Method, device, equipment and medium for establishing direct connection through link

Abstract

The present invention provides a method, device, equipment, and medium for establishing a direct connection through a link. The method includes: obtaining the public network IP address of the opposite end; generating a first scanning message based on the public network IP address of the opposite end and a random port available on the public network, and sending the first scanning message; when a second scanning message sent by the opposite end after being mapped by the opposite end NAT gateway and a first scanning message after being mapped by the local end NAT gateway are mirror images of each other, and a collision occurs between the two at the local end NAT gateway, receiving the second scanning message; and establishing a direct connection through a link with the opposite end based on the second scanning message. This method does not require the deployment of a public network relay node as a transit station to achieve transit through a link, reduces the cost of through-travel, and can meet the decentralization requirements of some current apps.

Description

Technical Field

[0001] The present invention relates to the field of communication technology, and in particular to a method, device, equipment and medium for establishing a direct connection through a link. Background Art

[0002] Network Address Translation (NAT) traversal is a technology used to address inter-network access between intranet devices. A NAT gateway is a network device typically used to map multiple private Internet Protocol (IP) addresses to one or more public IP addresses, allowing multiple devices to share a single public IP address. This can help improve network security and efficiently utilize IP address resources, but it can also cause connectivity issues because it modifies IP address and port information. For services deployed on an intranet, carriers generally do not allocate public IP addresses to such users. For users without public IP addresses, deploying intranet services requires using services such as Dynamic Domain Name Server (DDNS) to allow external users to access the service, preventing direct access from external users. The primary goal of NAT traversal is to enable connection requests from external networks to reach intranet services in networks with NAT devices, thereby establishing an end-to-end direct connection.

[0003] Generally speaking, NAT can be divided into four types: Full Cone, IP Restricted Cone, Port Restricted Cone, and Symmetric.

[0004] Existing NAT traversal technologies can achieve direct peer-to-peer (P2P) traversal for some NAT types. However, they cannot achieve direct peer-to-peer (P2P) traversal in the following two network scenarios: when both ends use symmetric NAT; or when one end uses a port-restricted cone NAT and the other uses symmetric NAT. In symmetric NAT scenarios, when an intranet device uses the same source IP and source port to access different destination IPs and ports, the public port mapped by the NAT gateway is not fixed. Therefore, the public port after NATing the intranet IP and port cannot be obtained. Therefore, direct traversal is impossible. Public network relay nodes must be deployed as relay stations, with both ends connecting to the relay nodes to achieve relay traversal. This relay node deployment increases traversal costs and fails to meet the decentralized requirements of some current applications. Summary of the Invention

[0005] The present invention provides a method, device, equipment and medium for establishing a direct connection crossing link, which is used to solve the problem in related technologies that public network relay nodes need to be deployed to achieve transit crossing, which increases the crossing cost and cannot meet the decentralization requirements of some current APPs.

[0006] The present invention provides a method for establishing a direct connection through a link, comprising the following steps.

[0007] Get the public IP of the other end;

[0008] Generate a first scanning message based on the public IP address of the other end and a random port available on the public network, and send the first scanning message;

[0009] When the second scanning message sent by the peer end after being mapped by the peer end NAT gateway and the first scanning message mapped by the local end NAT gateway are mirror messages of each other and the two collide on the local end NAT gateway, the second scanning message is received;

[0010] Establish a direct connection through link with the opposite end according to the second scanning message.

[0011] According to the method for establishing a direct connection through a link provided by the present invention, a first scanning message is generated based on the public IP address of the other end and a random port available on the public network, and the first scanning message is sent, including:

[0012] Install the target protocol;

[0013] Configuring a port scanning strategy for the target protocol based on a random port available on the public network and the public IP address of the peer end, and generating a first scanning message according to the port scanning strategy;

[0014] A first scanning message is sent using the target protocol.

[0015] According to the method for establishing a direct connection through a link provided by the present invention, a port scanning strategy for a target protocol is configured based on a random port available on the public network and the public IP address of the other end, including:

[0016] Configure a random port available on the public network as the randomly selected range of the destination port of the first scan message in the port scanning strategy;

[0017] Setting multiple local random ports according to the target protocol, and configuring the multiple local random ports as a random selection range of source ports of the first scan message in the port scanning strategy;

[0018] Configure the public IP of the other end as the destination IP of the first scan message in the port scan strategy, and configure the local IP as the source IP of the first scan message in the port scan strategy.

[0019] According to the method for establishing a direct traversal link provided by the present invention, the port scanning strategy further includes at least one of the following:

[0020] The sending period of the first scanning message, the number of first scanning messages sent by each source port in a single time, the sending interval of the first scanning message, and the maximum number of times the first scanning message is sent.

[0021] According to the method for establishing a direct connection through link provided by the present invention, establishing a direct connection through link with the opposite end according to the second scanning message includes:

[0022] Obtaining information about the other end according to the second scanning message;

[0023] Use the information of the other end to conduct handshake negotiation with the other end to establish a direct connection through the link.

[0024] According to the method for establishing a direct connection through link provided by the present invention, generating a first scanning message according to a port scanning strategy includes:

[0025] Generate the local encryption public key using the target protocol;

[0026] A first scanning message is generated according to the port scanning strategy and the local encryption public key.

[0027] According to the method for establishing a direct connection through link provided by the present invention, establishing a direct connection through link with the opposite end according to the second scanning message includes:

[0028] Obtaining information of the other end and the encryption public key of the other end according to the second scanning message;

[0029] The client performs handshake negotiation with the peer based on the peer's information, the peer's encryption public key, and the local encryption public key to establish a direct connection through the link.

[0030] The present invention also provides a device for establishing a direct connection through a link, comprising the following modules:

[0031] Acquisition module, used to obtain the public IP of the other end;

[0032] A scanning module, configured to generate a first scanning message based on the public IP address of the other end and a random port available on the public network, and send the first scanning message;

[0033] A receiving module, configured to receive the second scanning message when the second scanning message sent by the opposite end after being mapped by the opposite end NAT gateway and the first scanning message mapped by the local end NAT gateway are mirror images of each other and the two parties collide on the local end NAT gateway;

[0034] An establishing module is used to establish a direct connection through link with the opposite end according to the second scanning message.

[0035] According to a direct connection through link establishment provided by the present invention, according to the direct connection through link establishment device provided by the present invention, a first scanning message is generated based on the public IP address of the other end and a random port available on the public network, and when the first scanning message is sent, the scanning module is specifically used to:

[0036] Install the target protocol;

[0037] Configuring a port scanning strategy for the target protocol based on a random port available on the public network and the public IP address of the peer end, and generating a first scanning message according to the port scanning strategy;

[0038] A first scanning message is sent using the target protocol.

[0039] According to the apparatus for establishing a direct connection through a link provided by the present invention, when configuring a port scanning strategy for a target protocol based on a random port available on the public network and the public IP address of the other end, the scanning module is specifically configured to:

[0040] Configure a random port available on the public network as the randomly selected range of the destination port of the first scan message in the port scanning strategy;

[0041] Setting multiple local random ports according to the target protocol, and configuring the multiple local random ports as a random selection range of source ports of the first scan message in the port scanning strategy;

[0042] Configure the public IP of the other end as the destination IP of the first scan message in the port scan strategy, and configure the local IP as the source IP of the first scan message in the port scan strategy.

[0043] According to the apparatus for establishing a direct connection through a link provided by the present invention, the port scanning strategy further includes at least one of the following:

[0044] The sending period of the first scanning message, the number of first scanning messages sent by each source port in a single time, the sending interval of the first scanning message, and the maximum number of times the first scanning message is sent.

[0045] According to the apparatus for establishing a direct connection through link provided by the present invention, when establishing a direct connection through link with the opposite end according to the second scanning message, the establishing module is specifically configured to:

[0046] Obtaining information about the other end according to the second scanning message;

[0047] Use the information of the other end to conduct handshake negotiation with the other end to establish a direct connection through the link.

[0048] According to the apparatus for establishing a direct connection through link provided by the present invention, when generating a first scanning message according to a port scanning strategy, the scanning module is specifically configured to:

[0049] Generate the local encryption public key using the target protocol;

[0050] A first scanning message is generated according to the port scanning strategy and the local encryption public key.

[0051] According to the apparatus for establishing a direct connection through link provided by the present invention, when establishing a direct connection through link with the opposite end according to the second scanning message, the establishing module is specifically configured to:

[0052] Obtaining information of the other end and the encryption public key of the other end according to the second scanning message;

[0053] The client performs handshake negotiation with the peer based on the peer's information, the peer's encryption public key, and the local encryption public key to establish a direct connection through the link.

[0054] The present invention also provides an electronic device, comprising a memory, a processor, and a computer program stored in the memory and executable on the processor. When the processor executes the program, any of the above-mentioned methods for establishing a direct connection through a link is implemented.

[0055] The present invention also provides a non-transitory computer-readable storage medium having a computer program stored thereon. When the computer program is executed by a processor, the computer program implements any of the above-mentioned methods for establishing a direct connection through a link.

[0056] The present invention also provides a computer program product, including a computer program, which implements any of the above-mentioned methods for establishing a direct connection through a link when executed by a processor.

[0057] The method for establishing a direct connection through link provided by the present invention first obtains the public network IP of the other end, then generates a first scanning message based on the public network IP of the other end and a random port available on the public network, and sends the first scanning message. When the second scanning message sent by the other end after being mapped by the NAT gateway of the other end and the first scanning message after being mapped by the NAT gateway of the local end are mirror messages of each other, and the two sides collide on the NAT gateway of the local end, the second scanning message can pass through the NAT gateway, and the local end is able to receive the second scanning message, thereby establishing a direct connection through link with the other end according to the second scanning message. Using the method provided by the embodiment of the present invention, it is only necessary to start the port scan of the public network by sending a scanning message, so that the two ends may send scanning messages that are mirror messages of each other. When the scanning messages sent by the two ends as mirror messages collide on the NAT gateway, the scanning message can pass through the gateway due to the mapping rules of the NAT gateway, thereby allowing the two ends to establish a direct connection through link according to the scanning message, thereby achieving direct connection through. This method does not require the deployment of a public network relay node as a transit station, reduces the crossing cost, and can meet the current decentralized needs of some APPs. BRIEF DESCRIPTION OF THE DRAWINGS

[0058] In order to more clearly illustrate the technical solutions in the present invention or the prior art, a brief introduction is given below to the drawings required for use in the embodiments or the description of the prior art. Obviously, the drawings described below are some embodiments of the present invention. For ordinary technicians in this field, other drawings can be obtained based on these drawings without paying any creative work.

[0059] Figure 1 It is a flow chart of the method for establishing a direct connection through link provided by the present invention.

[0060] Figure 2 It is a schematic diagram of an application scenario provided by the present invention.

[0061] Figure 3 It is a schematic diagram of another application scenario provided by the present invention.

[0062] Figure 4 It is a schematic diagram of a public network message after the intranet access request provided by the present invention is encapsulated by wireagurd.

[0063] Figure 5 It is a structural diagram of the device for establishing a direct connection through link provided by the present invention.

[0064] Figure 6 It is a structural schematic diagram of the electronic device provided by the present invention. DETAILED DESCRIPTION

[0065] To make the objectives, technical solutions, and advantages of the present invention more clear, the technical solutions of the present invention will be clearly and completely described below in conjunction with the accompanying drawings. Obviously, the embodiments described are only some of the embodiments of the present invention, not all of them. Based on the embodiments of the present invention, all other embodiments obtained by ordinary technicians in this field without making creative efforts shall fall within the scope of protection of the present invention.

[0066] NAT traversal is a technology used to address inter-network access between intranet devices. A NAT gateway is a network device typically used to map multiple private IP addresses to one or more public IP addresses, allowing multiple devices to share a single public IP address. This can help improve network security and efficiently utilize IP address resources, but it can also cause some connectivity issues because it modifies IP address and port information. For services deployed on the intranet, operators generally do not allocate public IP addresses to such users. For users without public IP addresses, deploying intranet services requires using services such as DDNS to allow external users to access the service, and external users cannot access it directly. The main goal of NAT traversal technology is to enable connection requests from the external network to reach the intranet service in a network with a NAT device, so as to establish an end-to-end direct connection.

[0067] Generally speaking, NAT can be divided into four types: Full Cone, IP Restricted Cone, Port Restricted Cone, and Symmetric.

[0068] Existing NAT traversal technology can achieve direct P2P connections for some NAT types, but it cannot in the following two network scenarios: when both ends use symmetric NAT; or when one end uses a port-restricted cone NAT and the other uses symmetric NAT. This is because when an intranet device uses the same source IP and source port to access different destination IPs and ports, the public port mapped by the NAT gateway is not a fixed port, so the public port of the intranet IP and port after NAT is not obtained. When both ends use symmetric NAT, the services on either end lack fixed public ports, making direct traversal impossible. A public relay node must be deployed as a transit station, with both ends connected to the relay node to achieve transit traversal. When one end uses a port-restricted cone NAT and the other uses a symmetric NAT, intranet traffic will have a fixed public IP and port after being mapped by the port-restricted cone NAT. However, if one end uses symmetric NAT, that end will not have a fixed public port. For extranet traffic to enter the intranet through this public port, the intranet must first access the extranet's public IP and port, ultimately requiring transit through a relay node to achieve NAT traversal. This relay node deployment solution increases traversal costs and fails to meet the decentralization requirements of some current apps.

[0069] Therefore, a method for establishing a direct connection through a link is urgently needed to solve the above problems.

[0070] The following combination Figures 1-6The present invention describes a method, apparatus, device and medium for establishing a direct connection through a link.

[0071] Figure 1 This is one of the flow charts of the method for establishing a direct connection through a link provided by the present invention. Figure 1 As shown, the method includes the following:

[0072] Step 101: Get the public IP address of the other party.

[0073] When a peer device accesses the external network through a symmetric NAT gateway, the NAT gateway assigns it a public IP address and port number. Because each time an internal device communicates with a different external destination, the NAT gateway assigns a different public port number. This means that the public port mapped by the NAT gateway to the peer service port is not fixed. Therefore, the public port mapped by the NAT gateway to the internal service cannot be determined explicitly. However, the assigned public IP address is generally fixed, typically the public IP address of the NAT gateway. Therefore, the peer's public IP address can be obtained using network query tools or command-line interfaces.

[0074] Figure 2 is a schematic diagram of an application scenario provided by the present invention, such as Figure 2 As shown, device 21 and device 24 access the external network through NAT gateway 22 and NAT gateway 23, respectively. Devices 21 and 24 are on different intranets. When devices 21 and 24 need to establish a direct connection, they become peers. Device 21 obtains the public IP address of device 24, its peer, as IP 23B, which is assigned by NAT gateway 23. Device 24 obtains the public IP address of device 21, its peer, as IP 22A, which is assigned by NAT gateway 22.

[0075] Step 102: Generate a first scanning message based on the public IP address of the other end and a random port available on the public network, and send the first scanning message.

[0076] Usually, the port number range assigned by NAT gateway to intranet devices is fixed, for example, 1024-65535, that is, the number range of random ports available on the public network is fixed, and these random public network ports are shared by different NAT gateways. Figure 2 In the illustrated scenario, the number range of the public network random port allocated by NAT gateway 22 to device 21 is the same as the number range of the public network random port allocated by NAT gateway 23 to device 24 .

[0077] Each time an intranet device communicates with the external network through the NAT gateway, the port of the intranet device will be mapped to the public network port assigned to it by the NAT gateway. Therefore, as device 24 is the opposite device of device 21, the public network port range mapped by its intranet port is always within the number range of the public random port. The public network IP of device 24 is used as the destination IP of the scanning message, and the public network port that may be assigned to device 24 is used as the destination port of the scanning message. Device 21 can scan the public network port assigned to device 24 by sending scanning messages with different public random ports as the destination port. Conversely, device 24 can also scan the public network port assigned to device 21 by sending scanning messages.

[0078] Step 103: When the second scanning message sent by the opposite end after being mapped by the opposite end NAT gateway and the first scanning message mapped by the local end NAT gateway are mirror messages of each other and the two collide on the local end NAT gateway, the second scanning message is received.

[0079] like Figure 2 As shown, the second scan message 241 enters the NAT gateway 22 and collides with the first scan message 211 on the NAT gateway 22. Message collision on the NAT gateway means that during the validity period of a NAT session, the message outgoing from the NAT gateway and the message entering the NAT gateway are mirror images of each other.

[0080] Because the mapping table of NAT gateway 22 records the mapping rules for the destination IP address and destination port of second scan message 241, when first scan message 211 and second scan message 241 collide on NAT gateway 22, second scan message 241 is mapped according to the mapping rules in the mapping table, thereby passing through NAT gateway 22, allowing device 21 to receive second scan message 240. Similarly, when first scan message 211 and second scan message 241 collide on NAT gateway 23, first scan message 211 can also pass through NAT gateway 23, allowing device 24 to receive first scan message 210.

[0081] In a scenario where both ends use symmetric NAT, for external traffic to traverse the symmetric NAT gateway and reach an internal service (intranet IP + port), the internal service must first send a packet to the source IP and source port of the external traffic, establishing a NAT session on the NAT gateway. When external traffic reaches the NAT gateway, it matches the session with the packet's source IP as the destination IP and the source port as the destination port group key. Only then can the traffic traverse the NAT gateway and reach the internal service. Port scan packets sent by the internal service to the outside world can establish a session on the NAT gateway, but if this session is not hit by external traffic within a certain period of time, it expires. The session expiration time is defined by the specific NAT gateway and is generally between 5 and 30 seconds. Therefore, increasing the probability of collision between internal port scan packets and external access packets before the session expires is crucial for traversing NAT.

[0082] In a scenario with a symmetric NAT on one end and a port-restricted cone NAT on the other, intranet traffic mapped through the port-restricted cone NAT will have a fixed public IP and port. This means that once a communication begins, traffic from the same intranet device will communicate through the specific public IP address and port until the communication ends or times out. Therefore, for external traffic to traverse the port-restricted cone NAT, all it needs to do is for the intranet service behind the port-restricted cone NAT to send a packet to the source IP and source port of the external traffic. The external traffic, using the fixed public IP and port as the destination IP and destination port group key, will then match the session established on the NAT gateway for the packet. This allows the traffic to traverse the port-restricted cone NAT and reach the internal service. Similar to traversing a symmetric NAT gateway, when the intranet service behind the symmetric NAT gateway sends a packet to the source IP and source port of the external traffic, the external traffic, using the source IP as the destination IP and source port as the destination port group key, will match the session established on the NAT gateway for the packet. This allows the external traffic to traverse the NAT gateway and reach the internal service.

[0083] Step 104: Establish a direct connection link with the opposite end according to the second scanning message.

[0084] When the local device receives the second scan message sent by the peer device, it parses the second scan message to obtain the peer device information contained therein, such as the peer device's IP address and port number. Using this information, the local device performs a handshake negotiation with the peer device, establishing a direct link with the peer device.

[0085] Using the method provided by an embodiment of the present invention, it is only necessary to initiate port scanning on the public network by sending a scanning message, so that both ends may send scanning messages that are mirror images of each other. When the scanning messages sent by both ends collide on the NAT gateway, the mapping rules of the NAT gateway allow the scanning message to pass through the gateway, thereby allowing the two ends to establish a direct connection and achieve direct connection. This method does not require the deployment of public network relay nodes as transfer stations, reduces the cost of traversal, and can meet the decentralization requirements of some current apps.

[0086] In some embodiments, a first scanning message is generated based on the public IP of the opposite end and a random port available on the public network, and the first scanning message is sent, including: installing the target protocol; configuring the port scanning strategy of the target protocol based on the random port available on the public network and the public IP of the opposite end, and generating the first scanning message according to the port scanning strategy; and sending the first scanning message using the target protocol.

[0087] For example, you can install the WireGuard protocol configuration to configure port scanning policies. The WireGuard protocol is a modern, open-source VPN protocol that provides simple, efficient, and secure network connections. It is easy to configure and suitable for a variety of scenarios, including remote access, network interconnection, and edge computing.

[0088] like Figure 2 As shown, WireGuard protocol 1111 is installed on device 21. By extending the WireGuard protocol, it can send port scan messages, giving the WireGuard protocol port scanning functionality. The same applies to WireGuard protocol 2222 installed on device 21. Specifically, a new UDP (User Datagram Protocol) port scan message type (natscan message) is added to the WireGuard protocol, which is the first scan message. The destination IP address of the first scan message is the public IP address of the peer end (i.e., the public IP address of the peer NAT gateway), and the destination port is a random public port number, randomly selected from the public port number range (1024-65535). The local IP address and port number of device 21 are used as the source IP address and source port number of the first scan message. Multiple first scan messages are then sent using the WireGuard protocol. Similarly, device 24 sends multiple second scan messages. The specific implementation process is similar to that of device 21 and will not be repeated here.

[0089] In some embodiments, a port scanning strategy for a target protocol is configured based on a random port available on the public network and a public IP of the other end, including: configuring a random port available on the public network as a randomly selected range of the destination port of the first scanning message in the port scanning strategy; setting a plurality of local random ports according to the target protocol, and configuring the plurality of local random ports as a randomly selected range of the source port of the first scanning message in the port scanning strategy; configuring the public IP of the other end as the destination IP of the first scanning message in the port scanning strategy, and configuring the local IP as the source IP of the first scanning message in the port scanning strategy.

[0090] The port scanning strategy also includes at least one of the following: a sending period of the first scanning message, the number of first scanning messages sent by each source port at a time, a sending interval of the first scanning message, and a maximum number of sending times of the first scanning message.

[0091] like Figure 2 As shown, device 21 can set 256 random ports in the WireGuard protocol as the source ports for scanning messages and use iptables' NAT rules to DNAT (Destination Network Address Translation) the incoming traffic from these 256 ports to the WireGuard listenport of device 21. iptables is a common firewall software for Linux systems. It can implement NAT (Network Address Translation) by configuring rules, allowing devices on the internal network to be accessed from the external network.

[0092] The reason for this setting is that if only the listenport of the local WireGuard is used as the source port of the scanning message, there will be only one entry point on the local NAT gateway, which is extremely difficult to traverse in the symmetric NAT scenario. However, if the source port of the scanning message sent by the local end is expanded to 256, 256 entries can be formed on the local NAT gateway, which will greatly increase the probability of the message traversing the NAT gateway.

[0093] Figure 2Device A uses 256 source ports, sending 100 first scan packets per source port, for a total of 25,600 packets with random destination ports. These first scan packets are mapped by NAT gateway 22 and arrive at NAT gateway 23. One of these first scan packets, 210, has a source port of 1000 (intranet), a destination port of 25101 (public network), a source IP address of ip21A (intranet), and a destination IP address of ip23B (public network). Similarly, device 24 uses 256 source ports, sending 100 second scan packets per source port, for a total of 25,600 packets with random destination ports. These second scan packets are mapped by NAT gateway 23 and arrive at NAT gateway 22. One of these second scan packets, 240, has a source port of 2178 (intranet), a destination port of 3333 (public network), a source IP address of ip24B (intranet), and a destination IP address of ip22A (public network).

[0094] After first scanning message 210 passes through NAT gateway 22, NAT gateway 22 maps the source IP address and source port of the first scanning message according to the newly assigned public network port. The mapping relationship is shown in mapping table 221. After the mapping, the source IP address of first scanning message 210 becomes ip22A (public network), and the source port becomes 3333 (public network), thus becoming first scanning message 211. Similarly, after second scanning message 240 passes through NAT gateway 23, according to the mapping relationship shown in mapping table 231, the source IP address of second scanning message 240 becomes ip23B (public network), and the destination IP address and source port becomes 25101 (public network), thus becoming first scanning message 241. Thus, the first scanning message 210 and the second scanning message 240 after being mapped by the NAT gateway are mirror images of each other. A mirrored message is one in which the destination IP and destination port of one message are the source IP and source port of the other message. The second scan message 240 arrives at the intranet port of device 21, is mapped by the iptables DNAT rule of device 21, and finally reaches the listenport of Wireguard, entering the Wireguard protocol stack for processing.

[0095] In one example, a scanning strategy can be defined by designing Wireguard configuration parameters. The parameters for defining a scanning strategy are as follows:

[0096] PortRange (port range) configures the random range of the destination port of the scan message. The default value is 1024-65535. Each scan message takes a random number in this range as the destination port of the message;

[0097] multSportEnable (multi-protocol port mapping) configures whether to open 256 random ports as the source ports of the scan message. The default value is true, which is enabled.

[0098] rekeyTimeout (re-send time) configures the sending period of the scan message, the default value is 1s;

[0099] detectBatchNum (detection batch number) configures the number of scan packets sent at one time by the preset source port (i.e. the random port on the local end). The default value is 100.

[0100] prePktDelay (preset packet delay) configures the interval for sending scan packets, the default is 10us;

[0101] totalTryNum (total number of attempts) configures the maximum number of scan attempts. The default value is 1000.

[0102] The disclosed embodiment newly designs a port scanning function in the target protocol stack, and scans the public network port allocated to the other end by sending a port scanning message, so that the method can be used by deploying the Wireguard protocol, thereby making the deployment of the method simple and the function reliable.

[0103] In some embodiments, generating the first scanning message according to the port scanning policy includes: generating a local encryption public key using a target protocol; and generating the first scanning message according to the port scanning policy and the local encryption public key.

[0104] Establishing a direct connection through link with the other end according to the second scanning message, including: obtaining the information of the other end and the encryption public key of the other end according to the second scanning message; performing handshake negotiation with the other end according to the information of the other end, the encryption public key of the other end and the encryption public key of the local end to establish the direct connection through link.

[0105] When the local end generates the first scanning message according to the port scanning strategy, the Wireguard protocol can be used to generate the local end encryption public key, and then the first scanning message is generated according to the port scanning strategy and the local end encryption public key.

[0106] Similarly, the second scan message sent by the peer also carries the peer's encryption public key. By parsing the second scan message, the local end obtains the peer device information and the peer's encryption public key. Then, based on the peer's information, the peer's encryption public key, and the local end's encryption public key, a handshake negotiation is performed with the peer. In this process, an encrypted communication channel is first established using the encryption public key. Then, based on the encrypted communication channel, the two parties conduct a handshake negotiation to establish an encrypted direct link, making the direct link establishment more secure and confidential.

[0107] After establishing a direct traversal link using the above method, you can control inter-network access to intranet services using the Wireguard protocol's allowedips configuration item. Allowedips stands for allowed IP addresses and represents the range of IP addresses allowed to access a network or server. By setting allowed IP addresses, you can restrict access to specific resources or services, improving network security. In network management, this helps administrators control whether targets can access their network.

[0108] First, each intranet server that needs direct connection will be deployed with a Wireguard network card, and the Wireguard network card will be assigned an intranet IP, and the peer (peer entity) will be configured to point to the other end. If there are multiple peers, multiple peers will be configured; then allowedips will be configured to allow mutual access between Wireguard network cards. Figure 3 Taking the scenario shown as an example, the allowedips of Wireguard313 on intranet 31 can be configured as the IP of wiregaurd322 and the IP of wireagurd332. After the crossing is successful, Wireguard313 can communicate with Wireguard322 and Wireguard332. If users on intranet 31 want to access intranet service 323 on intranet 32 ​​or intranet service 333 on intranet 33, they only need to use the IP of Wireguard-322 or Wireguard332 as the destination IP and the intranet service port of the other end as the destination port. After the outer UDP tunnel header is encapsulated by the wireagurd protocol (such as Figure 4 As shown in the figure, the message is transmitted over the public network and passes through the peer NAT gateway to reach the peer Wireguard network card, where the outer tunnel header is stripped off and the inner message is decrypted, finally reaching the intranet service.

[0109] The following describes a device for establishing a direct connection through link provided by the present invention. The device for establishing a direct connection through link described below and the method for establishing a direct connection through link described above can refer to each other.

[0110] like Figure 5 As shown, the apparatus 500 for establishing a direct connection through link provided by the present invention includes the following modules:

[0111] Acquisition module 501, used to obtain the public IP address of the other party;

[0112] Scanning module 502, configured to generate a first scanning message based on the public IP address of the peer end and a random port available on the public network, and send the first scanning message;

[0113] The receiving module 503 is configured to receive the second scanning message when the second scanning message sent by the opposite end after being mapped by the opposite end NAT gateway and the first scanning message mapped by the local end NAT gateway are mirror images of each other and the two parties collide on the local end NAT gateway;

[0114] The establishing module 504 is configured to establish a direct connection through link with the opposite end according to the second scanning message.

[0115] According to a direct connection through link establishment provided by the present invention, according to the direct connection through link establishment device provided by the present invention, a first scanning message is generated based on the public IP address of the other end and a random port available on the public network, and when the first scanning message is sent, the scanning module is specifically used to:

[0116] Install the target protocol;

[0117] Configuring a port scanning strategy for the target protocol based on a random port available on the public network and the public IP address of the peer end, and generating a first scanning message according to the port scanning strategy;

[0118] A first scanning message is sent using the target protocol.

[0119] According to the apparatus for establishing a direct connection through a link provided by the present invention, when configuring a port scanning strategy for a target protocol based on a random port available on the public network and the public IP address of the other end, the scanning module is specifically configured to:

[0120] Configure a random port available on the public network as the randomly selected range of the destination port of the first scan message in the port scanning strategy;

[0121] Setting multiple local random ports according to the target protocol, and configuring the multiple local random ports as a random selection range of source ports of the first scan message in the port scanning strategy;

[0122] Configure the public IP of the other end as the destination IP of the first scan message in the port scan strategy, and configure the local IP as the source IP of the first scan message in the port scan strategy.

[0123] According to the apparatus for establishing a direct connection through a link provided by the present invention, the port scanning strategy further includes at least one of the following:

[0124] The sending period of the first scanning message, the number of first scanning messages sent by each source port in a single time, the sending interval of the first scanning message, and the maximum number of times the first scanning message is sent.

[0125] According to the apparatus for establishing a direct connection through link provided by the present invention, when establishing a direct connection through link with the opposite end according to the second scanning message, the establishing module is specifically configured to:

[0126] Obtaining information about the other end according to the second scanning message;

[0127] Use the information of the other end to conduct handshake negotiation with the other end to establish a direct connection through the link.

[0128] According to the apparatus for establishing a direct connection through link provided by the present invention, when generating a first scanning message according to a port scanning strategy, the scanning module is specifically configured to:

[0129] Generate the local encryption public key using the target protocol;

[0130] A first scanning message is generated according to the port scanning strategy and the local encryption public key.

[0131] According to the apparatus for establishing a direct connection through link provided by the present invention, when establishing a direct connection through link with the opposite end according to the second scanning message, the establishing module is specifically configured to:

[0132] Obtaining information of the other end and the encryption public key of the other end according to the second scanning message;

[0133] The client performs handshake negotiation with the peer based on the peer's information, the peer's encryption public key, and the local encryption public key to establish a direct connection through the link.

[0134] Figure 6 An example of a physical structure diagram of an electronic device is shown below. Figure 6 As shown, the electronic device may include: a processor 1110, a communication interface 1120, a memory 1130, and a communication bus 1140, wherein the processor 1110, the communication interface 1120, and the memory 1130 communicate with each other via the communication bus 1140. The processor 1110 may call the logic instructions in the memory 1130 to execute a method for establishing a direct connection through a link, the method including:

[0135] Get the public IP of the other end;

[0136] Generate a first scanning message based on the public IP address of the other end and a random port available on the public network, and send the first scanning message;

[0137] When the second scanning message sent by the peer end after being mapped by the peer end NAT gateway and the first scanning message mapped by the local end NAT gateway are mirror messages of each other and the two collide on the local end NAT gateway, the second scanning message is received;

[0138] Establish a direct connection through link with the opposite end according to the second scanning message.

[0139] Furthermore, the logic instructions in the aforementioned memory 1130 can be implemented as software functional units and, when sold or used as independent products, can be stored in a computer-readable storage medium. Based on this understanding, the technical solution of the present invention, or the portion that contributes to the prior art, or a portion of the technical solution, can be embodied in the form of a software product. This computer software product, stored in a storage medium, includes instructions for enabling a computer device (which can be a personal computer, server, or network device, etc.) to perform all or part of the steps of the methods described in various embodiments of the present invention. The aforementioned storage medium includes various media capable of storing program code, such as a USB flash drive, a mobile hard drive, a read-only memory (ROM), a random access memory (RAM), a magnetic disk, or an optical disk.

[0140] In another aspect, the present invention further provides a non-transitory computer-readable storage medium having a computer program stored thereon. When the computer program is executed by a processor, the method for establishing a direct connection through a link provided by the above methods is implemented, the method comprising:

[0141] Get the public IP of the other end;

[0142] Generate a first scanning message based on the public IP address of the other end and a random port available on the public network, and send the first scanning message;

[0143] When the second scanning message sent by the peer end after being mapped by the peer end NAT gateway and the first scanning message mapped by the local end NAT gateway are mirror messages of each other and the two collide on the local end NAT gateway, the second scanning message is received;

[0144] Establish a direct connection through link with the opposite end according to the second scanning message.

[0145] In yet another aspect, the present invention further provides a computer program product, comprising a computer program that can be stored on a non-transitory computer-readable storage medium. When the computer program is executed by a processor, the computer can perform the method for establishing a direct connection traversal link provided by each of the above methods, the method comprising:

[0146] Get the public IP of the other end;

[0147] Generate a first scanning message based on the public IP address of the other end and a random port available on the public network, and send the first scanning message;

[0148] When the second scanning message sent by the peer end after being mapped by the peer end NAT gateway and the first scanning message mapped by the local end NAT gateway are mirror messages of each other and the two collide on the local end NAT gateway, the second scanning message is received;

[0149] Establish a direct connection through link with the opposite end according to the second scanning message.

[0150] The device embodiments described above are merely illustrative. The units described as separate components may or may not be physically separate, and the components shown as units may or may not be physical units, i.e., they may be located in one location or distributed across multiple network units. Some or all of the modules may be selected based on actual needs to achieve the objectives of the present embodiment. Persons of ordinary skill in the art will be able to understand and implement the present invention without inventive effort.

[0151] Through the above description of the embodiments, those skilled in the art will clearly understand that each embodiment can be implemented using software plus a necessary general-purpose hardware platform, or of course, hardware. Based on this understanding, the essence of the above technical solution, or the portion that contributes to the prior art, can be embodied in the form of a software product. This computer software product can be stored in a computer-readable storage medium, such as ROM / RAM, a magnetic disk, or an optical disk, and includes a number of instructions for causing a computer device (such as a personal computer, server, or network device) to execute the methods described in each embodiment or certain portions of the embodiments.

[0152] Finally, it should be noted that the above embodiments are only used to illustrate the technical solutions of the present invention, rather than to limit it. Although the present invention has been described in detail with reference to the aforementioned embodiments, those skilled in the art should understand that they can still modify the technical solutions described in the aforementioned embodiments, or make equivalent replacements for some of the technical features therein. However, these modifications or replacements do not deviate the essence of the corresponding technical solutions from the spirit and scope of the technical solutions of the various embodiments of the present invention.

Claims

1. A method for establishing a direct connection through a link, characterized in that: The method comprises: Get the public IP of the other end; Generate a first scanning message based on the public IP address of the peer and a random port available on the public network, and send the first scanning message; When the second scanning message sent by the opposite end after being mapped by the opposite end NAT gateway and the first scanning message after being mapped by the local end NAT gateway are mirror messages of each other, and the two parties collide on the local end NAT gateway, receiving the second scanning message; Establish a direct connection through link with the opposite end according to the second scanning message.

2. The method for establishing a direct connection through a link according to claim 1, wherein: The generating a first scanning message based on the public network IP address of the opposite end and a random port available on the public network, and sending the first scanning message, includes: Install the target protocol; Configuring a port scanning strategy for a target protocol based on the random port available on the public network and the public IP address of the peer end, and generating the first scanning message according to the port scanning strategy; The first scanning message is sent using the target protocol.

3. The method for establishing a direct connection through a link according to claim 2, wherein: Configuring a port scanning strategy for a target protocol based on the random port available on the public network and the public IP address of the peer end includes: Configuring the random ports available on the public network as a randomly selected range of destination ports of the first scanning message in the port scanning strategy; Setting a plurality of local random ports according to the target protocol, and configuring the plurality of local random ports as a randomly selected range of source ports of the first scanning message in the port scanning strategy; The public network IP of the opposite end is configured as the destination IP of the first scanning message in the port scanning strategy, and the local IP is configured as the source IP of the first scanning message in the port scanning strategy.

4. The method for establishing a direct connection through a link according to claim 2, wherein: The port scanning strategy also includes at least one of the following: The sending period of the first scanning message, the number of the first scanning messages sent by each source port in a single time, the sending interval of the first scanning message, and the maximum number of times the first scanning message is sent.

5. The method for establishing a direct connection through a link according to claim 1, wherein: Establishing a direct traversal link with the peer end according to the second scanning message includes: Acquire information of the peer end according to the second scanning message; The information of the opposite end is used to perform handshake negotiation with the opposite end to establish a direct connection through link.

6. The method for establishing a direct connection through a link according to claim 2, wherein: Generating the first scanning message according to the port scanning strategy includes: Generate a local encryption public key using the target protocol; The first scanning message is generated according to the port scanning strategy and the local encryption public key.

7. The method for establishing a direct connection through a link according to claim 6, wherein: The establishing a direct connection through link with the opposite end according to the second scanning message includes: Acquire information of the peer end and a peer end encryption public key according to the second scanning message; Perform handshake negotiation with the peer end according to the information of the peer end, the peer end encryption public key and the local end encryption public key to establish a direct connection through link.

8. A device for establishing a direct connection through a link, characterized in that: include: Acquisition module, used to obtain the public IP of the other end; A scanning module, configured to generate a first scanning message based on the public IP address of the peer and a random port available on the public network, and send the first scanning message; A receiving module, configured to receive the second scanning message when the second scanning message sent by the opposite end after being mapped by the opposite end NAT gateway and the first scanning message mapped by the local end NAT gateway are mirror messages of each other and the two parties collide on the local end NAT gateway; An establishing module is used to establish a direct connection through link with the opposite end according to the second scanning message.

9. An electronic device comprising a memory, a processor, and a computer program stored in the memory and executable on the processor, wherein: When the processor executes the program, the method for establishing a direct connection through link according to any one of claims 1 to 7 is implemented.

10. A non-transitory computer-readable storage medium having a computer program stored thereon, characterized in that: When the computer program is executed by a processor, the method for establishing a direct connection through link according to any one of claims 1 to 7 is implemented.

11. A computer program product comprising a computer program, characterized in that When the computer program is executed by a processor, the method for establishing a direct connection through link according to any one of claims 1 to 7 is implemented.

Images