Method, device and equipment for establishing direct connection traversal link and medium

Abstract

The invention provides a method, a device, equipment and a medium for establishing a direct connection traversal link. The method comprises the following steps: acquiring a public network IP of an opposite end; generating a first scanning message based on the public network IP of the opposite terminal and the random port available to the public network, and sending the first scanning message; when a second scanning message which is sent by an opposite terminal and is mapped by the opposite terminal NAT gateway and a first scanning message which is mapped by the home terminal NAT gateway are mirror image messages, and the second scanning message and the first scanning message collide on the home terminal NAT gateway, receiving the second scanning message; and establishing a direct connection traversing link with the opposite terminal according to the second scanning message. According to the method, a public network relay node does not need to be deployed as a transfer station to realize transfer crossing, so that the crossing cost is reduced, and the decentralization requirements of some current APPs can be met.

Description

Technical Field

[0001] The present invention relates to the field of communication technology, and in particular to a method, device, equipment and medium for establishing a direct connection through a link. Background Art

[0002] Network Address Translation (NAT) traversal technology is a technology used to solve the problem of mutual access between intranet devices in a network. A NAT gateway is a network device that is usually used to map multiple private Internet Protocol (IP) addresses to one or more public IP addresses to allow multiple devices to share a single public IP address. This can help improve network security and effectively utilize IP address resources, but it can also cause some connection problems because it modifies IP address and port information. For services deployed in the intranet, operators generally do not allocate public IP addresses to such users. For users who do not have public IP addresses, deploying intranet services requires services such as Dynamic Domain Name Server (DDNS) to allow external network users to access the service, and external network users cannot access it directly. The main goal of NAT traversal technology is to enable connection requests from external networks to reach intranet services in a network with NAT devices, so as to establish an end-to-end direct connection.

[0003] Generally speaking, NAT can be divided into four types: Full Cone, IP Restricted Cone, Port Restricted Cone, and Symmetric.

[0004] The existing NAT traversal technology can achieve P2P direct traversal for some NAT types, but it cannot achieve peer-to-peer (p2p) direct traversal in the following two network scenarios: both ends are symmetric NAT; one end is port-restricted cone NAT and the other end is symmetric NAT. Because in the symmetric NAT scenario, when the intranet device uses the same source IP and source port to access different destination IPs and ports, the public network port mapped by the NAT gateway is not a fixed port, so it is impossible to obtain the public network port after the intranet IP and port are NATed, so direct traversal is impossible. It is necessary to deploy a public network relay node as a transit station, and connect the two ends to the relay node respectively to achieve transit traversal. This solution of deploying relay nodes will increase the traversal cost and cannot meet the decentralization requirements of some current applications (Application, APP). Summary of the invention

[0005] The present invention provides a method, device, equipment and medium for establishing a direct connection crossing link, so as to solve the problem in the related technology that a public network relay node needs to be deployed to realize transit crossing, which increases the crossing cost and cannot meet the decentralization requirements of some current APPs.

[0006] The present invention provides a method for establishing a direct connection through link, comprising the following steps.

[0007] Get the public IP address of the other end; Generate a first scanning message based on the public network IP of the other end and a random port available on the public network, and send the first scanning message; When the second scanning message sent by the opposite end after being mapped by the opposite end NAT gateway and the first scanning message mapped by the local end NAT gateway are mirror messages to each other, and the two parties collide on the local end NAT gateway, the second scanning message is received; A direct connection traversal link is established with the opposite end according to the second scanning message.

[0008] According to the method for establishing a direct connection through link provided by the present invention, a first scanning message is generated based on the public network IP of the opposite end and a random port available on the public network, and the first scanning message is sent, including: Install the target protocol; A port scanning strategy of the target protocol is configured based on the random port available on the public network and the public IP address of the other end, and a first scanning message is generated according to the port scanning strategy; A first scanning message is sent using the target protocol.

[0009] According to the method for establishing a direct connection through link provided by the present invention, a port scanning strategy of a target protocol is configured based on a random port available on the public network and the public IP address of the other end, including: Configure the random ports available on the public network as the randomly selected range of the destination port of the first scan message in the port scanning strategy; Setting a plurality of local random ports according to the target protocol, and configuring the plurality of local random ports as a random selection range of the source port of the first scanning message in the port scanning strategy; Configure the public IP of the other end as the destination IP of the first scan message in the port scan strategy, and configure the local IP as the source IP of the first scan message in the port scan strategy.

[0010] According to the method for establishing a direct connection through link provided by the present invention, the port scanning strategy also includes at least one of the following: The sending period of the first scanning message, the number of first scanning messages sent by each source port at a single time, the sending interval of the first scanning message, and the maximum number of times the first scanning message is sent.

[0011] According to the method for establishing a direct connection through link provided by the present invention, establishing a direct connection through link with the opposite end according to the second scanning message includes: Acquire information of the other end according to the second scanning message; Use the information of the other end to perform handshake negotiation with the other end and establish a direct connection through the link.

[0012] According to the method for establishing a direct connection through link provided by the present invention, generating a first scanning message according to a port scanning strategy includes: Generate the local encryption public key using the target protocol; A first scanning message is generated according to the port scanning strategy and the local encryption public key.

[0013] According to the method for establishing a direct connection through link provided by the present invention, establishing a direct connection through link with the opposite end according to the second scanning message includes: Acquire information of the other end and an encryption public key of the other end according to the second scanning message; Perform handshake negotiation with the peer end based on the peer end information, the peer end encryption public key, and the local end encryption public key to establish a direct connection through link.

[0014] The present invention also provides a device for establishing a direct connection through link, comprising the following modules: The acquisition module is used to obtain the public IP address of the other end; A scanning module, used to generate a first scanning message based on the public network IP of the other end and a random port available on the public network, and send the first scanning message; A receiving module, used for receiving the second scanning message when the second scanning message sent by the opposite end after being mapped by the opposite end NAT gateway and the first scanning message mapped by the local end NAT gateway are mirror messages to each other and the two parties collide on the local end NAT gateway; An establishing module is used to establish a direct connection through link with the opposite end according to the second scanning message.

[0015] According to the establishment of a direct connection through link provided by the present invention, according to the establishment device of the direct connection through link provided by the present invention, a first scanning message is generated based on the public network IP of the opposite end and the random port available on the public network, and when the first scanning message is sent, the scanning module is specifically used for: Install the target protocol; A port scanning strategy of the target protocol is configured based on the random port available on the public network and the public IP address of the other end, and a first scanning message is generated according to the port scanning strategy; A first scanning message is sent using the target protocol.

[0016] According to the apparatus for establishing a direct connection through link provided by the present invention, when configuring the port scanning strategy of the target protocol based on the random port available on the public network and the public IP of the other end, the scanning module is specifically used for: Configure the random ports available on the public network as the randomly selected range of the destination port of the first scan message in the port scanning strategy; Setting a plurality of local random ports according to the target protocol, and configuring the plurality of local random ports as a random selection range of the source port of the first scanning message in the port scanning strategy; Configure the public IP of the other end as the destination IP of the first scan message in the port scan strategy, and configure the local IP as the source IP of the first scan message in the port scan strategy.

[0017] According to the device for establishing a direct connection through link provided by the present invention, the port scanning strategy also includes at least one of the following: The sending period of the first scanning message, the number of first scanning messages sent by each source port at a single time, the sending interval of the first scanning message, and the maximum number of times the first scanning message is sent.

[0018] According to the apparatus for establishing a direct connection through link provided by the present invention, when establishing a direct connection through link with the opposite end according to the second scanning message, the establishing module is specifically used for: Acquire information of the other end according to the second scanning message; Use the information of the other end to perform handshake negotiation with the other end and establish a direct connection through the link.

[0019] According to the apparatus for establishing a direct connection through link provided by the present invention, when generating a first scanning message according to a port scanning strategy, the scanning module is specifically used for: Generate the local encryption public key using the target protocol; A first scanning message is generated according to the port scanning strategy and the local encryption public key.

[0020] According to the apparatus for establishing a direct connection through link provided by the present invention, when establishing a direct connection through link with the opposite end according to the second scanning message, the establishing module is specifically used for: Acquire information of the other end and an encryption public key of the other end according to the second scanning message; Perform handshake negotiation with the peer end based on the peer end information, the peer end encryption public key, and the local end encryption public key to establish a direct connection through link.

[0021] The present invention also provides an electronic device, including a memory, a processor, and a computer program stored in the memory and executable on the processor, wherein when the processor executes the program, any of the above-mentioned methods for establishing a direct connection through a link is implemented.

[0022] The present invention also provides a non-transitory computer-readable storage medium on which a computer program is stored. When the computer program is executed by a processor, the method for establishing a direct connection through a link as described above is implemented.

[0023] The present invention also provides a computer program product, including a computer program, which implements any of the above-mentioned methods for establishing a direct connection through link when executed by a processor.

[0024] The method for establishing a direct connection through link provided by the present invention first obtains the public network IP of the opposite end, then generates a first scanning message based on the public network IP of the opposite end and a random port available on the public network, and sends the first scanning message. When the second scanning message sent by the opposite end after being mapped by the NAT gateway of the opposite end and the first scanning message mapped by the NAT gateway of the local end are mirror messages to each other, and the two parties collide on the NAT gateway of the local end, the second scanning message can pass through the NAT gateway, and the local end is able to receive the second scanning message, thereby establishing a direct connection through link with the opposite end according to the second scanning message. Using the method provided by the embodiment of the present invention, it is only necessary to start the port scanning of the public network by sending a scanning message, so that the two ends may send scanning messages that are mirror messages to each other. When the scanning messages sent by the two ends that are mirror messages to each other collide on the NAT gateway, the scanning message can pass through the gateway due to the mapping rule of the NAT gateway, so that the two ends can establish a direct connection through link according to the scanning message, and realize direct connection through. This method does not need to deploy a public network relay node as a transfer station, reduces the cost of crossing, and can meet the current decentralized needs of some APPs. BRIEF DESCRIPTION OF THE DRAWINGS

[0025] In order to more clearly illustrate the technical solutions in the present invention or the prior art, the following briefly introduces the drawings required for use in the embodiments or the description of the prior art. Obviously, the drawings described below are some embodiments of the present invention. For ordinary technicians in this field, other drawings can be obtained based on these drawings without paying creative work.

[0026] Figure 1 It is a flow chart of the method for establishing a direct connection through link provided by the present invention.

[0027] Figure 2 It is a schematic diagram of an application scenario provided by the present invention.

[0028] Figure 3 It is a schematic diagram of another application scenario provided by the present invention.

[0029] Figure 4 It is a schematic diagram of a public network message after the intranet access request provided by the present invention is encapsulated by wireagurd.

[0030] Figure 5 It is a structural schematic diagram of a device for establishing a direct connection through link provided by the present invention.

[0031] Figure 6 It is a structural schematic diagram of the electronic device provided by the present invention. DETAILED DESCRIPTION

[0032] In order to make the purpose, technical solution and advantages of the present invention clearer, the technical solution of the present invention will be clearly and completely described below in conjunction with the drawings of the present invention. Obviously, the described embodiments are part of the embodiments of the present invention, not all of the embodiments. Based on the embodiments of the present invention, all other embodiments obtained by ordinary technicians in this field without creative work are within the scope of protection of the present invention.

[0033] NAT traversal technology is a technology used to solve the problem of mutual access between intranet devices in a network. A NAT gateway is a network device that is usually used to map multiple private IP addresses to one or more public IP addresses to allow multiple devices to share a single public IP address. This can help improve network security and effectively utilize IP address resources, but it can also cause some connection problems because it modifies IP address and port information. For services deployed on the intranet, operators generally do not allocate public IP addresses to such users. For users who do not have public IP addresses, deploying intranet services requires services such as DDNS to allow external network users to access the service, and external network users cannot access it directly. The main goal of NAT traversal technology is to enable connection requests from external networks to reach intranet services in a network where NAT devices exist, so as to establish an end-to-end direct connection.

[0034] Generally speaking, NAT can be divided into four types: Full Cone, IP Restricted Cone, Port Restricted Cone, and Symmetric.

[0035] The existing NAT traversal technology can achieve P2P direct traversal for some NAT types, but it cannot achieve P2P direct traversal in the following two network scenarios: both ends are symmetric NAT; one end is port-restricted cone NAT and the other end is symmetric NAT. Because when the intranet device uses the same source IP and source port to access different destination IPs and ports, the public network port mapped by the NAT gateway is not a fixed port, so it is impossible to obtain the public network port of the intranet IP and port after NAT. When both ends are symmetric NAT, the services at both ends do not have fixed public network ports, so they cannot be directly connected and traversed. It is necessary to deploy public network relay nodes as transit stations, and connect the two ends to the relay nodes respectively to achieve transit traversal. When one end is port-restricted cone NAT and the other end is symmetric NAT, the intranet traffic will have a fixed public network IP and port after being mapped by the port-restricted cone NAT. If one end is symmetric NAT, it will cause the end to have no fixed public network port. If the external network traffic wants to enter the intranet through this public network port, the intranet must first access the public network IP and port of the external network, and finally it still needs to be transferred through the relay node to achieve NAT traversal. This solution of deploying relay nodes will increase the traversal cost and cannot meet the current decentralized needs of some APPs.

[0036] Therefore, there is an urgent need for a method for establishing a direct connection through a link to solve the above problems.

[0037] Combine the following Figure 1-Figure 6 The present invention describes a method, device, equipment and medium for establishing a direct connection through link.

[0038] Figure 1 FIG. 1 is a flow chart of a method for establishing a direct connection through link provided by the present invention. Figure 1 As shown, the method includes the following: Step 101: Get the public IP address of the other party.

[0039] When the peer device accesses the external network through a symmetric NAT gateway, the NAT gateway will assign a public IP address and port number to it. Because each time the intranet device communicates with different external targets, the NAT gateway will assign different public ports to it, that is, the public port of the peer service port mapped by the NAT gateway is not a fixed port, so the public port of the intranet service mapped by the NAT gateway cannot be clearly obtained, but the public IP assigned to it is generally fixed, usually the public IP address of the NAT gateway. Therefore, the public IP address of the peer can be obtained through network query tools or command line interface tools.

[0040] Figure 2 is a schematic diagram of an application scenario provided by the present invention, such as Figure 2As shown, device 21 and device 24 access the external network through NAT gateway 22 and NAT gateway 23 respectively. Device 21 and device 24 are in different intranet services. When device 21 and device 24 need to establish a direct connection, the two parties are opposite ends. Device 21 obtains the public IP of device 24 as the opposite end as ip 23B, that is, the public IP assigned to it by NAT gateway 23. Device 24 obtains the public IP of device 21 as the opposite end as ip 22A, that is, the public IP assigned to it by NAT gateway 22.

[0041] Step 102: Generate a first scanning message based on the public IP address of the other end and a random port available on the public network, and send the first scanning message.

[0042] Usually, the port number range assigned by the NAT gateway to the intranet device is certain, for example, between 1024-65535, that is, the number range of the random ports available on the public network is certain, and these random public network ports are shared by different NAT gateways. Figure 2 In the illustrated scenario, the number range of the public network random port allocated by the NAT gateway 22 to the device 21 is the same as the number range of the public network random port allocated by the NAT gateway 23 to the device 24 .

[0043] Each time an intranet device communicates with the external network through a NAT gateway, the port of the intranet device will be mapped to the public port assigned to it by the NAT gateway. Therefore, as device 24 is the opposite device of device 21, the public port range mapped by its intranet port is always within the number range of random public ports. The public IP of device 24 is used as the destination IP of the scanning message, and the public port that may be assigned to device 24 is used as the destination port of the scanning message. Device 21 can scan the public port assigned to device 24 by sending scanning messages with different random public ports as the destination ports. Conversely, device 24 can also scan the public port assigned to device 21 by sending scanning messages.

[0044] Step 103: When the second scanning message sent by the opposite end after being mapped by the opposite end NAT gateway and the first scanning message mapped by the local end NAT gateway are mirror messages to each other and the two collide on the local end NAT gateway, the second scanning message is received.

[0045] like Figure 2 As shown, the second scan message 241 enters the NAT gateway 22 and collides with the first scan message 211 on the NAT gateway 22. Message collision on the NAT gateway means that during the validity period of a NAT session, the message going out of the NAT gateway and the message entering the NAT gateway are mirror messages of each other.

[0046] Because the mapping table of the NAT gateway 22 records the mapping rules of the destination IP and destination port of the second scan message 241, when the first scan message 211 and the second scan message 241 collide on the NAT gateway 22, the second scan message 241 will be mapped according to the mapping rules in the mapping table, thereby passing through the NAT gateway 22, so that the device 21 can receive the second scan message 240. Similarly, when the first scan message 211 and the second scan message 241 collide on the NAT gateway 23, the first scan message 211 can also pass through the NAT gateway 23, so that the device 24 can receive the first scan message 210.

[0047] In a scenario where both ends are symmetric NAT, if external traffic is to pass through the symmetric NAT gateway to reach the intranet service (intranet IP + intranet port), the intranet service needs to first send a message to the source IP and source port of the external traffic to establish a NAT session on the NAT gateway. When the external traffic reaches the NAT gateway, the session is hit with the source IP of the message as the destination IP and the source port as the destination port group key, and the traffic can pass through the NAT gateway to reach the internal service. The port scan message sent by the internal service to the outside can establish a session on the NAT gateway, but if the session is not hit by external traffic within a certain period of time, the session will also become invalid. The session expiration time is defined by the specific NAT gateway, generally 5s to 30s. Therefore, before the session expires, increasing the collision probability between the internal port scan message and the external access message becomes the key to traversing NAT.

[0048] In the scenario where one end is a symmetric NAT and the other end is a port-restricted cone NAT, the intranet traffic mapped by the port-restricted cone NAT will have a fixed public IP and port, which means that after a communication starts, the traffic of the same intranet device will communicate through a specific public IP address and port until the communication ends or times out. Therefore, for external traffic to traverse the port-restricted cone NAT, it only needs to be that when the intranet service behind the port-restricted cone NAT sends a message to the source IP and source port of the external traffic, the external traffic uses the fixed public IP and port as the destination IP and destination port group key to hit the session established by the message on the NAT gateway, and the traffic can traverse the port-restricted cone NAT to reach the internal service. The principle is the same as that of traversing the symmetric NAT gateway above. When the intranet service behind the symmetric NAT gateway sends a message to the source IP and source port of the external traffic, the external traffic uses the source IP of the message as the destination IP and the source port as the destination port group key to hit the session established by the message on the NAT gateway, and the external traffic can traverse the NAT gateway to reach the internal service.

[0049] Step 104: Establish a direct connection through link with the opposite end according to the second scanning message.

[0050] When the local device receives the second scanning message sent by the peer device, it can parse the second scanning message to obtain the information of the peer device carried therein, such as the IP and port of the peer device. It can use the information of the peer device to conduct handshake negotiation with the peer device, and establish a direct connection through link with the peer device.

[0051] By using the method provided by the embodiment of the present invention, it is only necessary to start the port scanning of the public network by sending a scanning message, so that both ends may send scanning messages that are mirror images of each other. When the scanning messages that are mirror images of each other sent by both ends collide on the NAT gateway, the scanning message can pass through the gateway due to the mapping rules of the NAT gateway, so that both ends can establish a direct connection and pass through link according to the scanning message to achieve direct connection and pass through. This method does not need to deploy a public network relay node as a transfer station, reduces the cost of passing through, and can meet the decentralization requirements of some current APPs.

[0052] In some embodiments, a first scanning message is generated based on the public IP of the other end and a random port available on the public network, and the first scanning message is sent, including: installing the target protocol; configuring the port scanning strategy of the target protocol based on the random port available on the public network and the public IP of the other end, and generating the first scanning message according to the port scanning strategy; and sending the first scanning message using the target protocol.

[0053] For example, you can install the WireGuard protocol configuration to configure the port scanning policy. The WireGuard protocol is a modern open source VPN protocol that can provide simple, efficient and secure network connections. It is easy to configure and is suitable for a variety of scenarios such as remote access, network interconnection and edge computing.

[0054] like Figure 2As shown, the Wireguard protocol 1111 is installed on the device 21. By extending the Wireguard protocol, it can send port scanning messages, so that the Wireguard protocol has a port scanning function. The Wireguard protocol 2222 installed on the device 21 is the same. Specifically, a new UDP (User Datagram Protocol) port scanning message type (natscan message) is added to the Wireguard protocol, which is the first scanning message. The destination IP of the first scanning message is the public IP of the other end (that is, the public IP of the NAT gateway on the other end), and the destination port is a random public port, that is, a number is randomly selected within the public port number range (1024-65535) as the destination port. The local IP and port of the device 21 are used as the source IP and source port of the first scanning message. Then use the Wireguard protocol to send multiple first scanning messages. Similarly, the device 24 sends multiple second scanning messages, and the specific implementation process is similar to the specific implementation process of the device 21, which will not be repeated here.

[0055] In some embodiments, a port scanning strategy for a target protocol is configured based on a random port available on a public network and a public IP address of a peer end, including: configuring a random port available on a public network as a randomly selected range of a destination port of a first scanning message in a port scanning strategy; setting a plurality of local random ports according to the target protocol, and configuring the plurality of local random ports as a randomly selected range of a source port of a first scanning message in a port scanning strategy; configuring the public IP address of the peer end as the destination IP address of the first scanning message in a port scanning strategy, and configuring the local IP address as the source IP address of the first scanning message in a port scanning strategy.

[0056] The port scanning strategy also includes at least one of the following: a sending period of the first scanning message, the number of first scanning messages sent by each source port at a time, a sending interval of the first scanning message, and a maximum number of sending times of the first scanning message.

[0057] like Figure 2 As shown, device 21 can set 256 random ports in the Wireguard protocol as the source ports of the scan message, and use the NAT rules of iptables to DNAT (Destination Network Address Translation) the inflow traffic of these 256 ports to the listenport (receiving port) of Wireguard of device 21. Iptables is a commonly used firewall software in Linux system. It can implement NAT (Network Address Translation) function by configuring rules, so that devices in the internal network can be accessed through the external network.

[0058] The reason for this setting is that if only the listenport of the local Wireguard is used as the source port of the scanning message, there will be only one entry on the local NAT gateway, which is extremely difficult to traverse in the symmetric NAT scenario. However, if the source port of the scanning message sent by the local end is extended to 256, 256 entries can be formed on the local NAT gateway, which will greatly increase the probability of the message traversing the NAT gateway.

[0059] Figure 2 Device A uses 256 source ports, and each source port sends 100 first scan messages with a total of 25,600 random destination ports in batches. These first scan messages are mapped by NAT gateway 22 and arrive at NAT gateway 23. The source port of one of the first scan messages 210 is 1000 (intranet), the destination port is 25101 (public network), the source IP is ip21A (intranet), and the destination IP is ip23B (public network). Similarly, device 24 uses 256 source ports, and each source port sends 100 second scan messages with a total of 25,600 random destination ports in batches. These second scan messages are mapped by NAT gateway 23 and arrive at NAT gateway 22. The source port of one of the second scan messages 240 is 2178 (intranet), the destination port is 3333 (public network), the source IP is ip24B (intranet), and the destination IP is ip22A (public network).

[0060] After the first scanning message 210 passes through the NAT gateway 22, the NAT gateway 22 maps the source IP and source port of the first scanning message according to the public network port allocated this time. The mapping relationship is shown in the mapping table 221. After the first scanning message 210 is mapped, the source IP becomes ip22A (public network), and the source port becomes 3333 (public network), that is, it becomes the first scanning message 211. Similarly, after the second scanning message 240 is mapped by the NAT gateway 23, according to the mapping relationship shown in the mapping table 231, the source IP of the second scanning message 240 becomes ip23B (public network), and the destination IP source port becomes 25101 (public network), that is, it becomes the first scanning message 241. In this way, the message after the first scanning message 210 is mapped by the NAT gateway and the message after the second scanning message 240 is mapped by the NAT gateway are mirror messages to each other. A mirror message refers to two messages, in which the destination IP and destination port of one message are the source IP and source port of another message, and the source IP and source port of the message are the destination IP and destination port of another message. The second scanning message 240 arrives at the intranet port of device 21, and is mapped by the iptables DNAT rule of device 21. Finally, the message arrives at the listenport of Wireguard and enters the Wireguard protocol stack for processing.

[0061] In one example, the scanning strategy can be defined by designing the Wireguard configuration parameters. The parameters for defining the scanning strategy are as follows: PortRange (port range) configures the random range of the destination port of the scan message. The default value is 1024-65535. Each scan message takes a random number in this range as the destination port of the message. multSportEnable (multi-protocol port mapping) configures whether to open 256 random ports as the source ports of the scan message. The default value is true, which means enabled. rekeyTimeout (re-send time) configures the scanning message sending period, the default value is 1s; detectBatchNum (detection batch number) configures the number of scan packets sent at one time by the preset source port (i.e. the random port on the local end). The default value is 100; prePktDelay (preset packet delay) configures the interval for sending scan messages, the default is 10us; totalTryNum (total number of attempts) configures the maximum number of scan attempts. The default value is 1000.

[0062] The disclosed embodiment newly designs a port scanning function in the target protocol stack, and scans the public network port allocated to the other end by sending a port scanning message, so that the method can be used by deploying the Wireguard protocol, thereby making the deployment of the method simple and the function reliable.

[0063] In some embodiments, generating the first scanning message according to the port scanning strategy includes: generating a local encryption public key using a target protocol; and generating the first scanning message according to the port scanning strategy and the local encryption public key.

[0064] Establishing a direct connection through link with the other end according to the second scanning message, including: obtaining the information of the other end and the encryption public key of the other end according to the second scanning message; performing handshake negotiation with the other end according to the information of the other end, the encryption public key of the other end and the encryption public key of the local end to establish the direct connection through link.

[0065] When the local end generates the first scanning message according to the port scanning strategy, the Wireguard protocol can be used to generate the local encryption public key, and then the first scanning message is generated according to the port scanning strategy and the local encryption public key.

[0066] Similarly, the second scanning message sent by the peer end will also carry the encrypted public key of the peer end. The local end can parse the second scanning message to obtain the information of the peer device and the encrypted public key of the peer end. Then, handshake negotiation is performed with the peer end based on the information of the peer end, the encrypted public key of the peer end and the encrypted public key of the local end. In this process, the group first establishes an encrypted communication channel through the encrypted public key, and then the two parties conduct handshake negotiation on the basis of the encrypted communication channel to establish an encrypted direct connection link, making the establishment of the direct connection link more secure and confidential.

[0067] After establishing a direct connection through the link using the above method, you can control the mutual access of intranet services through the Wireguard protocol allowedips configuration item. Alowedips means allowed IP addresses, which indicates the range of IP addresses that are allowed to access a certain network or server. By setting allowed IP addresses, you can limit access to specific resources or services and improve network security. In network management, it can help administrators control whether the target can access their network.

[0068] First, a Wireguard network card is deployed on each intranet server that needs to be directly connected, and an intranet IP is assigned to the Wireguard network card. The peer (peer entity) is configured to point to the other end. If there are multiple peers, multiple peers are configured. Then allowedips is configured to allow mutual access between Wireguard network cards. Figure 3 Taking the scenario shown in the figure as an example, the allowedips of Wireguard313 on intranet 31 can be configured as the IP of wiregaurd322 and the IP of wireagurd332. After the crossing is successful, Wireguard313 can communicate with Wireguard322 and Wireguard332. If users on intranet 31 want to access intranet service 323 on intranet 32 ​​or intranet service 333 on intranet 33, they only need to use the IP of Wireguard-322 or Wireguard332 as the destination IP and the intranet service port of the other end as the destination port. After the outer UDP tunnel header message is encapsulated by the wireagurd protocol (such as Figure 4 As shown in the figure, the message is transmitted through the public network and passes through the peer NAT gateway to reach the peer Wireguard network card, where the outer tunnel header is stripped and the inner message is decrypted, finally reaching the intranet service.

[0069] The following is a description of a device for establishing a direct connection through link provided by the present invention. The device for establishing a direct connection through link described below and the method for establishing a direct connection through link described above can be referred to each other.

[0070] like Figure 5As shown, the apparatus 500 for establishing a direct connection through link provided by the present invention includes the following modules: The acquisition module 501 is used to acquire the public IP address of the other end; The scanning module 502 is used to generate a first scanning message based on the public network IP of the other end and a random port available on the public network, and send the first scanning message; The receiving module 503 is used to receive the second scanning message when the second scanning message sent by the opposite end after being mapped by the opposite end NAT gateway and the first scanning message mapped by the local end NAT gateway are mirror messages to each other and the two parties collide on the local end NAT gateway; The establishing module 504 is used to establish a direct connection through link with the opposite end according to the second scanning message.

[0071] According to the establishment of a direct connection through link provided by the present invention, according to the establishment device of the direct connection through link provided by the present invention, a first scanning message is generated based on the public network IP of the opposite end and the random port available on the public network, and when the first scanning message is sent, the scanning module is specifically used for: Install the target protocol; A port scanning strategy of the target protocol is configured based on the random port available on the public network and the public IP address of the other end, and a first scanning message is generated according to the port scanning strategy; A first scanning message is sent using the target protocol.

[0072] According to the apparatus for establishing a direct connection through link provided by the present invention, when configuring the port scanning strategy of the target protocol based on the random port available on the public network and the public IP of the other end, the scanning module is specifically used for: Configure the random ports available on the public network as the randomly selected range of the destination port of the first scan message in the port scanning strategy; Setting a plurality of local random ports according to the target protocol, and configuring the plurality of local random ports as a random selection range of the source port of the first scanning message in the port scanning strategy; Configure the public IP of the other end as the destination IP of the first scan message in the port scan strategy, and configure the local IP as the source IP of the first scan message in the port scan strategy.

[0073] According to the device for establishing a direct connection through link provided by the present invention, the port scanning strategy also includes at least one of the following: The sending period of the first scanning message, the number of first scanning messages sent by each source port at a single time, the sending interval of the first scanning message, and the maximum number of times the first scanning message is sent.

[0074] According to the apparatus for establishing a direct connection through link provided by the present invention, when establishing a direct connection through link with the opposite end according to the second scanning message, the establishing module is specifically used for: Acquire information of the other end according to the second scanning message; Use the information of the other end to perform handshake negotiation with the other end and establish a direct connection through the link.

[0075] According to the apparatus for establishing a direct connection through link provided by the present invention, when generating a first scanning message according to a port scanning strategy, the scanning module is specifically used for: Generate the local encryption public key using the target protocol; A first scanning message is generated according to the port scanning strategy and the local encryption public key.

[0076] According to the apparatus for establishing a direct connection through link provided by the present invention, when establishing a direct connection through link with the opposite end according to the second scanning message, the establishing module is specifically used for: Acquire information of the other end and an encryption public key of the other end according to the second scanning message; Perform handshake negotiation with the peer end based on the peer end information, the peer end encryption public key, and the local end encryption public key to establish a direct connection through link.

[0077] Figure 6 An example of a physical structure diagram of an electronic device is shown in FIG. Figure 6 As shown, the electronic device may include: a processor 1110, a communications interface 1120, a memory 1130 and a communication bus 1140, wherein the processor 1110, the communications interface 1120, and the memory 1130 communicate with each other through the communication bus 1140. The processor 1110 may call the logic instructions in the memory 1130 to execute a method for establishing a direct connection through link, the method comprising: Get the public IP address of the other end; Generate a first scanning message based on the public network IP of the other end and a random port available on the public network, and send the first scanning message; When the second scanning message sent by the opposite end after being mapped by the opposite end NAT gateway and the first scanning message mapped by the local end NAT gateway are mirror messages to each other, and the two parties collide on the local end NAT gateway, the second scanning message is received; A direct connection traversal link is established with the opposite end according to the second scanning message.

[0078] In addition, the logic instructions in the above-mentioned memory 1130 can be implemented in the form of a software functional unit and can be stored in a computer-readable storage medium when it is sold or used as an independent product. Based on such an understanding, the technical solution of the present invention, in essence, or the part that contributes to the prior art or the part of the technical solution, can be embodied in the form of a software product, and the computer software product is stored in a storage medium, including a number of instructions for a computer device (which can be a personal computer, a server, or a network device, etc.) to perform all or part of the steps of the method described in each embodiment of the present invention. The aforementioned storage medium includes: U disk, mobile hard disk, read-only memory (ROM, Read-Only Memory), random access memory (RAM, Random Access Memory), disk or optical disk, etc. Various media that can store program codes.

[0079] On the other hand, the present invention further provides a non-transitory computer-readable storage medium having a computer program stored thereon, which is implemented when the computer program is executed by a processor to execute the method for establishing a direct connection through link provided by the above methods, the method comprising: Get the public IP address of the other end; Generate a first scanning message based on the public network IP of the other end and a random port available on the public network, and send the first scanning message; When the second scanning message sent by the opposite end after being mapped by the opposite end NAT gateway and the first scanning message mapped by the local end NAT gateway are mirror messages to each other, and the two parties collide on the local end NAT gateway, the second scanning message is received; A direct connection traversal link is established with the opposite end according to the second scanning message.

[0080] In another aspect, the present invention further provides a computer program product, the computer program product comprising a computer program, the computer program can be stored on a non-transitory computer-readable storage medium, and when the computer program is executed by a processor, the computer can execute the method for establishing a direct connection through link provided by the above methods, the method comprising: Get the public IP address of the other end; Generate a first scanning message based on the public network IP of the other end and a random port available on the public network, and send the first scanning message; When the second scanning message sent by the opposite end after being mapped by the opposite end NAT gateway and the first scanning message mapped by the local end NAT gateway are mirror messages to each other, and the two parties collide on the local end NAT gateway, the second scanning message is received; A direct connection traversal link is established with the opposite end according to the second scanning message.

[0081] The device embodiments described above are merely illustrative, wherein the units described as separate components may or may not be physically separated, and the components displayed as units may or may not be physical units, that is, they may be located in one place, or they may be distributed on multiple network units. Some or all of the modules may be selected according to actual needs to achieve the purpose of the scheme of this embodiment. Ordinary technicians in this field can understand and implement it without paying creative labor.

[0082] Through the description of the above implementation methods, those skilled in the art can clearly understand that each implementation method can be implemented by means of software plus a necessary general hardware platform, and of course, can also be implemented by hardware. Based on this understanding, the above technical solution is essentially or the part that contributes to the prior art can be embodied in the form of a software product, and the computer software product can be stored in a computer-readable storage medium, such as ROM / RAM, a disk, an optical disk, etc., including a number of instructions for a computer device (which can be a personal computer, a server, or a network device, etc.) to execute the methods described in each embodiment or some parts of the embodiments.

[0083] Finally, it should be noted that the above embodiments are only used to illustrate the technical solutions of the present invention, rather than to limit it. Although the present invention has been described in detail with reference to the aforementioned embodiments, those skilled in the art should understand that they can still modify the technical solutions described in the aforementioned embodiments, or make equivalent replacements for some of the technical features therein. However, these modifications or replacements do not deviate the essence of the corresponding technical solutions from the spirit and scope of the technical solutions of the embodiments of the present invention.

Claims

1. A method for establishing a direct connection through a link, characterized in that: The method comprises: Get the public IP address of the other end; Generate a first scanning message based on the public network IP of the peer and a random port available on the public network, and send the first scanning message; When the second scanning message sent by the opposite end after being mapped by the opposite end NAT gateway and the first scanning message after being mapped by the local end NAT gateway are mirror messages to each other, and the two parties collide on the local end NAT gateway, receiving the second scanning message; A direct connection traversal link is established with the opposite end according to the second scanning message.

2. The method for establishing a direct connection through link according to claim 1, characterized in that: The generating a first scanning message based on the public network IP of the opposite end and a random port available on the public network, and sending the first scanning message, comprises: Install the target protocol; A port scanning strategy for a target protocol is configured based on the random port available on the public network and the public IP address of the peer, and the first scanning message is generated according to the port scanning strategy; The first scanning message is sent using the target protocol.

3. The method for establishing a direct connection through link according to claim 2, characterized in that: The port scanning strategy of the target protocol is configured based on the random port available on the public network and the public IP address of the peer end, including: Configuring the random ports available on the public network as the randomly selected range of the destination ports of the first scanning message in the port scanning strategy; Setting a plurality of local random ports according to the target protocol, and configuring the plurality of local random ports as a random selection range of source ports of the first scanning message in the port scanning strategy; The public network IP of the opposite end is configured as the destination IP of the first scanning message in the port scanning strategy, and the local IP is configured as the source IP of the first scanning message in the port scanning strategy.

4. The method for establishing a direct connection through link according to claim 2, characterized in that: The port scanning strategy also includes at least one of the following: The sending period of the first scanning message, the number of the first scanning messages sent by each source port at a single time, the sending interval of the first scanning message, and the maximum number of times the first scanning message is sent.

5. The method for establishing a direct connection through link according to claim 1, characterized in that: Establishing a direct connection through link with the opposite end according to the second scanning message includes: Acquire information of the opposite end according to the second scanning message; The information of the opposite end is used to perform handshake negotiation with the opposite end to establish a direct connection through link.

6. The method for establishing a direct connection through link according to claim 2, characterized in that: The generating the first scanning message according to the port scanning strategy includes: Generate a local encryption public key using the target protocol; The first scanning message is generated according to the port scanning strategy and the local encryption public key.

7. The method for establishing a direct connection through link according to claim 6, characterized in that: The establishing a direct connection through link with the opposite end according to the second scanning message includes: Acquire the information of the opposite end and the encryption public key of the opposite end according to the second scanning message; A handshake negotiation is performed with the peer end according to the information of the peer end, the peer end encryption public key and the local end encryption public key to establish a direct connection through link.

8. A device for establishing a direct connection through link, characterized in that: include: The acquisition module is used to obtain the public IP address of the other end; A scanning module, used to generate a first scanning message based on the public network IP of the opposite end and a random port available on the public network, and send the first scanning message; A receiving module, configured to receive the second scanning message when the second scanning message sent by the opposite end after being mapped by the opposite end NAT gateway and the first scanning message after being mapped by the local end NAT gateway are mirror messages to each other and the two parties collide on the local end NAT gateway; An establishing module is used to establish a direct connection crossing link with the opposite end according to the second scanning message.

9. An electronic device comprising a memory, a processor, and a computer program stored in the memory and executable on the processor, wherein: When the processor executes the program, the method for establishing a direct connection crossing link as described in any one of claims 1 to 7 is implemented.

10. A non-transitory computer-readable storage medium having a computer program stored thereon, characterized in that: When the computer program is executed by a processor, the method for establishing a direct connection through link as claimed in any one of claims 1 to 7 is implemented.

11. A computer program product, comprising a computer program, characterized in that When the computer program is executed by a processor, the method for establishing a direct connection through link as claimed in any one of claims 1 to 7 is implemented.

Images