Method for automatically mapping port to access fortress machine and client side by sharing NAT (Network Address Translation) gateway

Abstract

The invention relates to a method for automatically mapping a port to access a fortress machine and a client by a shared NAT (Network Address Translation) gateway. The method comprises the following steps: opening one or more bastion host instances in a cloud computing environment; the user starts an NAT gateway access mode in a bastion host management page; the bastion host automatically detects an NAT gateway instance in the current virtual exclusive network, enters the instance to apply for some unused NAT ports, and then the bastion host performs DNAT mapping on a service port and a host private network IP of the bastion host and the applied NAT ports; after the DNAT mapping is completed, the bastion host records the port mapping relation, and when a user accesses a bastion host instance and client software, the corresponding public network access IP and the port mapped externally by the NAT can be automatically obtained according to the record. According to the method, through linkage of the NAT gateway service and the bastion host service, convenient access to the bastion host and the client software is realized, multiplexing of the access IP is realized, and the access efficiency and security are improved.

Description

Technical Field

[0001] The present invention relates to the technical field of bastion host access methods, and in particular to a method for automatically mapping ports of a shared NAT gateway to access a bastion host and a client. Background Art

[0002] In the current network architecture, we usually assign a fixed access IP address or access domain name to the bastion host, but this practice will lead to a great waste of access IP resources. Especially in large organizations with many bastion hosts, in order to ensure that each bastion host can work properly, these organizations have to allocate a corresponding number of access IP addresses, which will become very costly. In addition, some organizations may not have enough access IP addresses to allocate to the bastion host.

[0003] On the other hand, using a NAT (Network Address Translation) gateway can achieve sharing of access IP addresses, thereby reducing the waste of IP resources. However, the workload of configuring a NAT gateway is quite huge. This requires not only familiarity with how to configure SNAT (Source Address Translation) and DNAT (Destination Address Translation), but also understanding the specific ports used by the bastion host service. Only by mastering this information can you correctly configure the NAT gateway and ensure that the bastion host service can run normally.

[0004] However, even though we have learned how to configure the NAT gateway and the ports used by the bastion host service, there is still a problem: how does the bastion host know which port it should return data to the client? If the bastion host cannot determine the port that the service maps to the outside world, it cannot return the correct configuration information to the client. As a result, the client software will not be able to correctly access the bastion host's externally mapped access port, resulting in a connection failure.

[0005] In addition, in traditional network architecture, users often need to manually configure port mapping when accessing bastion hosts and client software, which is not only time-consuming and labor-intensive, but also prone to errors, leading to security risks. Summary of the invention

[0006] In order to overcome the above-mentioned defects of the existing bastion host access method and solve the many inconveniences and security problems in the traditional network access process, the present invention proposes a new method for automatically mapping ports of a shared NAT gateway to access the bastion host and the client.

[0007] Scenario description: In a cloud computing environment, a user has opened multiple bastion hosts, but only one public access IP. To enable one IP to access multiple bastion hosts, you can build a NAT gateway instance, bind the public access IP, and configure the SNAT (source address translation) and DNAT (destination address translation) of the NAT gateway instance to access different bastion hosts with different ports of one IP. At this point, although different bastion hosts can be accessed correctly, there is still a problem: the bastion host does not know that it has done NAT port mapping, so it cannot correctly return the external mapping port on NAT to the user's bastion host client, resulting in the bastion host client failing to access assets (accessing the port inside the bastion host, not the port mapped by NAT). To solve this problem, unless the bastion host can return the mapped port, manual configuration will be very troublesome, or even there is no way to manually configure it.

[0008] In order to solve the above problems and cope with complex configuration and usage scenarios, the present invention proposes a method for automatically mapping ports through a shared network address translation (NAT) gateway, so as to achieve convenient access to the bastion host and client software, and at the same time, through automation technology means, improve access efficiency and security, and effectively solve the many problems existing in traditional network access. The core of this method is to realize the intelligence and automation of port mapping through automation technology means, thereby linking the NAT gateway service and the bastion host service, so that users can easily access the bastion host and client software, and realize the reuse of access IP at the same time.

[0009] Specifically, the present invention provides a method for automatically mapping ports of a shared NAT gateway to access a bastion host and a client, such as Figure 3 As shown, the method comprises the following steps:

[0010] S1. Open one or more bastion host instances in a cloud computing environment;

[0011] S2. The user logs in to the management page of the bastion host and enables NAT gateway access mode on the management page;

[0012] S3. The bastion host automatically detects whether there is a NAT gateway instance in the current virtual private network. If there is a NAT gateway instance, the bastion host enters the instance to apply for some unused NAT ports. Then the bastion host performs DNAT mapping between its own service port and the host private IP and the applied NAT port to ensure that external requests can be correctly forwarded to the bastion host.

[0013] S4. After completing the DNAT mapping, the bastion host records the port mapping relationship. When users access the bastion host instance and client software, they can automatically obtain the corresponding public network access IP and NAT external mapping port based on this record.

[0014] Furthermore, the management page of the bastion host described in step S2 of the method for automatically mapping ports to access the bastion host and the client through a shared NAT gateway of the present invention is responsible for opening, modifying, deleting, and managing the bastion host.

[0015] Furthermore, step S3 of the method for automatically mapping ports to access the bastion host and the client through a shared NAT gateway of the present invention also includes: if the bastion host does not detect the NAT gateway instance, the bastion host automatically calls the NAT gateway service (the service for managing NAT gateway instances) to create a new NAT gateway instance and bind it to the public network access IP.

[0016] Furthermore, in the method of the present invention for automatically mapping ports of a shared NAT gateway to access a bastion host and a client, the automatic configuration process after the user turns on the NAT gateway access mode includes the following steps:

[0017] 1) Apply for access to IP and NAT gateway instance and bind the bastion host management service;

[0018] 2) The bastion host management service applies for a free port and configures the corresponding port mapped to the target bastion host instance;

[0019] 3) The bastion host management service synchronizes the port mapping relationship to the corresponding bastion host instance. When the bastion host instance invokes the bastion host client, it directly sends the mapped port to the user.

[0020] Furthermore, the user can access and use the bastion host through the method of the present invention for automatically mapping ports of the shared NAT gateway to access the bastion host and the client. The access process is as follows:

[0021] 1) The administrator first provides the user with the public network access IP address and web access mapping port of the bastion host;

[0022] 2) When a user tries to access the bastion host, the NAT gateway service automatically maps the port requested by the user to the designated port of the bastion host, and the user can access the web service of the bastion host through the designated port;

[0023] 3) When the user decides to use the SSH protocol to remotely access the target asset through the client, the bastion host service sends the public network access IP address, the public network mapping port of the SSH remote access proxy port, and related authentication connection information to the user's bastion host client;

[0024] 4) After the user receives the information, the bastion host client automatically calls up the corresponding local application; at the same time, the client automatically configures the connection parameters according to the received information to ensure that the user can successfully connect to the bastion host;

[0025] 5) After the configuration is complete, the local application accesses the bastion host service through the public network access IP address and public network mapping port;

[0026] 6) The NAT gateway service maps the port requested by the user to the specified port of the bastion host again to ensure that the user's request can be correctly transmitted to the ssh proxy port of the bastion host;

[0027] 7) After the designated port of the bastion host receives the user's request, it performs an authentication check. After the authentication is passed, the bastion host proxies the user's request to the target asset.

[0028] Furthermore, the method of the present invention for automatically mapping ports of a shared NAT gateway to access a bastion host and a client also includes: if there are multiple bastion host instances that need to be configured, the system implements the multiplexing of NAT gateway instances and public network access IPs by applying for different NAT ports, thereby enabling multiple bastion host instances to share the same public network IP address.

[0029] On the other hand, the present invention also provides a system for automatically mapping ports to access a bastion host and a client through a shared NAT gateway. When the system is running, the steps of the method for automatically mapping ports to access a bastion host and a client through a shared NAT gateway are implemented.

[0030] In addition, the present invention also provides a computer-readable storage medium, on which a computer program is stored. When the program is executed by a processor, the steps of the method for automatically mapping ports of a shared NAT gateway to access a bastion host and a client are implemented.

[0031] In summary, the method of the present invention has the following advantages:

[0032] (1) Through the automatic port mapping technology proposed in the present invention, users do not need to manually configure port mapping. The system can automatically complete the port mapping process according to preset rules and policies (the bastion host has an intelligent recognition function and can automatically detect and return the IP address and corresponding port number accessed by NAT). When users access the bastion host and client software, they can be more convenient and efficient, which greatly improves the user experience.

[0033] (2) The present invention realizes the reuse of access IP by sharing NAT gateway, which means that when multiple users access the bastion host and client software at the same time, they can share the same IP address, thereby effectively saving IP resources, avoiding resource waste, and reducing network management costs. At the same time, by automatically mapping ports and linking NAT gateway services, the present invention can also improve the security of network access and prevent unauthorized access and potential network attacks.

[0034] (3) When using this method, users do not need to spend time and energy to deal with the complex creation and configuration of network address translation (NAT), which greatly simplifies the operation process and improves the efficiency of use. At the same time, users do not need to deeply understand and care about the mapping relationship between the bastion host service port and the NAT gateway port. The system will automatically configure and manage it, allowing users to focus more on the processing of core business. BRIEF DESCRIPTION OF THE DRAWINGS

[0035] In order to more clearly illustrate the technical solution of the present invention, the following briefly introduces the drawings required for use in the description of the present invention. Obviously, the following drawings are only some embodiments recorded in the present invention. For those skilled in the art, other drawings can be obtained based on these drawings without paying creative work.

[0036] Figure 1 This is a schematic diagram of the automated configuration process after the user turns on the NAT access mode in the method of the present invention.

[0037] Figure 2 The figure is a schematic diagram of the process of a user accessing and using a bastion host in the method of the present invention.

[0038] Figure 3 It is a schematic diagram of the implementation process of the method of the present invention. DETAILED DESCRIPTION

[0039] In order to make the purpose, technical solution and advantages of the present invention clearer, the technical solution of the present invention will be clearly and completely described below in conjunction with specific embodiments. Obviously, the described embodiments are only part of the embodiments of the present invention, not all of the embodiments, and the present invention can also be implemented or applied through other different specific implementation methods. The details in this specification can also be modified or changed in various ways based on different viewpoints and applications without departing from the spirit of the present invention.

[0040] At the same time, it should be understood that the protection scope of the present invention is not limited to the specific embodiments described below; it should also be understood that the terms used in the embodiments of the present invention are for describing specific embodiments rather than for limiting the protection scope of the present invention.

[0041] Embodiment: A method for automatically mapping ports to access a bastion host and a client using a shared NAT gateway

[0042] The specific steps of this method are as follows:

[0043] Step 1: Open one or more bastion host instances in a cloud computing environment.

[0044] Step 2: The user logs in to the management page of the bastion host (responsible for opening, modifying, deleting, and managing the bastion host). On the management page, find the setting option for NAT gateway access mode and turn it on. This step is the key to ensure that the bastion host can use the NAT gateway service for network address translation.

[0045] Step 3: The bastion host automatically detects whether there is a NAT gateway instance in the current virtual private network. If it detects that there is no NAT gateway instance, the bastion host will automatically call the NAT gateway service (the service used to manage NAT gateway instances) to create a new NAT gateway instance and bind it to the public access IP. If a NAT gateway instance already exists, the bastion host will enter the instance to apply for some unused ports. Subsequently, the bastion host will perform DNAT mapping of its own service port and the host private IP with the applied NAT port to ensure that external requests can be correctly forwarded to the bastion host. The above configuration relationship is as follows Figure 1 shown.

[0046] Step 4: After completing the DNAT mapping, the bastion machine will record the port mapping relationship. These records will be used by users to automatically obtain the corresponding public network access IP and NAT external mapping port when accessing the bastion machine instance and client software. In this way, users do not need to manually configure any parameters during use, which greatly simplifies the operation process.

[0047] Step 5: For the operations from step 2 to step 4 above, users only need to enable NAT gateway access mode on the management page to complete the operation automatically. The entire process does not require users to perform complex configurations and operations. Through the automated configuration of steps 2 to step 4, users can easily access and use the bastion host instance and client software. The specific access steps are as follows Figure 2 shown.

[0048] Step 6: If there are multiple bastion host instances that need to be configured, the system will implement the reuse of NAT gateway instances and public access IPs by applying for different NAT ports. In this way, multiple bastion host instances can share the same public IP address, saving resources and improving the flexibility of network configuration.

[0049] In this method, the automatic configuration process after the user turns on the NAT access mode is as follows: Figure 1 As shown, the following steps are included:

[0050] 1) Apply for access to the bastion host management service IP and NAT instance and bind them.

[0051] 2) The bastion host management service applies for a free port and configures the corresponding port mapped to the target bastion host instance.

[0052] 3) The bastion host management service synchronizes the port mapping relationship to the corresponding bastion host instance. When the bastion host instance invokes the bastion host client, it directly sends the mapped port to the user.

[0053] In this method, the process of users accessing and using the bastion host is as follows: Figure 2 As shown, the following steps are included:

[0054] Note: 443 is the web access port, 2222 is the SSH remote access proxy port, and 3389 is the remote desktop proxy port.

[0055] 1) The administrator first provides the user with the public access IP address of the bastion host and the web access mapping port. For example, the administrator will provide an address similar to https: / / public access IP:8448 so that the user can access the bastion host through the web interface.

[0056] 2) When the user tries to access the bastion host, the NAT gateway service will automatically map the port 8443 requested by the user to the port 443 of bastion host 1. In this way, the user can access the web service of the bastion host through the specified port.

[0057] 3) When the user decides to remotely access the target asset using the SSH protocol through the client, the bastion host service will send the public access IP address, the public mapping port 3333 of the SSH remote access proxy port, and related authentication connection information to the user's bastion host client.

[0058] 4) After the user receives this information, the bastion host client will automatically call up the corresponding local application (such as xshell). At the same time, the client will automatically configure the connection parameters according to the received information to ensure that the user can successfully connect to the bastion host.

[0059] 5) After the configuration is complete, the local application will access the bastion host service through the public network access IP address and the public network mapping port 3333. At this point, the user is ready for remote access through the bastion host.

[0060] 6) The NAT gateway service plays a role again, mapping the port 3333 requested by the user to the port 2222 of the bastion host 1. This mapping ensures that the user's request can be correctly passed to the ssh proxy port of the bastion host.

[0061] 7) After receiving the user's request on port 2222 of the bastion host, an authentication check will be performed. Once the authentication is passed, the bastion host will proxy the user's request to the target asset. At this point, the user has successfully achieved the need to access the target asset through the remote proxy of the bastion host client.

[0062] Through the above steps, users do not need to worry about the tedious NAT creation and configuration process, do not need to understand the port mapping, and do not need to manually adjust any parameters of the bastion host. They can achieve the purpose of accessing multiple bastion host instances and client software through a shared IP address. This configuration method greatly simplifies the user's operation process and improves work efficiency.

[0063] The above description is only a preferred embodiment of the present invention and does not limit the present invention in any form. Any technician familiar with the profession can make some changes or modifications to the technical contents disclosed above without departing from the scope of the technical solution of the present invention to obtain equivalent embodiments of equivalent changes. However, any simple modification, equivalent changes and modifications made to the above embodiments based on the technical essence of the present invention without departing from the content of the technical solution of the present invention should be included in the scope of protection of the claims of the present invention.

Claims

1. A method for automatically mapping ports to access a bastion host and a client through a shared NAT gateway, characterized in that: The method comprises: S1. Open one or more bastion host instances in a cloud computing environment; S2. The user logs in to the management page of the bastion host and enables NAT gateway access mode on the management page; S3. The bastion host automatically detects whether there is a NAT gateway instance in the current virtual private network. If there is a NAT gateway instance, the bastion host enters the instance to apply for some unused NAT ports. Then the bastion host performs DNAT mapping between its own service port and the host private IP and the applied NAT port to ensure that external requests can be correctly forwarded to the bastion host. S4. After completing the DNAT mapping, the bastion host records the port mapping relationship. When users access the bastion host instance and client software, they can automatically obtain the corresponding public network access IP and NAT external mapping port based on this record.

2. The method for automatically mapping ports to access a bastion host and a client using a shared NAT gateway according to claim 1, wherein: The management page of the bastion host described in step S2 is responsible for opening, modifying, deleting, and managing the bastion host.

3. The method for automatically mapping ports to access a bastion host and a client using a shared NAT gateway according to claim 1, characterized in that: Step S3 also includes: if the bastion host does not detect the NAT gateway instance, the bastion host automatically calls the NAT gateway service to create a new NAT gateway instance and binds it to the public network access IP.

4. The method for automatically mapping ports of a shared NAT gateway to access a bastion host and a client according to claim 1, characterized in that: The automatic configuration process after the user turns on the NAT gateway access mode in the method includes the following steps: 1) Apply for access to the bastion host management service IP and NAT gateway instance and bind them; 2) The bastion host management service applies for a free port and configures the corresponding port mapped to the target bastion host instance; 3) The bastion host management service synchronizes the port mapping relationship to the corresponding bastion host instance. When the bastion host instance invokes the bastion host client, it directly sends the mapped port to the user.

5. The method for automatically mapping ports to access a bastion host and a client using a shared NAT gateway according to claim 1, wherein: Users can access and use the bastion host through the method described above. The access process is as follows: 1) The administrator first provides the user with the public network access IP address and web access mapping port of the bastion host; 2) When a user tries to access the bastion host, the NAT gateway service automatically maps the port requested by the user to the designated port of the bastion host, and the user can access the web service of the bastion host through the designated port; 3) When the user decides to use the SSH protocol to remotely access the target asset through the client, the bastion host service sends the public network access IP address, the public network mapping port of the SSH remote access proxy port, and related authentication connection information to the user's bastion host client; 4) After the user receives the information, the bastion host client automatically calls up the corresponding local application; at the same time, the client automatically configures the connection parameters according to the received information to ensure that the user can successfully connect to the bastion host; 5) After the configuration is complete, the local application accesses the bastion host service through the public network access IP address and public network mapping port; 6) The NAT gateway service maps the port requested by the user to the specified port of the bastion host again to ensure that the user's request can be correctly transmitted to the ssh proxy port of the bastion host; 7) After the designated port of the bastion host receives the user's request, it performs an authentication check. After the authentication is passed, the bastion host proxies the user's request to the target asset.

6. The method for automatically mapping ports to access a bastion host and a client using a shared NAT gateway according to claim 1, characterized in that: The method also includes: if there are multiple bastion host instances that need to be configured, the system implements multiplexing of the NAT gateway instance and the public network access IP by applying for different NAT ports, so that multiple bastion host instances share the same public network IP address.

7. A system for automatically mapping ports to access a bastion host and a client through a shared NAT gateway, characterized in that: When the system is running, the steps of the method for automatically mapping ports for accessing the bastion host and the client through a shared NAT gateway as described in any one of claims 1 to 6 are implemented.

8. A computer-readable storage medium having a computer program stored thereon, wherein when the program is executed by a processor, the steps of the method for automatically mapping ports of a shared NAT gateway to access a bastion host and a client according to any one of claims 1 to 6 are implemented.

Images