.
[0015] Furthermore, the device also includes: a monitoring and statistics module; the monitoring and statistics module is used to perform real-time monitoring and data storage on the operating status of the port forwarding device, and to perform statistics and analysis on the stored monitoring data to optimize or troubleshoot the forwarding device.
[0016] In a third aspect, the present invention provides a computer-readable storage medium having a computer program stored thereon, and when the computer program is executed by a processor, the port forwarding method as described in the first aspect is implemented.
[0017] Compared with the prior art, the present invention has the following beneficial effects: (1) The port forwarding method provided by the present invention adaptively generates a configuration script for establishing a forwarding tunnel between a client and a server according to the forwarding topology contained in the forwarding request, and generates a forwarding configuration according to the configuration script, thereby establishing a forwarding tunnel. By adaptively generating a forwarding configuration instead of manual configuration, the port forwarding configuration process is simplified and the port forwarding efficiency is improved, and the risk of port exposure caused by improper configuration is greatly reduced. (2) The port forwarding method provided by the present invention encapsulates and encrypts the information transmitted in the port forwarding tunnel, and the forwarding receiving end decapsulates and decrypts the received information, thereby preventing the forwarded information from being leaked and tampered with during the transmission process, thereby improving the reliability of the forwarding tunnel and effectively protecting the security of the forwarding network; (3) The port forwarding method provided by the present invention verifies the forwarding request after receiving it, and removes the forwarding request that does not comply with the preset forwarding policy, thereby preventing unauthorized clients from illegally accessing data or services in the intranet due to incorrect port forwarding; (4) The port forwarding method provided by the present invention is highly flexible, supports a variety of forwarding strategies and configuration methods, automatically establishes a forwarding tunnel through a configuration script, can adapt to different network environments and business requirements, and is convenient for expansion and upgrading. BRIEF DESCRIPTION OF THE DRAWINGS
[0018] Figure 1 This is a flow chart of the port forwarding method provided in Embodiment 1 of the present invention; Figure 2 A schematic diagram of a forwarding topology in Embodiment 1 of the present invention; Figure 3 This is a schematic diagram of the port forwarding scenario in Example 2 of the present invention. DETAILED DESCRIPTION
[0019] The terms "including" and "having" and any variations thereof in the specification and claims of this application and the above-mentioned drawings are intended to cover non-exclusive inclusions. For example, a process, method, system, product or device that includes a series of steps or units is not necessarily limited to those steps or units clearly listed, but may include other steps or units that are not clearly listed or inherent to these processes, methods, products or devices. The technical solutions in the embodiments of the present application will be clearly and completely described below in conjunction with the drawings in the embodiments of the present application. Obviously, the described embodiments are only part of the embodiments of the present application, not all of the embodiments. Example 1
[0020] This embodiment provides a port forwarding method, such as Figure 1 As shown, the method comprises the following steps: Step 1: In response to receiving a forwarding request from a client, a source address, a destination address, a forwarding type, and a forwarding topology included in the forwarding request are obtained.
[0021] Specifically, Figure 2 As shown, the forwarding topology is used to describe the network connection relationship between the client and the server; through these connection relationships, a forwarding tunnel can be established between the client and the server.
[0022] The forwarding type includes local forwarding or remote forwarding. Local forwarding forwards traffic from the local machine to the remote server, while remote forwarding forwards traffic from the remote server to the local machine.
[0023] Step 2: Verify whether the forwarding request complies with the forwarding strategy preset by the forwarding device according to the source address, target address and forwarding topology included in the forwarding request.
[0024] Specifically, if the forwarding request complies with the forwarding policy preset by the forwarding device, the forwarding request is accepted; if the forwarding request does not comply with the forwarding policy preset by the forwarding device, the forwarding request is rejected.
[0025] Step 3: By parsing the forwarding topology, a configuration script for establishing a forwarding tunnel between the client and the server is generated.
[0026] Specifically, the configuration script is an executable logic used to send configurations to the forwarding device and establish a tunnel. The configuration script is adaptively generated according to the type and implementation mechanism of the forwarding device. According to the forwarding mechanism of the forwarding device, a suitable tool is selected for configuration. Different tools will generate different configuration scripts. For example, if the forwarding device is a Linux server and the implementation mechanism adopts SSH tunnel, the configuration script related to SSH tunnel will be adapted; if the forwarding device is a Linux server and the implementation mechanism adopts iptables, the configuration script related to iptables will be adapted; if the forwarding device is a router and the implementation mechanism adopts NAT, the configuration script related to NAT will be adapted.
[0027] Step 4: Run the configuration script on the forwarding device, generate a forwarding configuration, and establish a forwarding tunnel between the client and the server.
[0028] Specifically, running the configuration script on the forwarding device will install the forwarding tool corresponding to the configuration script on the client and server, and start the service corresponding to the forwarding tool. The configuration is performed through the forwarding tool. Commonly used forwarding tools include iptables, SSH, nginx, etc.
[0029] Step 5: According to the source address, target address and forwarding type included in the forwarding request, data is forwarded between the client and the server through the forwarding tunnel until the forwarding of the data to be forwarded is completed.
[0030] Specifically, after the tunnel is established between the client and the server, the forwarding requester will be authorized. The forwarding requester has the forwarding right, and the data to be forwarded will be encapsulated and encrypted at the data sending end; then the data will be forwarded on the tunnel, and the data will be decapsulated and decrypted after being received at the data receiving end.
[0031] It should be noted that how to forward data on a tunnel is an existing technology and is not within the scope of the present invention.
[0032] Optionally, after the forwarding of the data to be forwarded is completed, the method further includes: destroying the forwarding tunnel by running the execution logic of destroying the tunnel in the configuration script on the forwarding device. Example 2
[0033] This embodiment provides Figure 3 The process of port forwarding in the scenario shown.
[0034] like Figure 3 As shown in the figure, Network 1 is an external network, Network 2 is an internal network, and the client in Network 1 needs to access the server in Network 2 (Web service, port 8080, internal network access http: / / 192.168.10.3:8080). Since Network 1 and Network 2 are isolated, the client cannot access the service on the server.
[0035] S1: Obtain the forwarding topology contained in the forwarding request between the client and the server, and describe it according to the forwarding topology to generate a configuration script and automatically establish a forwarding tunnel.
[0036] In this embodiment, a forwarding tunnel is established based on SSH to complete the access from the client to the server. An SSH server with the ability to access network 1 and network 2 is provided between the client and the server. The SSH tunnel establishes a secure channel between the local and remote hosts through the SSH protocol to implement a method of forwarding data between ports. It allows users to access the services of the server through a secure SSH connection without directly accessing the server host.
[0037] In this embodiment, the configuration script is an SSH command. It should be noted that the configuration script includes but is not limited to the SSH command.
[0038] Depending on whether the forwarding type is local forwarding or remote forwarding, the command format is as follows: Local forwarding: ssh -L local_port:remote_host:remote_port username@ssh_server Among them, local_port is the port monitored on the local machine, remote_host is the address of the remote server, remote_port is the port of the service on the remote server, username is the login username of the remote server, and ssh_server is the server address used to establish the SSH tunnel; Remote forwarding: ssh -R remote_port:local_host:local_port username@ssh_server Among them, remote_port is the port listening on the remote server, local_host is the address of the local machine, and local_port is the port of the service on the local machine.
[0039] S2: After the configuration script is generated, the configuration script is run on the forwarding device to establish a forwarding tunnel between the client and the server.
[0040] Specifically, running the SSH command on the forwarding device will install the SSH forwarding tool on the client and server and start the corresponding service.
[0041] S3: forward data on the forwarding tunnel according to the source address, destination address and forwarding type contained in the forwarding request.
[0042] Specifically, after the tunnel is established between the client and the server, the forwarding requester will be authorized. The forwarding requester has the forwarding right and forwards data on the tunnel.
[0043] More specifically, before data forwarding, the data at the sending end is encapsulated and encrypted, and after the data forwarding is completed, the data at the receiving end is decapsulated and decrypted to ensure the security of the forwarded data.
[0044] S4: After the forwarding requester completes data forwarding, the tunnel is destroyed.
[0045] Specifically, according to the relevant data of the forwarding tunnel, a configuration script related to destroying the forwarding tunnel is run on the forwarding device to destroy the tunnel. Example 3
[0046] This embodiment provides a port forwarding device, including: Receiving module: used to receive a forwarding request from a client and obtain the source address, destination address, forwarding type and forwarding topology contained in the forwarding request; Configuration script generation module: used to parse the forwarding topology and generate a configuration script for establishing a forwarding tunnel between the client and the server; Configuration script running module: used to run the configuration script on the forwarding device, generate forwarding configuration, and establish a forwarding tunnel between the client and the server; Data forwarding module: used to forward data between the client and the server through the forwarding tunnel. Example 4
[0047] On the basis of Embodiment 3, this embodiment provides a port forwarding device further comprising: Verification module: used to verify whether the forwarding request complies with the forwarding strategy preset by the forwarding device according to the source address, target address and forwarding topology included in the forwarding request; Data processing module: used to encapsulate and encrypt the data to be forwarded at the data sending end, and to decapsulate and decrypt the received data at the data receiving end; The device also includes: a monitoring and statistics module; the monitoring and statistics module is used to monitor the operating status of the port forwarding device in real time and store data, and to collect statistics and analyze the stored monitoring data to optimize or troubleshoot the forwarding device; The configuration script running module is further used to: destroy the forwarding tunnel by running the execution logic of destroying the tunnel in the configuration script on the forwarding device. Example 5
[0048] This embodiment provides a computer storage medium, on which a computer program is stored. When the computer program is executed by a processor, the port forwarding method as described in Embodiment 1 or Embodiment 2 is implemented.
[0049] The storage medium may include, for example, a storage component of a tablet computer, a hard disk of a computer, a read-only memory (ROM), an erasable programmable read-only memory (EPROM), a portable compact disk read-only memory (CD-ROM), a USB memory, or any combination of the above storage media. The computer storage medium may be any combination of one or more computer storage media.
[0050] The above embodiments are only used to illustrate the technical solutions of the present application, rather than to limit them. Although the present application has been described in detail with reference to the aforementioned embodiments, those skilled in the art should understand that they can still modify the technical solutions described in the aforementioned embodiments, or make equivalent replacements for some of the technical features therein. However, these modifications or replacements do not deviate the essence of the corresponding technical solutions from the spirit and scope of the technical solutions of the embodiments of the present application.
Claims
1. A port forwarding method, characterized in that: include: In response to receiving a forwarding request from a client, obtaining a source address, a destination address, a forwarding type, and a forwarding topology included in the forwarding request; wherein the forwarding topology is used to describe a network connection relationship between the client and the server; By parsing the forwarding topology, a configuration script for establishing a forwarding tunnel between the client and the server is generated; Run the configuration script on the forwarding device, generate a forwarding configuration, and establish a forwarding tunnel between the client and the server; According to the source address, the destination address and the forwarding type included in the forwarding request, data is forwarded between the client and the server through the forwarding tunnel until the forwarding of the data to be forwarded is completed.
2. The port forwarding method according to claim 1, characterized in that: The configuration script is adaptively generated according to the type and implementation mechanism of the forwarding device.
3. The port forwarding method according to claim 2, characterized in that: The running of the configuration script on the forwarding device includes: installing a forwarding tool corresponding to the configuration script on a client and a server, and starting a service corresponding to the forwarding tool.
4. The port forwarding method according to claim 3, characterized in that: Before parsing the forwarding topology, the method further includes: verifying whether the forwarding request complies with the forwarding strategy preset by the forwarding device according to the source address, the target address and the forwarding topology included in the forwarding request, In response to the forwarding policy preset by the forwarding device being met, the forwarding request is accepted; In response to not complying with the forwarding policy preset by the forwarding device, the forwarding request is rejected.
5. The port forwarding method according to claim 4, characterized in that: The client and the server forward the data to be forwarded through the forwarding tunnel, including: Encapsulate and encrypt the data to be forwarded at the data sending end; The received data is decapsulated and decrypted at the data receiving end.
6. The port forwarding method according to claim 5, characterized in that: The configuration script also includes: execution logic for destroying the tunnel; After the forwarding of the data to be forwarded is completed, the method further includes: destroying the forwarding tunnel by running the execution logic of destroying the tunnel in the configuration script on the forwarding device.
7. A port forwarding device, characterized in that: include: Receiving module: used to receive a forwarding request from a client and obtain the source address, destination address, forwarding type and forwarding topology contained in the forwarding request; Configuration script generation module: used to parse the forwarding topology and generate a configuration script for establishing a forwarding tunnel between the client and the server; Configuration script running module: used to run the configuration script on the forwarding device, generate forwarding configuration, and establish a forwarding tunnel between the client and the server; Data forwarding module: used to forward data between the client and the server through the forwarding tunnel.
8. The port forwarding device according to claim 7, characterized in that: Also includes: Verification module: used to verify whether the forwarding request complies with the forwarding strategy preset by the forwarding device according to the source address, target address and forwarding topology included in the forwarding request; Data processing module: used to encapsulate and encrypt the data to be forwarded at the data sending end, and to decapsulate and decrypt the received data at the data receiving end; The configuration script running module is further used to: destroy the forwarding tunnel by running the execution logic of destroying the tunnel in the configuration script on the forwarding device.
9. The port forwarding device according to claim 8, characterized in that: Also includes: Monitoring and statistics module: The monitoring and statistics module is used to monitor the operating status of the port forwarding device in real time and store data, and is used to optimize or troubleshoot the forwarding device by taking statistics and analyzing the stored monitoring data.
10. A computer-readable storage medium, characterized in that: The computer-readable storage medium stores a computer program, and when the computer program is executed by a processor, the port forwarding method according to any one of claims 1 to 6 is implemented.