Method and system for realizing multi-client user traffic management based on WireGuard

Abstract

The present invention discloses a method and system for implementing multi-client user traffic management based on WireGuard. By configuring a unique virtual IP address for each client and establishing a Socket connection, and binding the virtual IP address corresponding to the client to the Socket connection, the function of supporting multi-user proxy under a single WireGuard is realized. Compared with the practice of using multiple WireGuards to serve multiple clients respectively, the occupation of server resources is reduced and the operation and maintenance costs are reduced. In addition, the automated virtual IP address allocation and Socket connection management mechanism of the present invention simplifies the configuration and operation of the system, allowing administrators to more easily manage and maintain VPN services in a multi-user environment. At the same time, a unique virtual IP address is allocated to each client. Even if multiple clients are in different LANs and use the same intranet IP, there will be no IP address conflict, avoiding data transmission errors and security risks caused by IP address conflicts in traditional VPNs.

Description

Technical Field

[0001] The present invention relates to a method and system for processing data in a computer network, and in particular to a method and system for implementing multi-client user traffic management based on WireGuard. Background Art

[0002] In modern computer networks, virtual private network (VPN) technology is widely used to achieve secure remote access and cross-regional network connections. VPN creates a secure private connection on a public network by means of an encrypted tunnel. Common protocols include IPsec, OpenVPN, and the recently popular WireGuard.

[0003] WireGuard is a modern, fast and simple VPN protocol that has attracted much attention for its superior performance and easy configuration. For example, the prior art disclosed in patent CN 117201022B, WireGuard uses efficient encryption algorithms such as ChaCha20 and Poly1305 to achieve fast and secure VPN connections.

[0004] However, VPNs based on the WireGuard protocol still have some limitations: Multi-user intranet IP conflict: Due to the point-to-point connection mode used by WireGuard, a single WireGuard service instance is usually only suitable for a specific client configuration. When multiple clients connect through the same WireGuard service, if these clients are located in different LANs and use the same intranet IP address, it will be difficult for the server to distinguish and manage the traffic of these client users. This situation usually leads to IP address conflicts, which affects the accuracy and security of data transmission.

[0005] Traffic routing complexity: Existing VPN technologies usually rely on fixed routing rules to transmit data. When multiple client users share the same intranet IP, the server may not be able to correctly route traffic to the corresponding client. In addition, traditional routing mechanisms may not be able to effectively handle high-concurrency, multi-user scenarios, resulting in performance degradation.

[0006] Insufficient scalability: Many existing VPN protocols, including WireGuard, have poor scalability when handling a large number of client user connection requirements. Especially in multi-user proxy scenarios, traditional VPN service architectures are difficult to support dynamic multi-user connections and traffic management, which is prone to bottlenecks and reduces the overall efficiency of the system.

[0007] The above problems limit the application of existing VPN technology in complex network environments, especially in scenarios that need to support multiple users, and cannot effectively solve the problems of intranet IP conflicts and traffic management. Therefore, there is an urgent need for a new method or technology that can support efficient and secure traffic proxy in multi-user scenarios without increasing network complexity. Summary of the invention

[0008] The purpose of the present invention is to solve the above-mentioned problems existing in the prior art and to provide a method and system for multi-client user traffic management based on WireGuard.

[0009] The purpose of the present invention is achieved through the following technical solutions: A method for implementing multi-client user traffic management based on WireGuard includes the following steps: S1, the server determines in real time whether it has received a network request initiated by a client through the WireGuard tunnel; if so, the network request is sent to the service system corresponding to the server through the Socket connection bound to the virtual IP address corresponding to the client; S2, after the server responds to the network request, it sends the response data to the client through the Socket connection bound to the virtual IP address corresponding to the client and the WireGuard tunnel.

[0010] Preferably, the client initiates a network request through the WireGuard tunnel, and the process includes generating a key pair and configuring the WireGuard interface files of the server and the client; when the WireGuard tunnel configuration is completed, the server assigns a unique virtual IP address to the client user, and establishes one or more Socket connections with the client, the virtual IP address is bound to the corresponding connection of the Socket interface, and the status information is saved in the mapping table.

[0011] Preferably, one or more Socket connections are established between the server and the client, and the process includes the server first creating a Socket, binding a virtual IP address and port number, the server listens to requests from the virtual IP address through the port number, and the client uses TCP to connect to the Socket port of the server's virtual IP to establish a TCP connection. Based on this TCP connection, the data packets between the server and the client are sent as TCP loads.

[0012] Preferably, while establishing the Socket connection, a routing rule is preset for the Socket connection, wherein the routing rule is to map a unique TCP socket according to the client user identifier, and forwarding is performed based on the Socket.

[0013] Preferably, the virtual IP address allocated to each client user is simultaneously recorded in the IP address allocation table of the server.

[0014] Preferably, in the process of the server monitoring the request of the virtual IP address through the port number, when the connection status of the client changes, such as "reconnect" or "disconnect", the mapping table is dynamically updated; The server uses a periodic heartbeat mechanism to detect the connection status: if the heartbeat times out, the connection is marked as "DISCONNECTED"; When the client reconnects, the server checks whether the virtual IP already exists in the mapping table; if it does, the status is updated to "CONNECTED" and the virtual IP and the new Socket connection are rebound; if the virtual IP does not exist, it means that the IP is invalid and the connection is closed; When the server detects that the client is disconnected, it updates the corresponding virtual IP status to "DISCONNECTED" and releases the associated Socket connection resources.

[0015] Preferably, each Socket connection is monitored in real time to achieve traffic filtering and anomaly detection; the traffic filtering method includes but is not limited to IP address-based filtering, port number-based filtering, and protocol-based filtering; the anomaly detection method includes but is not limited to behavior-based anomaly detection, including sudden traffic surges and frequent connection interruptions.

[0016] The present invention also discloses a system for implementing multi-client user traffic management based on WireGuard, comprising: The WireGuard interface module is used to create and maintain a WireGuard tunnel for communication between the client and the server; A virtual IP management module, communicating with the WireGuard interface module, for assigning a unique virtual IP address to each client; A socket connection management module, communicating with the WireGuard interface module, is used to establish a socket connection for communication between each client and the server, and to bind the socket connection established for each client to the virtual IP address allocated to the client; A routing and security control module, communicating with the Socket connection management module, for configuring and managing routing rules for each virtual IP address; The traffic takeover and forwarding module is used to send the data sent by the client to the business system corresponding to the server according to the Socket connection corresponding to the client and the preset routing rules, and to feed back the response data of the server to the client through the Socket connection corresponding to the client.

[0017] Preferably, the forwarding module obtains the corresponding socket according to the user identifier of the data packet, and then sends the entire message data as a TCP payload to the other end, and the other end forwards it locally after obtaining the complete data packet.

[0018] The beneficial effects of the present invention are mainly reflected in: 1. The present invention solves the IP address conflict problem in a multi-user environment through a virtual IP address allocation and traffic management method, ensuring that the traffic of each client user can be correctly identified and processed.

[0019] 2. The present invention simplifies traffic routing allocation and management by introducing a mechanism of Socket connection and traffic binding, ensuring that the server can correctly process and forward the traffic of each client user, thereby improving the stability and security of the system.

[0020] 3. The present invention improves the scalability of the system in multi-user scenarios through innovative virtual network and Socket connection management mechanisms, enabling the server to efficiently process multi-user requests while maintaining good performance. BRIEF DESCRIPTION OF THE DRAWINGS

[0021] Figure 1 is a schematic diagram of the system of the present invention; Figure 2 It is a process schematic diagram of the method of the present invention; Figure 3 It is a schematic diagram of the process of configuring a virtual IP address and a Socket connection for each client and binding them in the invention of the present invention. DETAILED DESCRIPTION

[0022] The purpose, advantages and features of the present invention will be illustrated and explained by the non-limiting description of the following preferred embodiments. These embodiments are only typical examples of the application of the technical solution of the present invention, and any technical solution formed by equivalent replacement or equivalent transformation falls within the scope of protection claimed by the present invention.

[0023] The present invention aims to solve the problems of multi-user intranet IP conflicts, traffic management complexity and insufficient scalability in the prior art by providing a method for binding virtual IP and Socket traffic based on WireGuard VPN technology, and further enhance the application capability of WireGuard protocol in complex network environments.

[0024] Example 1 The following is a system for implementing multi-client user traffic management based on WireGuard disclosed by the present invention in conjunction with the accompanying drawings, as shown in the attached drawings. Figure 1 As shown, it includes: The WireGuard interface module is used to create and maintain a WireGuard tunnel for communication between the client and the server. The WireGuard interface module is responsible for interacting with the WireGuard protocol to create and maintain a virtual network. It encrypts and transmits traffic from the client through the WireGuard tunnel, and receives and decrypts traffic returned from the server. The process of creating a WireGuard tunnel includes generating a key pair (to verify the client's identity information), configuring the server and client's WireGuard interface files, etc.

[0025] The virtual IP management module communicates with the WireGuard interface module and is used to assign a unique virtual IP address to each client. Whenever a new client connects to the server, the virtual IP management module assigns a virtual IP address to it according to a predefined rule or algorithm and records it in the system's IP allocation table. The virtual IP address network segment can be predefined, for example, using the 172.16.0.0 / 12 network segment. Specifically, each virtual IP address is assigned by the server and then configured by the client, so the server manages a global virtual IP resource pool to ensure that there is one less IP allocated, and different virtual IP addresses will be selected according to the specific environment of the client. For example, if the local LAN environment of the client is the 192.168.1.0 / 24 network segment, then the virtual IP will select, for example, the 10.0.1.0 / 24 network segment to ensure that there is no conflict with the local LAN. The virtual IP address assigned to each client user is also recorded in the IP address allocation table of the server.

[0026] The Socket connection management module communicates with the WireGuard interface module, and is used to establish a Socket connection for communication between each client and the server, and bind the Socket connection established for each client to the virtual IP address assigned to the client to ensure that each client traffic can be managed and processed independently. The Socket interface is established between the server and the client. The process includes the server first creating a Socket, binding a virtual IP address and port number, the server listens to the request of the virtual IP address through the port number, and the client uses TCP to connect to the Socket port of the virtual IP of the server to establish a TCP connection. Based on this TCP connection, the data packets between the server and the client are sent as TCP loads. While establishing the Socket connection, a routing rule is preset for the Socket connection. The routing rule is to map to a unique tcp socket according to the client user identifier and forward based on this Socket. The Socket connection management module is responsible for recording and monitoring the virtual IP address, Socket connection status and client identity information of each client. The specific operation of the Socket connection management module to monitor the Socket connection status is as follows: the client will send a heartbeat to the server at regular intervals, which is used by the server to determine the client's connection status (online / offline). In an abnormal state, the socket resources and virtual IP address corresponding to the client will be destroyed, and the client will be reconnected and allocated again.

[0027] The traffic takeover and forwarding module is used to send the data sent by the client to the corresponding business system of the server according to the Socket connection corresponding to the client, and to feed back the response data of the server to the client through the Socket connection corresponding to the client. The traffic takeover and forwarding module uses predefined rules to send specific user traffic to the corresponding business application or resource on the server, ensuring that each user's traffic can be processed independently and securely.

[0028] Furthermore, a routing and security control module is also provided between the traffic takeover and forwarding module and the Socket connection management module, which is used to configure and manage the routing rules of each virtual IP address to ensure that the data packet can be correctly forwarded from the server to the target client. Specifically, the client virtual IP is assigned by the server, and the so-called routing rule is actually a custom forwarding rule, which is a mapping of a user ID and a socket handle. The user ID, the client virtual IP, and the socket handle are bound during the connection establishment. When the client connects to the server through the virtual IP, the server will have the client's current socket handle, and the user ID can correspond to a unique socket handle. When the data packet is transferred to the user state, we can find the corresponding socket according to the user ID, so that the data packet can be sent out through the socket.

[0029] In the present invention, the traffic takeover and forwarding module first takes over the traffic and is responsible for transferring the data packet to the user state. Next, the routing and security control module performs DPI (deep packet detection) analysis to determine whether the rules are met. If the rules are not met, the data packet is discarded, and the data packet that meets the rules enters the routing module. The routing module finds the corresponding Socket according to the user identifier (if it cannot be found, the data packet will be discarded, and it will not be found when the client is not online), and finally enters the traffic forwarding module, encapsulates the data packet and sends it to the other end through the Socket.

[0030] Preferably, in the system for implementing multi-user proxy based on WireGuard, the routing and security control module integrates traffic filtering and anomaly detection mechanisms to ensure the overall security and stability of the system.

[0031] Traffic filtering and anomaly detection are mainly used to control which data packets can be transmitted through the WireGuard tunnel and intercept illegal or unnecessary traffic according to predefined policies.

[0032] Traffic filtering methods include: filtering based on IP addresses, filtering based on port numbers, and filtering based on protocols. Anomaly detection methods include: behavior-based anomaly detection (such as sudden traffic surges, frequent connection interruptions, etc.). The advantages of this operation are: improved network security, fine control and flexibility, and resource savings (filtering invalid or illegal traffic).

[0033] Example 2 This embodiment discloses a method for implementing multi-client user traffic management based on WireGuard, as shown in the attached Figure 2 As shown, the following steps are included: S1, the server determines in real time whether it has received a network request initiated by a client through the WireGuard tunnel; if so, the network request is sent to the service system corresponding to the server through the Socket connection bound to the virtual IP address corresponding to the client; S2, after the server responds to the network request, it sends the response data to the client through the Socket connection bound to the virtual IP address corresponding to the client and the WireGuard tunnel.

[0034] As attached Figure 3 As shown, the virtual IP address corresponding to each client is allocated a unique virtual IP address to the client by the virtual IP management module when the server determines that it has received a connection request sent by a client through the WireGuard tunnel; the Socket connection management module creates a new Socket connection for the client, binds the allocated virtual IP address to the Socket connection, and saves the status information to the mapping table.

[0035] When the client needs to make a connection request, it first generates a pair of public and private keys on the client, configures the WireGuard interface file, and uses the server's public key to complete the client's WireGuard configuration. The server configures the public key requested by the client into the server's WireGuard interface file, allowing the client to connect through the WireGuard tunnel.

[0036] The client obtains the virtual IP configuration (short connection) from the server through an initialization request. The server uses some identity identifiers (such as sn) carried by the client to find out whether there is a virtual IP mapping. If not, it allocates an unused virtual IP and stores its relationship mapping in the database.

[0037] The client has obtained the virtual IP through the request and configured the WireGuard tunnel. When the client successfully connects through the WireGuard tunnel, the server will create a Socket connection with the client and bind the Socket interface to its virtual IP.

[0038] One or more Socket connections are established between the server and the client. The process includes the server first creating a Socket, binding a virtual IP address and port number, the server listening to the request of the virtual IP address through the port number, the client using TCP to connect to the Socket port of the virtual IP of the server, establishing a TCP connection, and based on this TCP connection, sending the data packets between the server and the client as TCP load. While establishing the Socket connection, a routing rule is preset for the Socket connection, and the routing rule is mapped to a unique TCP socket according to the client user identifier, and forwarding is performed based on this Socket.

[0039] The server monitors the client's connection status in real time. When a client initiates a connection, the server resolves its virtual IP address and the requested Socket port number from the tunnel. During the process of the server monitoring the request of the virtual IP address through the port number, when the client's connection status changes, such as "reconnect" or "disconnect", the mapping table is dynamically updated; The server uses a periodic heartbeat mechanism to detect the connection status: if the heartbeat times out, the connection is marked as "DISCONNECTED"; When the client reconnects, the server checks whether the virtual IP already exists in the mapping table; if it does, the status is updated to "CONNECTED" and the virtual IP and the new Socket connection are rebound; if the virtual IP does not exist, it means that the IP is invalid and the connection is closed; When the server detects that the client is disconnected, it updates the corresponding virtual IP status to "DISCONNECTED" and releases the associated Socket connection resources.

[0040] The network request and response data are sent to the client through the Socket connection bound to the virtual IP address corresponding to the client and the WireGuard tunnel after the traffic filtering and / or anomaly detection mechanism. Each Socket connection is monitored in real time to achieve traffic filtering and anomaly detection; the traffic filtering method includes but is not limited to filtering based on IP addresses, filtering based on port numbers, and filtering based on protocols; the anomaly detection method includes but is not limited to behavior-based anomaly detection, including sudden traffic surges, frequent connection interruptions, etc.

[0041] The present invention implements connection status monitoring on the server and client sides, and detects whether the connection is normal by regularly sending heartbeat packets. When the heartbeat times out or a read / write return error is detected, the connection is determined to be disconnected. After the connection is disconnected, the server will update the connection status of the virtual IP to "DISCONNECTED" and wait for the client to reconnect.

[0042] After detecting that the connection is disconnected, the client re-initiates the connection: re-establish the socket connection based on the virtual IP and the assigned server address. When the server receives a new connection request, it updates the virtual IP connection status and the corresponding socket descriptor. After reconnection, the mapping relationship is automatically updated to "CONNECTED".

[0043] The present invention optimizes Socket connections: using epoll or similar mechanisms to implement non-blocking I / O to avoid blocking the entire application; using connection pools to reuse memory resources in long and short connections to avoid frequent creation and destruction. At the same time, large amounts of data that need to be transmitted through the WireGuard tunnel are compressed to reduce bandwidth usage in the tunnel.

[0044] The present invention realizes the function of supporting multi-user proxy under a single WireGuard by configuring a unique virtual IP address for each client and establishing a Socket connection, and binding the virtual IP address corresponding to the client and the Socket connection. Compared with the practice of using multiple WireGuards to serve multiple clients respectively, it reduces the occupation of server resources, helps to reduce hardware consumption and energy consumption, and reduces operation and maintenance costs. In addition, the automated virtual IP address allocation and Socket connection management mechanism of the present invention simplifies the configuration and operation of the system, allowing administrators to more easily manage and maintain VPN services in a multi-user environment. At the same time, a unique virtual IP address is allocated to each client. Even if multiple clients are in different LANs and use the same intranet IP, there will be no IP address conflict, avoiding data transmission errors and security risks caused by IP address conflicts in traditional VPNs.

[0045] Through the mechanism of binding Socket connection and traffic, the present invention can accurately bind the traffic of each client to a specific Socket connection, avoiding the problem of unclear traffic routing in existing VPN technology. The traffic takeover and forwarding module ensures accurate transmission and efficient routing of traffic, greatly improving the accuracy and efficiency of traffic management, especially in high concurrency and multi-user scenarios.

[0046] At the same time, the virtual IP address assigned to each client is bound to the Socket connection, which greatly enhances the scalability of the system. The server can handle a large number of client connection requests at the same time without worrying about intranet IP conflicts or traffic confusion.

[0047] In addition, the Socket connection management module monitors all connections in real time, ensuring the stability of the system in a multi-user high-load environment and avoiding the risk of server-side performance degradation or crash.

[0048] The routing and security control module integrates traffic filtering and anomaly detection mechanisms, effectively preventing malicious traffic and potential security threats, thereby further improving system security and data transmission reliability.

[0049] There are many implementation methods of the present invention, and all technical solutions formed by equivalent transformation or equivalent transformation fall within the protection scope of the present invention.

Claims

1. A method for implementing multi-client user traffic management based on WireGuard, characterized in that: The steps include: S1, the server determines in real time whether it has received a network request initiated by a client through the WireGuard tunnel; if so, it sends the network request to the business system corresponding to the server through the Socket connection bound to the virtual IP address corresponding to the client; S2, after the server responds to the network request, it sends the response data to the client through the Socket connection bound to the virtual IP address corresponding to the client and the WireGuard tunnel.

2. The method according to claim 1, characterized in that: The client initiates a network request through the WireGuard tunnel, including generating a key pair and configuring the WireGuard interface files on the server and client; When the WireGuard tunnel configuration is completed, the server assigns a unique virtual IP address to the client user and establishes one or more Socket connections with the client. The virtual IP address is bound to the corresponding connection of the Socket interface and the status information is saved in the mapping table.

3. The method according to claim 2, characterized in that: One or more Socket connections are established between the server and the client. The process includes that the server first creates a Socket, binds a virtual IP address and port number, and the server listens to requests from the virtual IP address through the port number. The client uses TCP to connect to the Socket port of the server's virtual IP to establish a TCP connection. Based on this TCP connection, the data packets between the server and the client are sent as TCP loads.

4. The method according to claim 3, characterized in that: When establishing a Socket connection, a routing rule is preset for the Socket connection. The routing rule is to map a unique TCP socket according to the client user identifier and forward based on the Socket.

5. The method according to claim 4, characterized in that: The virtual IP address bound to each client user is allocated and simultaneously recorded in the IP address allocation table of the server.

6. The method according to claim 3, characterized in that: In the process of the server monitoring the request of the virtual IP address through the port number, when the connection status of the client changes, such as "reconnect" or "disconnect", dynamically updating the mapping table; The server uses a periodic heartbeat mechanism to detect the connection status: if the heartbeat times out, the connection is marked as "DISCONNECTED"; When detecting a client reconnection, the server checks whether the virtual IP already exists in the mapping table; If it already exists, update the status to "CONNECTED" and rebind the virtual IP and the new Socket connection; if the virtual IP does not exist, it means that the IP is invalid and close the connection; When the server detects that the client is disconnected, it updates the corresponding virtual IP status to "DISCONNECTED" and releases the associated Socket connection resources.

7. The method according to claim 3, characterized in that: Each Socket connection is monitored in real time to implement traffic filtering and anomaly detection; the traffic filtering method includes but is not limited to IP address-based filtering, port number-based filtering, and protocol-based filtering; the anomaly detection method includes but is not limited to behavior-based anomaly detection, including sudden traffic surges and frequent connection interruptions.

8. A system for implementing multi-client user traffic management based on WireGuard, characterized in that: include: The WireGuard interface module is used to create and maintain a WireGuard tunnel for communication between the client and the server; A virtual IP management module, communicating with the WireGuard interface module, for assigning a unique virtual IP address to each client; A socket connection management module, communicating with the WireGuard interface module, is used to establish a socket connection for communication between each client and the server, and to bind the socket connection established for each client to the virtual IP address allocated to the client; A routing and security control module, communicating with the Socket connection management module, for configuring and managing routing rules for each virtual IP address; The traffic takeover and forwarding module is used to send the data sent by the client to the business system corresponding to the server according to the Socket connection corresponding to the client and the preset routing rules, and to feed back the response data of the server to the client through the Socket connection corresponding to the client.

9. The system according to claim 8, characterized in that: The forwarding module obtains the corresponding socket according to the user identifier of the data packet, and then sends the entire message data as the TCP payload to the other end. After the other end obtains the complete data packet, it will forward it locally.

Images