Message forwarding method, electronic equipment and storage medium

Abstract

The invention provides a message forwarding method, electronic equipment and a storage medium. The method is applied to routing equipment, and comprises the following steps: receiving a request message initiated by a client to a target host; forwarding the request message to the firewall equipment according to a preset binding relationship and a destination address in the request message, so that the firewall equipment forwards the message to the target host according to a destination address conversion strategy; receiving a response message sent by the firewall equipment; and forwarding the response message to the client according to a preset binding relationship and the destination address in the response message. According to the method, the characteristic that the service hosts in the cloud platform support host routing is utilized, firewall services are deployed in the VPC instances, protection of all the service hosts in the VPC instances is achieved, the firewall capacity can be conveniently, rapidly and simply connected to the cloud platform through the implementation mode, the protection capacity is formed, the firewall delivery difficulty in the cloud scene is effectively reduced, and the service performance of the cloud platform is improved. And the firewall delivery period is shortened.

Description

Technical Field

[0001] The present application relates to the field of communication technology, and in particular to a message forwarding method, electronic device and storage medium. Background Art

[0002] Cloud computing has become the mainstream, and various types of cloud platforms are emerging. How to provide security protection for business hosts in cloud platforms is a key issue in this field. In traditional security protection solutions, it is necessary to open a firewall business traffic channel in the cloud, develop customized firewall services based on the cloud platform docking firewalls. This security protection solution has certain drawbacks, that is, every time there is a new customer delivery, or every time a new manufacturer or new version of the cloud platform is encountered, the firewall needs to be customized and developed again, resulting in high delivery costs and long delivery cycles. Summary of the invention

[0003] In order to overcome the problems existing in the related art, the present application provides a message forwarding method, an electronic device and a storage medium.

[0004] According to a first aspect of an embodiment of the present application, a message forwarding method is provided, the method being applied to a routing device deployed in a target VPC instance, the method comprising:

[0005] Receive a request message initiated by a client to a target host deployed in the target VPC instance;

[0006] According to the preset binding relationship and the destination address in the request message, the request message is forwarded to the firewall device deployed in the target VPC instance, so that the firewall device performs a destination address conversion operation on the request message after confirming that the request message complies with the access control policy, and forwards the converted first message to the target host, wherein the preset binding relationship is a binding relationship between the address of the target host providing services to the outside and the address of the firewall device, and the destination address conversion operation is: converting the destination address of the request message from the address of the firewall device to the address of the target host;

[0007] receiving a response message sent by the firewall device, wherein the response message is obtained by the firewall device performing a source address translation operation on the second message after confirming that the second message complies with the access control policy, the second message is generated by the target host according to the first message, and is forwarded to the firewall device by the target host according to the host route, the host route includes a next hop address leading to any network segment as the address of the firewall device, and the source address translation operation is: converting the source address of the second message from the address of the target host to the address of the firewall device;

[0008] According to the preset binding relationship and the destination address in the response message, the response message is forwarded to the client.

[0009] According to a second aspect of an embodiment of the present application, a message forwarding device is provided, the device being applied to a routing device deployed in a target VPC instance, the device comprising:

[0010] A first routing receiving module is used to receive a request message initiated by a client to a target host deployed in the target VPC instance;

[0011] A first routing forwarding module, configured to forward the request message to a firewall device deployed in the target VPC instance according to a preset binding relationship and a destination address in the request message, so that the firewall device performs a destination address conversion operation on the request message after confirming that the request message complies with an access control policy, and forwards the converted first message to the target host, wherein the preset binding relationship is a binding relationship between an address of a service provided by the target host to the outside and an address of the firewall device, and the destination address conversion operation is: converting the destination address of the request message from the address of the firewall device to the address of the target host;

[0012] a second routing receiving module, configured to receive a response message sent by the firewall device, wherein the response message is obtained by the firewall device performing a source address translation operation on the second message after confirming that the second message complies with the access control policy, the second message is generated by the target host according to the first message, and is forwarded to the firewall device by the target host according to the host route, the host route includes a next hop address leading to any network segment as the address of the firewall device, and the source address translation operation is: converting the source address of the second message from the address of the target host to the address of the firewall device;

[0013] The second routing forwarding module is used to forward the response message to the client according to the preset binding relationship and the destination address in the response message.

[0014] According to a third aspect of an embodiment of the present application, a message forwarding method is provided, the method being applied to a firewall device deployed in a target VPC instance, the method comprising:

[0015] receiving a request message sent by a routing device deployed on the target VPC instance, wherein the request message is initiated by a client to a target host deployed on the target VPC instance, is received by the routing device from the client, and is forwarded by the routing device to the firewall device according to a preset binding relationship and a destination address in the request message, wherein the preset binding relationship is a binding relationship between an address of the target host providing services externally and an address of the firewall device;

[0016] Determine whether the request message complies with the access control policy, and if the judgment result is yes, perform a destination address conversion operation on the request message, and send the converted first message to the target host, wherein the destination address conversion operation is: converting the destination address of the request message from the address of the firewall device to the address of the target host;

[0017] receiving a second message sent by the target host, wherein the second message is generated by the target host according to the first message, and forwarded by the target host to the firewall device according to a host route, wherein the host route includes a next hop address to any network segment that is an address of the firewall device;

[0018] Determine whether the second message complies with the access control policy. If the judgment result is yes, perform a source address translation operation on the second message, and send the converted response message to the routing device, so that the routing device sends the response message to the client, wherein the source address translation operation is: converting the source address of the second message from the address of the target host to the address of the firewall device.

[0019] According to a fourth aspect of an embodiment of the present application, a message forwarding device is provided, the device being applied to a firewall device deployed in a target VPC instance, the device comprising:

[0020] A first firewall receiving module is configured to receive a request message sent by a routing device deployed on the target VPC instance, wherein the request message is initiated by a client to a target host deployed on the target VPC instance, is received by the routing device from the client, and is forwarded by the routing device to the firewall device according to a preset binding relationship and a destination address in the request message, wherein the preset binding relationship is a binding relationship between an address of the target host providing services externally and an address of the firewall device;

[0021] A first firewall forwarding module is used to determine whether the request message complies with the access control policy. If the determination result is yes, a destination address conversion operation is performed on the request message, and a first message obtained by conversion is sent to the target host, wherein the destination address conversion operation is: converting the destination address of the request message from the address of the firewall device to the address of the target host;

[0022] a second firewall receiving module, configured to receive a second message sent by the target host, wherein the second message is generated by the target host according to the first message, and forwarded by the target host to the firewall device according to a host route, wherein the host route includes a next hop address leading to any network segment as the address of the firewall device;

[0023] The second firewall forwarding module is used to determine whether the second message complies with the access control policy. If the judgment result is yes, a source address conversion operation is performed on the second message, and a response message obtained by the conversion is sent to the routing device, so that the routing device sends the response message to the client, wherein the source address conversion operation is: converting the source address of the second message from the address of the target host to the address of the firewall device.

[0024] According to a fifth aspect of an embodiment of the present application, a message forwarding method is provided, the method being applied to a target host deployed in a target VPC instance, the method comprising:

[0025] Receive a first message sent by a firewall device deployed on the target VPC instance, wherein the first message is obtained by the firewall device performing a destination address conversion operation on the request message after confirming that the request message complies with the access control policy, the request message is initiated by a client to a target host deployed on the target VPC instance, received by a routing device from the client, and forwarded by the routing device to the firewall device according to a preset binding relationship and a destination address in the request message, the preset binding relationship being a binding relationship between an address of a service provided externally by the target host and an address of the firewall device, and the destination address conversion operation is: converting the destination address of the request message from the address of the firewall device to the address of the target host;

[0026] A second message is generated according to the first message, and the second message is sent to the firewall device according to the host route, so that the firewall device performs a source address translation operation on the second message after confirming that the second message complies with the access control policy, and sends the converted response message to the routing device, wherein the host route includes a next hop address leading to any network segment as the address of the firewall device, and the source address translation operation is: converting the source address of the second message from the address of the target host to the address of the firewall device.

[0027] According to a sixth aspect of an embodiment of the present application, a message forwarding device is provided, the device being applied to a target host deployed in a target VPC instance, the device comprising:

[0028] A host receiving module, configured to receive a first message sent by a firewall device deployed on the target VPC instance, wherein the first message is obtained by the firewall device performing a destination address conversion operation on the request message after confirming that the request message complies with the access control policy, the request message is initiated by a client to a target host deployed on the target VPC instance, received by a routing device from the client, and forwarded by the routing device to the firewall device according to a preset binding relationship and a destination address in the request message, the preset binding relationship being a binding relationship between an address of a service provided externally by the target host and an address of the firewall device, and the destination address conversion operation being: converting the destination address of the request message from the address of the firewall device to the address of the target host;

[0029] A host sending module is used to generate a second message according to the first message, and send the second message to the firewall device according to the host route, so that the firewall device performs a source address conversion operation on the second message after confirming that the second message complies with the access control policy, and sends the converted response message to the routing device, wherein the host route includes a next hop address leading to any network segment as the address of the firewall device, and the source address conversion operation is: converting the source address of the second message from the address of the target host to the address of the firewall device.

[0030] According to the seventh aspect of an embodiment of the present application, an electronic device is provided, comprising a processor and a machine-readable storage medium, wherein the machine-readable storage medium stores machine-executable instructions that can be executed by the processor, and the processor is prompted by the machine-executable instructions to implement the steps of the message forwarding method described above.

[0031] According to an eighth aspect of an embodiment of the present application, a computer-readable storage medium is provided, wherein a computer program is stored in the computer-readable storage medium, and when the computer program is executed by a processor, the steps of the message forwarding method described above are implemented.

[0032] The technical solution provided by the embodiments of the present application may have the following beneficial effects:

[0033] In the embodiment of the present application, by utilizing the feature that the business host in the cloud platform supports host routing, a firewall service is deployed in the VPC instance to implement protection for each business host in the VPC instance. This implementation method facilitates quick and easy connection of firewall capabilities to the cloud platform that supports cloud routing tables and forms protection capabilities, thereby effectively reducing the difficulty of firewall delivery in cloud scenarios and shortening the firewall delivery cycle.

[0034] It should be understood that the foregoing general description and the following detailed description are exemplary and explanatory only and are not restrictive of the present application. BRIEF DESCRIPTION OF THE DRAWINGS

[0035] The accompanying drawings, which are incorporated in the specification and constitute a part of this application, illustrate embodiments consistent with the application and, together with the description, serve to explain the principles of the application.

[0036] Figure 1 A schematic diagram of the cloud platform structure provided for this application;

[0037] Figure 2 A schematic diagram of a process of the message forwarding method provided in this application;

[0038] Figure 3 A flowchart of a message forwarding method provided in Example 1 of the present application;

[0039] Figure 4 Another process diagram of the message forwarding method provided by this application;

[0040] Figure 5 A flowchart of a message forwarding method provided in Embodiment 2 of the present application;

[0041] Figure 6 A flowchart of a message forwarding method provided in Embodiment 3 of the present application;

[0042] Figure 7 Schematic diagram of the message forwarding process for a specific application scenario provided by this application;

[0043] Figure 8 Schematic diagram of message forwarding process for specific application scenarios provided by this application;

[0044] Fig. 9 A schematic diagram of the structure of the electronic device provided in this application. DETAILED DESCRIPTION

[0045] Exemplary embodiments will be described in detail herein, examples of which are shown in the accompanying drawings. When the following description refers to the drawings, the same numbers in different drawings represent the same or similar elements unless otherwise indicated. The implementations described in the following exemplary embodiments do not represent all implementations consistent with the present application. Instead, they are merely examples of devices and methods consistent with some aspects of the present application as detailed in the appended claims.

[0046] The terms used in this application are for the purpose of describing specific embodiments only and are not intended to limit this application. The singular forms of "a", "said" and "the" used in this application and the appended claims are also intended to include plural forms unless the context clearly indicates other meanings. It should also be understood that the term "and / or" used herein refers to and includes any or all possible combinations of one or more associated listed items.

[0047] It should be understood that, although the terms first, second, third, etc. may be used in the present application to describe various information, these information should not be limited to these terms. These terms are only used to distinguish the same type of information from each other. For example, without departing from the scope of the present application, the first information may also be referred to as the second information, and similarly, the second information may also be referred to as the first information. Depending on the context, the words "if" or "if" as used herein may be interpreted as "at the time of" or "when...".

[0048] In this application, the cloud platform includes one or more VPC (Virtual Private Cloud) instances, and the network traffic of the business host in each VPC instance can be controlled according to the host routing on the business host. The VPC instance is deployed with any number of business hosts, and the client can access the business host in the VPC instance on the cloud platform through the public network. For the convenience of description, this application refers to the VPC instance that the client requests to access as the target VPC instance, and the business host that the client requests to access as the target host.

[0049] like Figure 1 As shown, the target VPC instance is deployed with a routing device, and the network traffic from the client reaches the target VPC instance through the routing device. The target VPC instance is deployed with a target host that the client requests to access, and a firewall device.

[0050] Next, the message forwarding method provided in the embodiment of the present application is introduced and explained.

[0051] Embodiment 1

[0052] Figure 2 A schematic diagram of the process of the message forwarding method provided in this application, Figure 3A flow chart of a message forwarding method provided in Embodiment 1 of the present application, wherein the method is applied to a routing device deployed in a target VPC instance, such as Figure 3 As shown, the method comprises the following steps:

[0053] Step 310: Receive a request message initiated by the client to a target host deployed in a target VPC instance;

[0054] Step 320: forward the request message to a firewall device deployed in the target VPC instance according to the preset binding relationship and the destination address in the request message, so that the firewall device performs a destination address translation operation on the request message after confirming that the request message complies with the access control policy, and forwards the first message obtained by the translation to the target host;

[0055] The preset binding relationship is the binding relationship between the address of the target host providing services externally and the address of the firewall device, and the destination address conversion operation is: converting the destination address of the request message from the address of the firewall device to the address of the target host.

[0056] Step 330: receiving a response message sent by the firewall device;

[0057] Among them, the response message is obtained by the firewall device performing a source address translation operation on the second message after confirming that the second message complies with the access control policy. The second message is generated by the target host according to the first message, and forwarded to the firewall device by the target host according to the host route. The host route includes the next hop address leading to any network segment as the address of the firewall device. The source address translation operation is: converting the source address of the second message from the address of the target host to the address of the firewall device.

[0058] Step 340: forward the response message to the client according to the preset binding relationship and the destination address in the response message.

[0059] This application does not limit the deployment location relationship between the target host and the firewall device. Specifically, the target host and the firewall device can be deployed in the same subnet of the target VPC instance, or in different subnets of the target VPC instance. In actual applications, you can even set up a subnet specifically for deploying firewall devices.

[0060] In the case where the target host and firewall device are deployed in different subnets of the target VPC instance, assuming that Figure 4 As shown, the target host is deployed in the first subnet of the target VPC instance, and the firewall device is deployed in the second subnet of the target VPC instance. Then, the above host route not only includes the next hop address to any network segment as the address of the firewall device, but also includes the next hop address to the network segment where the firewall device is located as the gateway address of the target host.

[0061] In actual applications, one or more firewall devices are often set up as backups to ensure high availability. Therefore, as a preferred implementation, in the target VPC instance of this embodiment, both the primary firewall device and the backup firewall device are deployed. In this case, it is necessary to create a target VIP (Virtual IP) instance in the subnet where the primary firewall device and the backup firewall device are located, and bind the target VIP instance to the address of the primary firewall device and the address of the backup firewall device.

[0062] When the target VPC instance is deployed with both a primary firewall device and a backup firewall device, the above preset binding relationship is correspondingly adjusted to: the binding relationship between the address of the target host providing services externally and the address of the target VIP instance.

[0063] When both the active firewall device and the standby firewall device are deployed in the target VPC instance, this embodiment specifically forwards the request message in the following manner:

[0064] According to the preset binding relationship and the destination address in the request message, the request message is forwarded to the primary firewall device or the backup firewall device deployed on the target VPC instance, so that the firewall device that receives the request message performs a destination address conversion operation on the request message after confirming that the request message complies with the access control policy, and forwards the converted first message to the target host. The destination address conversion operation is: converting the destination address of the request message from the address of the target VIP instance to the address of the target host.

[0065] Correspondingly, when the target VPC instance is deployed with both a primary firewall device and a backup firewall device, this embodiment specifically receives the response message in the following manner:

[0066] Receive a response message sent by the active firewall device or the backup firewall device, wherein the response message is obtained by the active firewall device or the backup firewall device performing a source address conversion operation on the second message after confirming that the second message complies with the access control policy. The second message is generated by the target host according to the first message, and is forwarded by the target host to the active firewall device or the backup firewall device according to the host route. The host route includes a next-hop address to any network segment, which is the address of the target VIP instance. The source address conversion operation is: converting the source address of the second message from the address of the target host to the address of the target VIP instance.

[0067] It is worth mentioning that in this embodiment, the firewall device deployed in the target VPC instance can perform access control for a specific business host in the target VPC instance, or can perform access control for any business host in the target VPC instance. Therefore, the target host can be any host deployed in the target VPC instance.

[0068] As a specific implementation method, the address of the target host providing services externally may be an elastic public IP (Elastic IP, EIP) address.

[0069] Embodiment 2

[0070] Figure 5 A flow chart of a message forwarding method provided in Embodiment 2 of the present application, which is applied to a firewall device deployed in a target VPC instance, such as Figure 5 As shown, the method comprises the following steps:

[0071] Step 510: Receive a request message sent by a routing device deployed in the target VPC instance;

[0072] Among them, the request message is initiated by the client to the target host deployed in the target VPC instance, received by the routing device from the client, and forwarded to the firewall device by the routing device according to the preset binding relationship and the destination address in the request message. The preset binding relationship is the binding relationship between the address of the target host providing services to the outside world and the address of the firewall device.

[0073] Step 520: determine whether the request message complies with the access control policy. If the determination result is yes, perform a destination address translation operation on the request message, and send the first message obtained by the translation to the target host.

[0074] The destination address conversion operation is: converting the destination address of the request message from the address of the firewall device to the address of the target host.

[0075] Step 530: receiving a second message sent by the target host;

[0076] The second message is generated by the target host according to the first message, and is forwarded by the target host to the firewall device according to the host route, and the host route includes a next hop address leading to any network segment, which is the address of the firewall device.

[0077] Step 540: determine whether the second message complies with the access control policy. If the determination result is yes, perform a source address translation operation on the second message, and send the converted response message to the routing device, so that the routing device sends the response message to the client.

[0078] The source address conversion operation is: converting the source address of the second message from the address of the target host to the address of the firewall device.

[0079] Embodiment 3

[0080] Figure 6A flow chart of a message forwarding method provided in Embodiment 3 of the present application, which is applied to a target host deployed in a target VPC instance, such as Figure 6 As shown, the method comprises the following steps:

[0081] Step 610: Receive a first message sent by a firewall device deployed in the target VPC instance;

[0082] Among them, the first message is obtained by the firewall device performing a destination address conversion operation on the request message after confirming that the request message complies with the access control policy. The request message is initiated by the client to the target host deployed in the target VPC instance, received by the routing device from the client, and forwarded to the firewall device by the routing device according to the preset binding relationship and the destination address in the request message. The preset binding relationship is the binding relationship between the address of the target host providing services to the outside and the address of the firewall device. The destination address conversion operation is: converting the destination address of the request message from the address of the firewall device to the address of the target host.

[0083] Step 620: Generate a second message based on the first message, and send the second message to the firewall device according to the host route, so that the firewall device performs a source address translation operation on the second message after confirming that the second message complies with the access control policy, and sends the converted response message to the routing device.

[0084] The host route includes a next hop address leading to any network segment, which is the address of the firewall device. The source address conversion operation is: converting the source address of the second message from the address of the target host to the address of the firewall device.

[0085] In combination with the above-mentioned Embodiment 1, Embodiment 2 and Embodiment 3, the message forwarding method of the present application is further explained by taking a specific application scenario as an example.

[0086] In actual applications, the network configuration is as follows Figure 7 As shown:

[0087] Create a target VPC instance in the cloud platform, create two subnets in the target VPC instance, record them as the first subnet and the second subnet, and create a switching device in each subnet.

[0088] Create a virtual machine in the first subnet, deploy the target service in the virtual machine, obtain the target host, and assign an IP address to the target host, such as Figure 7 192.168.1.2 is shown in the figure. Create an elastic public IP address as the public address for the target host to provide external services, name it EIP address, and bind the EIP address to the IP address of the target host.

[0089] Create two virtual machines in the second subnet and deploy firewall services in each virtual machine to obtain two firewall devices. Assign IP addresses to each firewall device from the second subnet and configure the gateway. In the second subnet, create a highly available VIP instance and name it the target VIP instance. The target VIP instance contains an IP address 192.168.3.101 assigned from the second subnet. The target VIP instance is bound to the IP addresses of the two firewall devices. Send the master-slave configuration to the two firewall devices, set the virtual address in the master-slave configuration to the IP address of the target VIP instance, use one firewall device as the master firewall device, and use the other firewall device as the backup firewall device, and start configuration synchronization.

[0090] Unbind the EIP address from the target host's IP address, and bind the EIP address to the target VIP instance's IP address.

[0091] Delete the default gateway of the target host. Create a host route in the target host. The host route includes the first custom route and the second custom route. The first custom route is: the target network segment is the second subnet, and the next hop address is the gateway of the first subnet (if the target host and the firewall device are in the same subnet, there is no need to create the first custom route); the second custom route is: the target network segment is 0.0.0.0 / 0, that is, any network segment, and the next hop address is the IP address of the target VIP instance.

[0092] Configure the source address translation policy and the destination address translation policy on the active firewall device. The source address translation policy is to perform a source address translation operation, which is to convert the source address of the second message from the IP address of the target host to the IP address of the target VIP instance; the destination address translation policy is to perform a destination address translation operation, which is to convert the destination address of the request message from the IP address of the target VIP instance to the IP address of the target host. Synchronize the source address translation policy and the destination address translation policy of the active firewall device to the standby firewall device.

[0093] In actual applications, after the above network configuration, the message forwarding process is as follows: Figure 8 As shown:

[0094] The client sends a request message. The source address of the request message is the client's IP address, and the destination address is the EIP address.

[0095] After the request message reaches the routing device of the target VPC instance, the routing device modifies the destination address of the request message to the IP address of the target VIP instance based on the preset binding relationship, that is, the binding relationship between the EIP address and the IP address of the target VIP instance, and forwards the modified request message to the firewall device based on the IP address of the target VIP instance.

[0096] After the request message arrives at the firewall device, the firewall device first determines whether the request message complies with the access control policy. If it is confirmed that the request message complies with the access control policy, the firewall device performs a destination address translation operation, converts the destination address of the request message from the IP address of the target VIP instance to the IP address of the target host, obtains the first message, and forwards the first message to the target host.

[0097] The first message arrives at the target host, and the target host generates a second message based on the first message, and then forwards the second message to the firewall device according to the host route. It can be understood that the second message generated by the target host is sent to the client, so the destination address of the second message is the IP address of the client. Therefore, when the second message matches the route, the second custom route mentioned above is matched first, that is, the next hop address is the IP address of the target VIP instance, but because the target host and the target VIP instance are not in the same subnet, the second message will match the route again and match the first custom route mentioned above, that is, the next hop address is the gateway of the first subnet, so the second message can be forwarded to the firewall device via the routing device.

[0098] After the second message arrives at the firewall device, the firewall device first determines whether the second message complies with the access control policy. If it is confirmed that the second message complies with the access control policy, the firewall device performs a source address translation operation to convert the source address from the IP address of the target host to the IP address of the target VIP instance, obtains a response message, and sends the response message to the routing device.

[0099] The response message arrives at the routing device. The routing device modifies the source address of the response message to the EIP address based on the preset binding relationship, that is, the binding relationship between the target public network EIP address and the IP address of the target VIP instance, and finally sends the modified response message to the client.

[0100] It can be seen from the above technical solutions that the present application provides a message forwarding method that can utilize the basic resources of the cloud platform to realize the firewall function. There is no need to open a dedicated firewall business traffic channel in the cloud platform, nor is there any need for customized development based on the cloud platform to connect to the firewall.

[0101] Specifically, the present application utilizes the characteristic that the business hosts in the cloud platform support host routing, deploys firewall services in the VPC instance, and implements protection for each business host in the VPC instance. On the one hand, this implementation method facilitates the quick and easy connection of firewall capabilities to the cloud platform that supports cloud routing tables, and forms protection capabilities, effectively reducing the difficulty of firewall delivery in cloud scenarios and shortening the firewall delivery cycle; on the other hand, since this implementation method deploys firewall services for each VPC instance of the cloud platform separately, rather than deploying one firewall service for the entire cloud platform, it is more flexible and can respond quickly and implement firewall capabilities in a timely manner at each customer delivery.

[0102] Based on the same inventive concept, the present application also provides a corresponding message forwarding device. The message forwarding device provided by the present application is introduced below.

[0103] Corresponding to the first embodiment described above, the present application provides a message forwarding device, which is applied to a routing device deployed in a target VPC instance, and includes:

[0104] A first routing receiving module is used to receive a request message initiated by a client to a target host deployed in a target VPC instance;

[0105] A first routing forwarding module is used to forward the request message to a firewall device deployed in a target VPC instance according to a preset binding relationship and a destination address in the request message, so that the firewall device performs a destination address conversion operation on the request message after confirming that the request message complies with the access control policy, and forwards the converted first message to a target host, wherein the preset binding relationship is a binding relationship between an address of a service provided by the target host to the outside and an address of the firewall device, and the destination address conversion operation is: converting the destination address of the request message from the address of the firewall device to the address of the target host;

[0106] A second routing receiving module is used to receive a response message sent by the firewall device, wherein the response message is obtained by the firewall device performing a source address translation operation on the second message after confirming that the second message complies with the access control policy, the second message is generated by the target host according to the first message, and is forwarded to the firewall device by the target host according to the host route, the host route includes a next hop address leading to any network segment as the address of the firewall device, and the source address translation operation is: converting the source address of the second message from the address of the target host to the address of the firewall device;

[0107] The second routing forwarding module is used to forward the response message to the client according to the preset binding relationship and the destination address in the response message.

[0108] Corresponding to the second embodiment described above, the present application provides a message forwarding device, which is applied to a firewall device deployed in a target VPC instance, and includes:

[0109] A first firewall receiving module is used to receive a request message sent by a routing device deployed in a target VPC instance, wherein the request message is initiated by a client to a target host deployed in the target VPC instance, is received by the routing device from the client, and is forwarded by the routing device to the firewall device according to a preset binding relationship and a destination address in the request message, wherein the preset binding relationship is a binding relationship between an address of a target host providing services externally and an address of the firewall device;

[0110] The first firewall forwarding module is used to determine whether the request message complies with the access control policy. If the determination result is yes, a destination address conversion operation is performed on the request message, and the converted first message is sent to the target host, wherein the destination address conversion operation is: converting the destination address of the request message from the address of the firewall device to the address of the target host;

[0111] A second firewall receiving module, used for receiving a second message sent by a target host, wherein the second message is generated by the target host according to the first message, and forwarded by the target host to the firewall device according to a host route, wherein the host route includes a next hop address leading to any network segment as an address of the firewall device;

[0112] The second firewall forwarding module is used to determine whether the second message complies with the access control policy. If the judgment result is yes, a source address translation operation is performed on the second message, and a response message obtained by the translation is sent to the routing device, so that the routing device sends the response message to the client, wherein the source address translation operation is: converting the source address of the second message from the address of the target host to the address of the firewall device.

[0113] Corresponding to the third embodiment described above, the present application provides a message forwarding device, which is applied to a target host deployed in a target VPC instance, and includes:

[0114] A host receiving module, configured to receive a first message sent by a firewall device deployed on a target VPC instance, wherein the first message is obtained by performing a destination address conversion operation on the request message by the firewall device after confirming that the request message complies with an access control policy, the request message is initiated by a client to a target host deployed on the target VPC instance, received by a routing device from the client, and forwarded by the routing device to the firewall device according to a preset binding relationship and a destination address in the request message, the preset binding relationship being a binding relationship between an address of a service provided externally by the target host and an address of the firewall device, and the destination address conversion operation being: converting the destination address of the request message from the address of the firewall device to the address of the target host;

[0115] A host sending module is used to generate a second message according to the first message, and send the second message to the firewall device according to the host route, so that the firewall device performs a source address conversion operation on the second message after confirming that the second message complies with the access control policy, and sends the converted response message to the routing device, wherein the host route includes a next hop address leading to any network segment as the address of the firewall device, and the source address conversion operation is: converting the source address of the second message from the address of the target host to the address of the firewall device.

[0116] The present application also provides an electronic device, such as Fig. 9 As shown, it includes a processor 910 and a machine-readable storage medium 920, and the machine-readable storage medium 920 stores machine-executable instructions that can be executed by the processor 910. The processor 910 is prompted by the machine-executable instructions to implement the steps of any of the above-mentioned message forwarding methods.

[0117] The machine-readable storage medium may include a random access memory (RAM) or a non-volatile memory (NVM), such as at least one disk storage. Optionally, the machine-readable storage medium may also be at least one storage device located away from the processor.

[0118] The above-mentioned processor can be a general-purpose processor, including a central processing unit (CPU), a network processor (NP), etc.; it can also be a digital signal processor (DSP), an application specific integrated circuit (ASIC), a field programmable gate array (FPGA) or other programmable logic devices, discrete gate or transistor logic devices, discrete hardware components.

[0119] In another embodiment provided in the present application, a computer-readable storage medium is provided, in which a computer program is stored. When the computer program is executed by a processor, the steps of any of the above-mentioned message forwarding methods are implemented.

[0120] The above description is only a preferred embodiment of the present application and is not intended to limit the present application. Any modifications, equivalent substitutions, improvements, etc. made within the spirit and principles of the present application shall be included in the scope of protection of the present application.

Claims

1. A message forwarding method, characterized in that: The method is applied to a routing device deployed in a target VPC instance, and the method includes: Receive a request message initiated by a client to a target host deployed in the target VPC instance; According to the preset binding relationship and the destination address in the request message, the request message is forwarded to the firewall device deployed in the target VPC instance, so that the firewall device performs a destination address conversion operation on the request message after confirming that the request message complies with the access control policy, and forwards the converted first message to the target host, wherein the preset binding relationship is a binding relationship between the address of the target host providing services to the outside and the address of the firewall device, and the destination address conversion operation is: converting the destination address of the request message from the address of the firewall device to the address of the target host; receiving a response message sent by the firewall device, wherein the response message is obtained by the firewall device performing a source address translation operation on the second message after confirming that the second message complies with the access control policy, the second message is generated by the target host according to the first message, and is forwarded to the firewall device by the target host according to the host route, the host route includes a next hop address leading to any network segment as the address of the firewall device, and the source address translation operation is: converting the source address of the second message from the address of the target host to the address of the firewall device; According to the preset binding relationship and the destination address in the response message, the response message is forwarded to the client.

2. The method according to claim 1, characterized in that The target host is deployed in the first subnet of the target VPC instance, and the firewall device is deployed in the second subnet of the target VPC instance; The host route includes a next hop address leading to any network segment, which is the address of the firewall device, and also includes a next hop address leading to the network segment where the firewall device is located, which is the gateway address of the target host.

3. The method according to claim 1, characterized in that The method specifically forwards the request message in the following manner: According to the preset binding relationship and the destination address in the request message, the request message is forwarded to the primary firewall device or the backup firewall device deployed on the target VPC instance, so that the firewall device that receives the request message performs a destination address conversion operation on the request message after confirming that the request message complies with the access control policy, and forwards the converted first message to the target host, wherein the preset binding relationship is a binding relationship between the address of the target host providing services to the outside and the address of the target VIP instance, the target VIP instance is in the same subnet as the primary firewall device and the backup firewall device, and there is a binding relationship between the target VIP instance and the address of the primary firewall device and the address of the backup firewall device, and the destination address conversion operation is: converting the destination address of the request message from the address of the target VIP instance to the address of the target host; The method specifically receives the response message in the following manner: Receive a response message sent by a primary firewall device or a backup firewall device, wherein the response message is obtained by the primary firewall device or the backup firewall device performing a source address conversion operation on the second message after confirming that the second message complies with the access control policy, the second message is generated by the target host according to the first message, and forwarded by the target host to the primary firewall device or the backup firewall device according to the host route, the host route includes a next hop address to any network segment as the address of the target VIP instance, and the source address conversion operation is: converting the source address of the second message from the address of the target host to the address of the target VIP instance.

4. The method according to claim 1, characterized in that: The target host is any host deployed in the target VPC instance.

5. A message forwarding method, characterized in that: The method is applied to a firewall device deployed in a target VPC instance, and the method includes: receiving a request message sent by a routing device deployed on the target VPC instance, wherein the request message is initiated by a client to a target host deployed on the target VPC instance, is received by the routing device from the client, and is forwarded by the routing device to the firewall device according to a preset binding relationship and a destination address in the request message, wherein the preset binding relationship is a binding relationship between an address of the target host providing services externally and an address of the firewall device; Determine whether the request message complies with the access control policy, and if the judgment result is yes, perform a destination address conversion operation on the request message, and send the converted first message to the target host, wherein the destination address conversion operation is: converting the destination address of the request message from the address of the firewall device to the address of the target host; receiving a second message sent by the target host, wherein the second message is generated by the target host according to the first message, and forwarded by the target host to the firewall device according to a host route, wherein the host route includes a next hop address to any network segment that is an address of the firewall device; Determine whether the second message complies with the access control policy. If the judgment result is yes, perform a source address translation operation on the second message, and send the converted response message to the routing device, so that the routing device sends the response message to the client, wherein the source address translation operation is: converting the source address of the second message from the address of the target host to the address of the firewall device.

6. A message forwarding method, characterized in that: The method is applied to a target host deployed in a target VPC instance, and the method includes: Receive a first message sent by a firewall device deployed on the target VPC instance, wherein the first message is obtained by the firewall device performing a destination address conversion operation on the request message after confirming that the request message complies with the access control policy, the request message is initiated by a client to a target host deployed on the target VPC instance, received by a routing device from the client, and forwarded by the routing device to the firewall device according to a preset binding relationship and a destination address in the request message, the preset binding relationship being a binding relationship between an address of a service provided externally by the target host and an address of the firewall device, and the destination address conversion operation is: converting the destination address of the request message from the address of the firewall device to the address of the target host; A second message is generated according to the first message, and the second message is sent to the firewall device according to the host route, so that the firewall device performs a source address translation operation on the second message after confirming that the second message complies with the access control policy, and sends the converted response message to the routing device, wherein the host route includes a next hop address leading to any network segment as the address of the firewall device, and the source address translation operation is: converting the source address of the second message from the address of the target host to the address of the firewall device.

7. The method according to claim 6, characterized in that The target host is deployed in the first subnet of the target VPC instance, and the firewall device is deployed in the second subnet of the target VPC instance. The method specifically sends the second message to the firewall device in the following manner: The second message is sent to the firewall device via the gateway device of the first subnet according to the host route, wherein the host route includes the next hop address leading to any network segment as the address of the firewall device, and also includes the next hop address leading to the network segment where the firewall device is located as the gateway address of the target host.

8. The method according to claim 6, characterized in that The method specifically receives the first message in the following manner: Receive a first message sent by a primary firewall device or a backup firewall device deployed on the target VPC instance, wherein the first message is obtained by the primary firewall device or the backup firewall device performing a destination address conversion operation on the request message after confirming that the request message complies with the access control policy, the request message is initiated by a client to a target host deployed on the target VPC instance, received by a routing device from the client, and forwarded by the routing device to the primary firewall device or the backup firewall device according to a preset binding relationship and the destination address in the request message, the preset binding relationship is a binding relationship between an address of a service provided by the target host to the outside and an address of a target VIP instance, the target VIP instance is in the same subnet as the primary firewall device and the backup firewall device, and there is a binding relationship between the target VIP instance and the address of the primary firewall device and the address of the backup firewall device, and the destination address conversion operation is: converting the destination address of the request message from the address of the target VIP instance to the address of the target host; The method specifically sends the second message in the following manner: A second message is generated based on the first message, and the second message is sent to the active firewall device or the backup firewall device based on the host route, so that the active firewall device or the backup firewall device performs a source address conversion operation on the second message after confirming that the second message complies with the access control policy, and sends the converted response message to the routing device, wherein the host route includes the next hop address to any network segment as the address of the target VIP instance, and the source address conversion operation is: converting the source address of the second message from the address of the target host to the address of the target VIP instance.

9. An electronic device, characterized in that: The method comprises a processor and a machine-readable storage medium, wherein the machine-readable storage medium stores machine-executable instructions that can be executed by the processor, and the processor is prompted by the machine-executable instructions to implement the method steps described in any one of claims 1 to 8.

10. A computer-readable storage medium, characterized in that: The computer-readable storage medium stores a computer program, and when the computer program is executed by a processor, the method steps of any one of claims 1 to 8 are implemented.

Images