Method for sharing nat gateway to automatically map port access to bastion and client

Abstract

The application relates to a method for automatically mapping a NAT gateway to access a bastion host and a client. The method comprises the following steps: opening one or more bastion host instances in a cloud computing environment; starting a NAT gateway access mode in a bastion host management page; automatically detecting a NAT gateway instance in a current virtual private network by the bastion host, applying some unused NAT ports in the instance, and then performing DNAT mapping between service ports and host private network IP of the bastion host and the applied NAT ports; after the DNAT mapping is completed, recording the port mapping relationship by the bastion host, and automatically obtaining a corresponding public network access IP and a NAT external mapping port according to the record when a user accesses the bastion host instance and client software. The method realizes convenient access to the bastion host and the client software by linking the NAT gateway service and the bastion host service, simultaneously realizes reuse of the access IP, and improves access efficiency and security.

Description

TECHNICAL FIELD

[0001] The present application relates to the technical field of bastion host access methods, and particularly relates to a method for automatically mapping ports of a shared NAT gateway to access a bastion host and a client. BACKGROUND

[0002] In current network architectures, a fixed access IP address or domain name is usually allocated to a bastion host, but this approach results in a great waste of IP resources. In particular, in large organizations with a large number of bastion hosts, in order to ensure that each bastion host can work normally, the organizations have to allocate a corresponding number of access IP addresses, which makes the cost very high. In addition, some organizations may not have enough access IP addresses to allocate to the bastion hosts.

[0003] On the other hand, using a NAT (Network Address Translation) gateway can achieve sharing of access IP addresses, thereby reducing the waste of IP resources. However, the work of configuring a NAT gateway is quite large. Not only does it need to be familiar with how to configure SNAT (Source Network Address Translation) and DNAT (Destination Network Address Translation), but it also needs to understand the specific ports used by the bastion host service. Only by mastering this information can the NAT gateway be correctly configured to ensure that the bastion host service can work normally.

[0004] However, even if we have understood the configuration method of the NAT gateway and the ports used by the bastion host service, there is still a problem: how does the bastion host know which port the data should be returned to the client? If the bastion host cannot determine the externally mapped port of the service, it cannot return the correct configuration information to the client, so the client software cannot correctly access the externally mapped access port of the bastion host, resulting in a connection failure.

[0005] In addition, in traditional network architectures, users often need to manually configure port mapping when accessing the bastion host and client software, which not only consumes time and effort, but also is prone to errors, resulting in security risks. SUMMARY

[0006] In order to overcome the above-mentioned defects of the existing bastion host access method and solve the many inconveniences and security problems existing in the traditional network access process, the present application proposes a new method for automatically mapping ports of a shared NAT gateway to access a bastion host and a client.

[0007] Scenario description: In a cloud computing environment, a user opens multiple bastion hosts, but only has one public access IP. To achieve access to multiple bastion hosts with one IP, a NAT gateway instance can be built, the public access IP is bound, and the SNAT (source address translation) and DNAT (destination address translation) of the NAT gateway instance are configured to achieve access to different bastion hosts with different ports of one IP. At this time, although different bastion hosts can be accessed correctly, there is still a problem: the bastion host does not know that it has performed NAT port mapping, so it cannot correctly return the external mapping port on the NAT to the bastion host client of the user, resulting in failure of the bastion host client to access the asset (accessing the internal port of the bastion host instead of the NAT mapped port). To solve this problem, unless the bastion host can return the mapped port, manual configuration will be very troublesome, or there is no way to manually configure.

[0008] To solve the above problems and cope with complex configurations and use scenarios, the present application provides a method for automatically mapping ports through a shared network address translation (NAT) gateway, so as to achieve convenient access to bastion hosts and client software, and at the same time, through automatic technical means, improve access efficiency and security, effectively solving many problems existing in traditional network access. The core of the method is to realize intelligentization and automation of port mapping through automatic technical means, thereby linking the NAT gateway service and the bastion host service, so that the user can easily access the bastion host and the client software, and at the same time, realize reuse of the access IP.

[0009] Specifically, the present application provides a method for automatically mapping ports through a shared NAT gateway to access bastion hosts and clients, as shown in Figure 3 The method comprises the following steps:

[0010] S1. One or more bastion host instances are opened in a cloud computing environment;

[0011] S2. The user logs in to the management page of the bastion host, and enables the NAT gateway access mode in the management page;

[0012] S3. The bastion host automatically detects whether a NAT gateway instance exists in the current virtual private network, if a NAT gateway instance already exists, the bastion host applies some unused NAT ports in the instance, and then the bastion host performs DNAT mapping of its service port and host private IP with the applied NAT ports, to ensure that external requests can be correctly forwarded to the bastion host;

[0013] S4. After completing the DNAT mapping, the bastion host records the port mapping relationship, and when the user accesses the bastion host instance and the client software, the corresponding public access IP and NAT external mapping port can be automatically obtained according to the record.

[0014] Further, the management page of the bastion server in step S2 of the method for sharing a NAT gateway to automatically map ports to access a bastion server and a client is responsible for opening, modifying, deleting, and managing the bastion server.

[0015] Further, the method for sharing a NAT gateway to automatically map ports to access a bastion server and a client further includes, in step S3: if the bastion server does not detect a NAT gateway instance, the bastion server automatically invokes a NAT gateway service (a service for managing NAT gateway instances) to create a new NAT gateway instance and binds it to a public network access IP.

[0016] Further, the automatic configuration process after a user starts a NAT gateway access mode in the method for sharing a NAT gateway to automatically map ports to access a bastion server and a client includes the following steps:

[0017] 1) The bastion server management service applies for an access IP and a NAT gateway instance and binds them;

[0018] 2) The bastion server management service applies for an idle port and configures a corresponding port mapped to a target bastion server instance;

[0019] 3) The bastion server management service synchronizes the port mapping relationship to the corresponding bastion server instance, and when the bastion server instance invokes a bastion server client, directly issues the mapped port to the user.

[0020] Further, a user can access and use a bastion server through the method for sharing a NAT gateway to automatically map ports to access a bastion server and a client, and the access process is as follows:

[0021] 1) An administrator first provides a public network access IP address of the bastion server and a web access mapping port to the user;

[0022] 2) When the user attempts to access the bastion server, the NAT gateway service automatically maps a port requested by the user to a specified port of the bastion server, and the user can access a web service of the bastion server through the specified port;

[0023] 3) When the user decides to remotely access a target asset through a client using an ssh protocol, the bastion server service sends a public network access IP address, a public network mapping port of an ssh remote access proxy port, and related authentication connection information to the bastion server client of the user;

[0024] 4) After receiving the information, the bastion server client automatically invokes a local corresponding application; at the same time, the client automatically configures connection parameters according to the received information to ensure that the user can successfully connect to the bastion server;

[0025] 5) After the configuration is completed, the local application accesses the bastion service through the public network access IP address and the public network mapping port;

[0026] 6) The NAT gateway service maps the user's requested port to the specified port of the bastion again, ensuring that the user's request can be correctly delivered to the ssh agent port of the bastion;

[0027] 7) After the specified port of the bastion receives the user's request, it performs authentication check, and after the authentication is passed, the bastion proxies the user's request to the target asset.

[0028] Further, the method for sharing NAT gateway automatic mapping port to access the bastion and the client further comprises: if there are multiple bastion instances to be configured, the system applies different NAT ports to realize the multiplexing of the NAT gateway instance and the public network access IP, and realizes that multiple bastion instances share the same public network IP address.

[0029] On the other hand, the application also provides a system for sharing NAT gateway automatic mapping port to access the bastion and the client, which realizes the steps of the above-mentioned method for sharing NAT gateway automatic mapping port to access the bastion and the client when running.

[0030] In addition, the application also provides a computer readable storage medium, and the storage medium stores a computer program, and the program realizes the steps of the above-mentioned method for sharing NAT gateway automatic mapping port to access the bastion and the client when executed by a processor.

[0031] In summary, the method of the application has the following advantages:

[0032] (1) Through the automatic mapping port technology proposed by the application, the user does not need to manually configure the port mapping, and the system can automatically complete the port mapping process according to the preset rules and strategies (the bastion has intelligent identification function, which can automatically detect and return the IP address of NAT access and the corresponding port number), the user can access the bastion and the client software more conveniently and efficiently, which greatly improves the user experience.

[0033] (2) The application realizes the multiplexing of the access IP through the sharing of the NAT gateway, which means that when multiple users access the bastion and the client software at the same time, the same IP address can be shared, thereby effectively saving IP resources, avoiding resource waste, and reducing network management cost. At the same time, through the automatic mapping port and the linkage of the NAT gateway service, the application can also improve the security of network access, prevent unauthorized access and potential network attacks.

[0034] (3) The user does not need to spend time and effort to deal with the creation and configuration of complex network address translation (NAT) in the process of using the method, greatly simplifying the operation process and improving the use efficiency. At the same time, the user does not need to deeply understand and care about the mapping relationship between the service port of the bastion host and the gateway port of the NAT, and the system will automatically configure and manage, so that the user can focus more on the processing of the core business. BRIEF DESCRIPTION OF DRAWINGS

[0035] In order to more clearly illustrate the technical solutions of the present application, the following briefly introduces the drawings used in the description of the present application. Obviously, the following drawings are only some embodiments of the present application, and other drawings can also be obtained by those skilled in the art without creative labor.

[0036] Figure 1 The figure is a schematic diagram of the automatic configuration process of the user after opening the NAT access mode in the method of the present application.

[0037] Figure 2 The figure is a schematic diagram of the process of the user accessing and using the bastion host in the method of the present application.

[0038] Figure 3 The figure is a schematic diagram of the implementation process of the method of the present application. DETAILED DESCRIPTION

[0039] In order to make the purpose, technical solutions and advantages of the present application more clear, the technical solutions of the present application will be described clearly and completely in combination with specific embodiments. Obviously, the described embodiments are only some of the embodiments of the present application, not all the embodiments, and the present application can also be implemented or applied by other different specific embodiments, and each detail in the specification can be modified or changed based on different views and applications without departing from the spirit of the present application.

[0040] At the same time, it should be understood that the protection scope of the present application is not limited to the following specific embodiments; it should also be understood that the terms used in the embodiments of the present application are for describing specific embodiments, not for limiting the protection scope of the present application.

[0041] Embodiment: a method for sharing NAT gateway to automatically map port to access bastion host and client

[0042] The specific steps of the method are as follows:

[0043] Step 1: open one or more bastion host instances in a cloud computing environment.

[0044] Step 2: The user logs into the management page of the bastion host (responsible for opening, modifying, deleting, and managing the bastion host). In the management page, find the setting option of the NAT gateway access mode and turn it on. This step is the key to ensuring that the bastion host can use the NAT gateway service for network address translation.

[0045] Step 3: The bastion host automatically detects whether there is a NAT gateway instance in the current virtual private network. If no NAT gateway instance is detected, the bastion host will automatically call the NAT gateway service (service for managing NAT gateway instances) to create a new NAT gateway instance and bind it with the public access IP. If there is already a NAT gateway instance, the bastion host will apply for some unused ports in the instance. Then, the bastion host will DNAT map its service port and host private IP with the applied NAT port to ensure that external requests can be correctly forwarded to the bastion host. The above configuration relationship is shown in Figure 1 .

[0046] Step 4: After completing the DNAT mapping, the bastion host records the port mapping relationship. These records will be used by users when accessing the bastion host instance and client software to automatically obtain the corresponding public access IP and NAT externally mapped port. In this way, users do not need to manually configure any parameters during use, greatly simplifying the operation process.

[0047] Step 5: The operations in steps 2 to 4 can be automatically completed by the user by simply turning on the NAT gateway access mode in the management page. The entire process does not require complex configuration and operation by the user. Through the automatic configuration in steps 2 to 4, users can easily access and use the bastion host instance and client software. The specific access steps are shown in Figure 2 .

[0048] Step 6: If there are multiple bastion host instances to be configured, the system will achieve the reuse of NAT gateway instances and public access IPs by applying for different NAT ports. In this way, multiple bastion host instances can share the same public IP address, thereby saving resources and improving the flexibility of network configuration.

[0049] In this method, the automatic configuration process after the user turns on the NAT access mode is shown in Figure 1 , including the following steps:

[0050] 1) The bastion host management service applies for an access IP and a NAT instance and binds them.

[0051] 2) The bastion host management service applies for an idle port and configures the corresponding port mapped to the target bastion host instance.

[0052] 3) The bastion host management service synchronizes the port mapping relationship to the corresponding bastion host instance. When the bastion host instance invokes the bastion host client, it directly issues the mapped port to the user.

[0053] In the method, the process in which the user accesses and uses the bastion host is as shown in Figure 2

[0054] Note: 443 is the web access port, 2222 is the ssh remote access proxy port, and 3389 is the remote desktop proxy port.

[0055] 1) The administrator first provides the user with the public network access IP address of the bastion host and the web access mapping port. For example, the administrator will provide an address similar to https: / / public network access IP:8448, so that the user can access the bastion host through the web interface.

[0056] 2) When the user tries to access the bastion host, the NAT gateway service automatically maps the port 8443 requested by the user to the 443 port of the bastion host 1. In this way, the user can access the web service of the bastion host through the specified port.

[0057] 3) When the user decides to remotely access the target asset through the client using the ssh protocol, the bastion host service sends the public network access IP address, the public network mapping port 3333 of the ssh remote access proxy port, and the related authentication connection information to the user's bastion host client.

[0058] 4) After receiving this information, the bastion host client automatically invokes the local corresponding application (such as xshell). At the same time, the client automatically configures the connection parameters according to the received information to ensure that the user can successfully connect to the bastion host.

[0059] 5) After the configuration is completed, the local application accesses the bastion host service through the public network access IP address and the public network mapping port 3333. At this time, the user has prepared to remotely access through the bastion host.

[0060] 6) The NAT gateway service again plays a role in mapping the port 3333 requested by the user to the 2222 port of the bastion host 1. This mapping ensures that the user's request can be correctly transmitted to the ssh proxy port of the bastion host.

[0061] 7) After the 2222 port of the bastion host receives the user's request, it will perform authentication checking. Once the authentication is passed, the bastion host will proxy the user's request to the target asset. At this point, the user has successfully realized the demand for remotely proxying access to the target asset through the bastion host client.

[0062] ​Through the above steps, the user does not need to care about the complicated NAT creation and configuration process, does not need to understand the port correspondence, and does not need to manually adjust any parameters of the bastion host, so as to achieve the purpose of accessing multiple bastion host instances and client software through the shared IP address. The configuration mode greatly simplifies the operation process of the user and improves the work efficiency.

[0063] The above is only the preferred embodiment of the present application, and does not limit the present application in any form. Any person skilled in the art can make some changes or modifications to the above disclosed technical content without departing from the technical solution of the present application to obtain equivalent embodiments with equivalent changes. However, any simple modification, equivalent change and modification of the above embodiments made according to the technical essence of the present application should be included in the protection scope of the claims of the present application.

Claims

1. A method for sharing NAT gateway automatic mapping port access to a bastion and a client, characterized in that, The method comprises: S1. opening one or more bastion machine instances in a cloud computing environment; S2. a user logging in a management page of the bastion machine, and starting a NAT gateway access mode in the management page; S3. the bastion machine automatically detecting whether a NAT gateway instance exists in a current virtual private network, if the NAT gateway instance already exists, the bastion machine applying some unused NAT ports in the instance, and then the bastion machine performing DNAT mapping of its service port and host private network IP and the applied NAT ports, to ensure that external requests can be correctly forwarded to the bastion machine; S4. after the DNAT mapping is completed, the bastion machine records the port mapping relationship, and the user can automatically obtain a corresponding public network access IP and a NAT external mapping port according to the record when accessing the bastion machine instance and the client software. The automatic configuration process of the user after starting the NAT gateway access mode in the method comprises the following steps: 1) the bastion machine management service applies for an access IP and a NAT gateway instance and binds them; 2) the bastion machine management service applies for an idle port and configures a corresponding port mapped to the target bastion machine instance; 3) the bastion machine management service synchronizes the port mapping relationship to the corresponding bastion machine instance, and the bastion machine instance directly issues the mapped port to the user when the bastion machine client is invoked; The user can access and use the bastion machine through the method, and the access process is as follows: 1) an administrator first provides the user with a public network access IP address of the bastion machine and a web access mapping port; 2) when the user tries to access the bastion machine, the NAT gateway service automatically maps the port requested by the user to a specified port of the bastion machine, and the user can access the web service of the bastion machine through the specified port; 3) when the user decides to remotely access a target asset through the client using the ssh protocol, the bastion machine service sends the public network access IP address, the public network mapping port of the ssh remote access proxy port, and related authentication connection information to the bastion machine client of the user; 4) after the user receives the information, the bastion machine client automatically invokes the local corresponding application program; at the same time, the client automatically configures the connection parameters according to the received information, to ensure that the user can successfully connect to the bastion machine; 5) after the configuration is completed, the local application program accesses the bastion machine service through the public network access IP address and the public network mapping port; 6) the NAT gateway service maps the port requested by the user to the specified port of the bastion machine again, to ensure that the request of the user can be correctly transmitted to the ssh proxy port of the bastion machine; 7) the specified port of the bastion machine receives the request of the user, performs authentication checking, and after the authentication is passed, the bastion machine proxies the request of the user to the target asset.

2. The method for shared NAT gateway automated mapping port access to a bastion and a client of claim 1, wherein, The management page of the bastion machine in step S2 is responsible for opening, modifying, deleting, and managing the bastion machine.

3. The method for shared NAT gateway automated mapping port access to a bastion and a client of claim 1, wherein, In step S3, if the bastion machine does not detect the NAT gateway instance, the bastion machine automatically calls the NAT gateway service to create a new NAT gateway instance and binds it to the public network access IP.

4. The method for shared NAT gateway automated mapping port access to a bastion and a client of claim 1, wherein, The method further comprises: if there are multiple bastion machine instances to be configured, the system implements multiplexing of the NAT gateway instance and the public network access IP by applying different NAT ports, so that the multiple bastion machine instances share the same public network IP address.

5. A system for sharing NAT gateway automated mapping port access to a bastion and a client, the system comprising: The system implements the steps of the method for automatically mapping ports to access the bastion machine and the client by sharing the NAT gateway according to any one of claims 1-4. 6.A computer readable storage medium, the storage medium storing a computer program, the program being executed by a processor to implement the steps of the method for automatically mapping ports to access the bastion machine and the client by sharing the NAT gateway according to any one of claims 1-4.

Images