VPN gateway traffic forwarding method and device, electronic equipment and storage medium

Abstract

The invention relates to the technical field of network security, and discloses a VPN gateway traffic forwarding method and device, electronic equipment and a storage medium, applied to a physical machine of a public cloud system, the method comprises the following steps: receiving a first target data packet sent by a tenant gateway, encrypting the first target data packet to obtain a first encrypted data packet, analyzing the first encrypted data packet, and sending the analyzed first encrypted data packet to a tenant gateway; and thus, a target speed-limiting gateway node is determined, the first encrypted data packet is forwarded to the target speed-limiting gateway node, and the target speed-limiting gateway executes speed-limiting processing and then sends the first encrypted data packet to the client gateway. According to the method, the outbound flow is sent to the speed-limiting gateway, and is forwarded to the client gateway by the speed-limiting gateway, so that the VPN gateway does not need to realize a speed-limiting management function, the speed-limiting gateway performs speed-limiting management on the outbound flow, and the implementation complexity of the VPN gateway is reduced.

Description

Technical Field

[0001] The present invention relates to the field of network security technology, and in particular to a VPN gateway traffic forwarding method, device, electronic device and storage medium. Background Art

[0002] Public cloud computing network is a cloud computing service model deployed on the Internet. Users can access and use the shared resource pool provided by cloud service providers through the Internet. In the current mainstream public cloud computing network, VPN (Virtual Private Network) function and SNAT / PNAT (Source / Port Network Address Translation) function of accessing and exiting the public network can be implemented for tenants' VPC (Virtual Private Cloud). Both VPN function and SNAT / PNAT function will have floating IP (Internet Protocol) traffic entering and exiting the public network, but the traffic paths of the two in and out of the public network are not unified, and the floating IP diversion method and traffic speed limit management method of the two are inconsistent, which is not convenient for troubleshooting and subsequent maintenance, and the maintenance cost is high. Summary of the invention

[0003] In view of this, the present invention provides a VPN gateway traffic forwarding method, device, electronic device and storage medium to solve the problem of inconsistent traffic paths for different functions in a public cloud computing network.

[0004] In a first aspect, the present invention provides a VPN gateway traffic forwarding method, which is applied to a physical machine in a public cloud system, wherein the public cloud system includes at least a VPC, a tenant gateway, a physical machine, a rate-limiting gateway node, and a traffic diversion gateway node, wherein the physical machine includes a VPN gateway and an open virtual switch, and the method includes:

[0005] Receive a first target data packet sent by a tenant gateway, where the first target data packet is used to represent outbound traffic;

[0006] Encrypting the first target data packet based on the VPN gateway to obtain a first encrypted data packet;

[0007] The first encrypted data packet is parsed based on the preset flow table rules, and the target speed limit gateway node is determined based on the parsing result, and the first encrypted data packet is forwarded to the target speed limit gateway node. The target speed limit gateway node performs speed limit processing and sends the first encrypted data packet to the client gateway.

[0008] In a second aspect, the present invention provides a VPN gateway traffic forwarding device, the device comprising:

[0009] A data packet receiving module receives a first target data packet sent by a tenant gateway, wherein the first target data packet is used to represent outgoing traffic;

[0010] An encryption module, used for encrypting the first target data packet based on the VPN gateway to obtain a first encrypted data packet;

[0011] The data packet parsing module is used to parse the first encrypted data packet based on the preset flow table rules, and determine the target speed limit gateway node based on the parsing result, and forward the first encrypted data packet to the target speed limit gateway node. The target speed limit gateway node performs speed limit processing and sends the first encrypted data packet to the client gateway.

[0012] In a third aspect, the present invention provides an electronic device comprising: a memory and a processor, the memory and the processor being communicatively connected to each other, the memory storing computer instructions, and the processor executing the method of the first aspect or any corresponding embodiment thereof by executing the computer instructions.

[0013] In a fourth aspect, the present invention provides a computer-readable storage medium having computer instructions stored thereon, the computer instructions being used to cause a computer to execute the method of the first aspect or any corresponding embodiment thereof.

[0014] The VPN gateway traffic forwarding method provided by the embodiment of the present invention is applied to the physical machine of the public cloud system. The method includes receiving a first target data packet sent by the tenant gateway, the first target data packet is the outbound traffic, encrypting the first target data packet, and after obtaining the first encrypted data packet, parsing the first encrypted data packet based on the preset flow table rule, thereby determining the target speed limit gateway node, forwarding the first encrypted data packet to the target speed limit gateway node, and sending the first encrypted data packet to the client gateway after the target speed limit gateway performs speed limit processing. This method sends the outbound traffic to the speed limit gateway, which is forwarded to the client gateway by the speed limit gateway. In this way, the VPN gateway does not need to implement the speed limit management function, and the speed limit gateway performs speed limit management on the outbound traffic, thereby reducing the implementation complexity of the VPN gateway. The VPN function uses the same method and traffic path as other functions to connect to the public network, which can improve the troubleshooting efficiency of each function and reduce the problem of high subsequent maintenance costs caused by different functions. BRIEF DESCRIPTION OF THE DRAWINGS

[0015] In order to more clearly illustrate the specific implementation methods of the present invention or the technical solutions in the prior art, the drawings required for use in the specific implementation methods or the description of the prior art will be briefly introduced below. Obviously, the drawings described below are some implementation methods of the present invention. For ordinary technicians in this field, other drawings can be obtained based on these drawings without paying creative work.

[0016] Figure 1 is a network topology diagram of public cloud computing in the prior art according to an embodiment of the present invention;

[0017] Figure 2 is a network topology diagram of a VPN gateway traffic forwarding method according to an embodiment of the present invention;

[0018] Figure 3 It is a flow chart of a VPN gateway traffic forwarding method according to an embodiment of the present invention;

[0019] Figure 4 is a structural block diagram of a VPN gateway traffic forwarding device according to an embodiment of the present invention;

[0020] Figure 5 It is a schematic diagram of the hardware structure of the electronic device according to an embodiment of the present invention. DETAILED DESCRIPTION

[0021] In order to make the purpose, technical solution and advantages of the embodiments of the present invention clearer, the technical solution in the embodiments of the present invention will be clearly and completely described below in conjunction with the drawings in the embodiments of the present invention. Obviously, the described embodiments are part of the embodiments of the present invention, not all of the embodiments. Based on the embodiments of the present invention, all other embodiments obtained by those skilled in the art without creative work are within the scope of protection of the present invention.

[0022] VPC (Virtual Private Cloud) is a network mode used to isolate cloud hosts of different tenants on a public cloud. VPN (Virtual Private Network) uses a specific encryption method to establish a stable tunnel between two networks to achieve secure communication between the two networks. The tenant gateway is one of the basic network elements in the cloud computing network and is the default gateway of the tenant. It is used to forward business traffic in and out of the tenant's VPC and realize the interconnection between the tenant's VPC and other networks. The VPN gateway is one of the basic network elements in the cloud computing network and is a gateway that implements the VPN function. The rate-limiting gateway is one of the basic network elements in the cloud computing network. It is connected to the tenant gateway and is used to implement bandwidth management and traffic rate limiting for tenants. The traffic diversion gateway is one of the basic network elements in the cloud computing network. It is connected to the b-leaf node (border leaf node) and is used to synchronize BGP (Border Gateway Protocol) routing with the b-leaf node to achieve public network traffic diversion. B-Leaf nodes are usually used as basic network elements at the network boundary in cloud computing networks. They are responsible for connecting the external network and the inside of the data center, and undertake tasks such as routing learning, traffic forwarding, and network security.

[0023] In the current mainstream public cloud computing network, implementing VPN functions for tenant VPC usually involves the collaboration of tenant gateways, VPN gateways, b-leaf nodes, and other nodes. The network topology diagram is as follows: Figure 1. For tenant VPC, the outbound traffic path is: VM traffic goes out from VPC to tenant gateway, tenant gateway forwards traffic to VPN gateway's intranet port (eth1 port), VPN gateway encrypts and manages speed limit for data packets, then forwards traffic from its external network port (eth2 port) to b-leaf node, and finally b-leaf node forwards traffic to client-side VPN gateway through public network tunnel. For tenant VPC, the inbound traffic path is opposite to the outbound traffic path. In order to connect the VPN gateway in the cloud with the client-side VPN gateway, a floating IP needs to be allocated to the external network port (eth2 port) of the VPN gateway in the cloud. On the other hand, when implementing SNAT / PNAT access to and from the public network for tenant VPC, the outbound traffic path is: VM traffic goes out from VPC to tenant gateway, tenant gateway forwards traffic to NAT (Network Address Translation) gateway, NAT gateway forwards traffic to speed limit gateway for traffic bandwidth speed limit management, speed limit gateway forwards traffic to b-leaf node for outbound to the public network. The traffic path in the direction of the public network is: the public network traffic goes to the b-leaf node, the b-leaf node queries the BGP route and forwards the traffic to the diversion gateway, the diversion gateway forwards the traffic to the speed limit gateway, the speed limit gateway forwards the traffic to the NAT gateway, the NAT gateway forwards the traffic to the tenant gateway, and finally the tenant gateway forwards the traffic to the VPC. Among them, in order to enable the in-cloud traffic to be forwarded on the public network, a floating IP will be assigned to it on the NAT gateway. It can be seen that the VPN function and the SNAT / PNAT function will have floating IP traffic entering and leaving the public network, but the traffic paths of the two in and out of the public network are not unified, and the floating IP diversion method and traffic speed limit management method of the two are inconsistent, which is not convenient for troubleshooting and subsequent maintenance, and the maintenance cost is high.

[0024] Based on this, an embodiment of the present invention provides a VPN gateway traffic forwarding method. This solution can be used in scenarios where VPN functions are implemented in a public cloud, and is specifically applied to physical machines in a public cloud system, wherein the public cloud system includes at least a VPC, a tenant gateway, a physical machine, a rate-limiting gateway node, and a traffic diversion gateway node, and the physical machine includes a VPN gateway and an open virtual switch.

[0025] The embodiment of the present invention provides a VPN gateway traffic forwarding method such as Figure 2 As shown in Figure 2, the public cloud system is Figure 2In the cloud environment, users can create a custom VPC network and related subnets, and have several virtual machines in the corresponding subnets. The cloud environment will automatically assign a corresponding tenant gateway to the VPC, and all Layer 3 traffic in and out of the VPC will be forwarded by the tenant gateway. Correspondingly, the traffic in and out of the VPC for VPN services also needs to pass through the tenant gateway. The tenant gateway can be implemented in the form of a physical machine or a virtual machine. For a VPC network with VPN services enabled, the cloud environment will assign it a VPN gateway, which can be implemented in the form of a physical machine or a virtual machine. Take the form of a virtual machine as an example, that is, create a virtual machine on a physical machine, which acts as a VPN gateway to forward traffic for VPN services. The cloud environment also deploys a rate-limiting gateway and a traffic diversion gateway, which can be implemented in a cluster, that is, there are at least two rate-limiting gateway nodes and traffic diversion gateway nodes in the cloud environment.

[0026] According to an embodiment of the present invention, an embodiment of a VPN gateway traffic forwarding method is provided. It should be noted that the steps shown in the flowchart of the accompanying drawings can be executed in a computer system such as a set of computer executable instructions, and although a logical order is shown in the flowchart, in some cases, the steps shown or described can be executed in an order different from that shown here.

[0027] In this embodiment, a VPN gateway traffic forwarding method is provided, which can be used for a physical machine in the above-mentioned public cloud system. Figure 3 is a flow chart of a VPN gateway traffic forwarding method according to an embodiment of the present invention. Figure 3 As shown, the process includes the following steps:

[0028] Step S101: receiving a first target data packet sent by a tenant gateway.

[0029] Among them, the first target data packet is used to characterize the outbound traffic, and the outbound traffic refers to the traffic sent outward from the public cloud system. The first target data packet of the virtual machine in the VPC is forwarded to the tenant gateway through the VXLAN (Virtual Extensible Local Area Network) tunnel, and the tenant gateway sends the first target data packet to the physical machine in this embodiment, specifically, from the intranet port (eth1 port) of the VPN gateway to the VPN gateway on the physical machine. The VPN gateway has at least two network ports: eth1 and eth2. The IP address on the eth1 port is an intranet address, which is connected to the tenant gateway in the cloud environment and is used to forward traffic in and out of the tenant gateway. The IP address on the eth2 port is a public floating IP, that is, the VPN gateway on the client side of the cloud environment can access this floating IP through the public network, and the eth2 port is connected to the speed-limiting gateway through the OVS (Open vSwitch) of the physical machine.

[0030] Step S102: encrypting the first target data packet based on the VPN gateway to obtain a first encrypted data packet.

[0031] In order to ensure the security and privacy of data, encryption is performed before data transmission. The VPN gateway encrypts the first target data packet to obtain a first encrypted data packet.

[0032] Step S103: parse the first encrypted data packet based on the preset flow table rule, determine the target speed limit gateway node based on the parsing result, and forward the first encrypted data packet to the target speed limit gateway node.

[0033] The preset flow table rules define how to process and forward data packets based on the characteristics of the data packets (such as source address, destination address, port number, etc.). According to the flow table rules, the encrypted data packets are matched and parsed to identify their characteristics and destination addresses. Based on the parsing results, the target speed-limiting gateway node is determined, and specifically the IP address of the target speed-limiting gateway node can be determined. There are at least two speed-limiting gateway nodes in the cloud environment. The speed-limiting gateway node can be implemented in the form of a physical machine or a virtual machine.

[0034] The target speed-limiting gateway node sends the first encrypted data packet to the client gateway after executing the speed-limiting process.

[0035] Each speed-limiting gateway node has at least two network ports, such as Figure 2The bond-LAN port and bond-WAN port shown. Among them, the bond-LAN port is connected to the physical machine where the VPN gateway is located, and the bond-WAN port can be directly connected to the b-leaf node, which is used to forward the outbound traffic through the b-leaf node to the client gateway in the cloud environment. In this embodiment, the target speed-limiting gateway node performs speed-limiting management on the first encrypted data packet, and then forwards it to the b-leaf node, and the b-leaf node forwards the first encrypted data packet to the client VPN gateway in the cloud environment through the public network. The b-leaf node has the function of a switch. In the outbound direction, the b-leef node connects the public network and the speed-limiting gateway node. When the first encrypted data packet whose source IP is the specified floating IP is received from the speed-limiting gateway, the first encrypted data packet is forwarded to the public network. The client gateway will decrypt the first encrypted data packet, so as to see the decrypted original data packet, and can send the data packet to the computing node with the IP address contained in the original data packet according to the IP address contained in the original data packet.

[0036] The VPN gateway traffic forwarding method provided in this embodiment is applied to the physical machine of the public cloud system. The method includes receiving a first target data packet sent by the tenant gateway, the first target data packet is the outbound traffic, encrypting the first target data packet, and after obtaining the first encrypted data packet, parsing the first encrypted data packet based on the preset flow table rules, thereby determining the target speed-limited gateway node, forwarding the first encrypted data packet to the target speed-limited gateway node, and sending the first encrypted data packet to the client gateway after the target speed-limited gateway performs speed-limiting processing. This method sends the outbound traffic to the speed-limited gateway, which is forwarded to the client gateway by the speed-limited gateway. In this way, the VPN gateway does not need to implement the speed-limiting management function, and the speed-limiting gateway performs speed-limiting management on the outbound traffic, thereby reducing the implementation complexity of the VPN gateway. The VPN function uses the same method and traffic path as other functions to connect to the public network, which can improve the troubleshooting efficiency of each function and reduce the problem of high subsequent maintenance costs caused by different functions.

[0037] In some optional implementations, the above step S103 includes the following steps:

[0038] Step S201: the open virtual switch receives a first encrypted data packet sent by a VPN gateway, and parses the first encrypted data packet based on a preset flow table rule to determine a virtual extended LAN tunnel and a target speed-limiting gateway node.

[0039] The physical machines of the public cloud system also deploy open virtual switches (Open vSwitch, OVS), such as Figure 2As shown, the eth2 port of the VPN gateway is connected to the speed-limiting gateway through OVS. After the VPN gateway encrypts the data packet to generate the first encrypted data packet, the first encrypted data packet is sent from the eth2 port to OVS, and OVS parses the first encrypted data packet through the preset flow table rules to determine its corresponding virtual extended local area network (Virtual Extensible Local Area Network, VXLAN) tunnel and the target speed-limiting gateway node.

[0040] Furthermore, in step S201, the first encrypted data packet is parsed based on the preset flow table rules to determine the virtual extended LAN tunnel and the target speed limit gateway node, including: the open virtual switch parses the first encrypted data packet based on the preset flow table rules, and modifies the physical address of the target speed limit gateway node, the identification number and endpoint address of the virtual extended LAN tunnel based on the parsing result to determine the virtual extended LAN tunnel and the target speed limit gateway node.

[0041] The first encrypted data packet is an IP packet. The first encrypted data packet is parsed by the preset flow table rule. Specifically, the first encrypted data packet can be matched with the IP packet flow table representing the outgoing flow, so as to determine the physical address of the target speed-limiting gateway (i.e., the destination MAC address of the Ethernet frame), the identification number of the virtual extended LAN tunnel (VNI value) and the endpoint address (VTEP_IP), and finally the first encrypted data packet is sent to the vxlan1 port of the open virtual switch (such as Figure 2 After the first encrypted data packet comes out of the vxlan1 port, it will pass through the virtual extended LAN tunnel of the physical machine and be sent to the bond-LAN port of the target speed-limiting gateway node.

[0042] Step S202: forwarding a first encrypted data packet to a target rate-limiting gateway node from a virtual extended local area network tunnel based on a first flow table.

[0043] The first encrypted data packet is generated by the VPN gateway based on the ARP reply data packet sent by the open virtual switch, the first flow table is generated based on a preset flow table rule, and the first flow table is used to represent an IP packet flow table in an outgoing direction.

[0044] Among them, the ARP reply data packet is generated in the following manner: the open virtual switch receives the ARP request data packet sent by the VPN gateway, and replies to the ARP request data packet based on the second flow table to generate an ARP reply data packet, the second flow table is used to characterize the ARP proxy reply flow table, the second flow table is generated based on preset flow table rules, and the ARP reply data packet includes at least the physical address of the target speed limit gateway node.

[0045] ARP (Address Resolution Protocol) is a protocol used to resolve network layer addresses (such as IPv4 addresses) into link layer addresses (such as Ethernet MAC addresses). When a device (such as a computer, router, etc.) needs to send a data packet to another device, it first needs to know the physical address (MAC address) of the target device. If the sender does not know the MAC address of the target device, it will send an ARP request. In this embodiment, the VPN gateway sends an ARP request packet from the outbound direction of the eth2 port, and the second flow table represents the ARP proxy flow table in the outbound direction, which is used to match the ARP request packet in the outbound direction of the VPN gateway eth2 port and send an ARP reply packet. For the eth2 port of the VPN gateway, it only needs to be connected to the speed-limited gateway. The floating IP address on the eth2 port does not require a specific gateway. Therefore, all traffic coming out of the eth2 port of the VPN gateway should be forwarded to the speed-limited gateway. Based on this, for the ARP request data packet coming out of the eth2 port of the VPN gateway, the second flow table can be used on the br-int (integration bridge) bridge of OVS to do ARP proxy reply, that is, the second flow table directly responds to the ARP request and sends an ARP reply data packet to the eth2 port of the VPN gateway.

[0046] After receiving the ARP reply data packet, the VPN gateway can determine the physical address of the target speed-limiting gateway node, and then modify and encrypt the first target data packet in a targeted manner to determine the first encrypted data packet, which at least contains the physical address of the target speed-limiting gateway node. The first flow table represents the IP packet flow table in the outgoing direction, and its function is to match the IP packet (i.e., the first encrypted data packet) in the outgoing direction of the VPN gateway eth2 port, thereby modifying the physical address of the target speed-limiting gateway (i.e., the destination MAC address of the Ethernet frame), the identification number (VNI value) of the virtual extended LAN tunnel, and the endpoint address (VTEP_IP).

[0047] In some optional implementations, step S104 in the above implementations includes:

[0048] Step S301: The target speed-limiting gateway node compares the flow rate of the first encrypted data packet with a preset speed-limiting threshold.

[0049] When the target speed limit gateway node receives the first encrypted data packet, the target speed limit gateway node records and analyzes the traffic situation (i.e., traffic rate) of the specified IP address (the floating IP address of the eth2 port of the VPN gateway) in the first encrypted data packet, and compares the traffic rate with the preset speed limit threshold.

[0050] Step S302: If the flow rate of the first encrypted data packet does not exceed the preset speed limit threshold, the first encrypted data packet is forwarded to the client gateway.

[0051] If the traffic rate does not exceed the preset speed limit threshold, the target speed limit gateway node forwards the first encrypted data packet according to the pre-specified business rules. If, after comparison, the traffic rate continues to be greater than the preset speed limit threshold within the specified time, the target speed limit gateway node will discard the first encrypted data packet, thereby achieving the purpose of speed limit.

[0052] In this embodiment, a VPN gateway traffic forwarding method is provided, and the method includes the following steps:

[0053] Step S401: receiving a second encrypted data packet sent by a rate limiting gateway node.

[0054] The second encrypted data packet is used to represent the inbound traffic, and the second encrypted data packet is forwarded by the traffic diversion gateway node to the rate-limiting gateway node.

[0055] When the second encrypted data packet is used to characterize the inbound traffic, it indicates that it is sent from the client gateway outside the public cloud system to the VPC. After receiving and decrypting the first encrypted data packet, the client gateway will reply to the VPC in the public cloud system with a message. The reply message is the second target data. After encryption and encapsulation, the second encrypted data packet is obtained. The second encrypted data packet first reaches the b-leaf node from the client gateway. The b-leaf node forwards the second encrypted data packet to the drainage gateway node through the learned BGP route, where the drainage gateway node is clustered. The drainage gateway then forwards the second encrypted data packet to the speed-limiting gateway node through the VXLAN tunnel. The speed-limiting gateway node performs speed-limiting management on the second encrypted data packet, and then forwards the second encrypted data packet to the physical machine, specifically to the open virtual switch of the physical machine.

[0056] In step S402, the open virtual switch determines a third flow table based on a preset flow table rule, and forwards the second encrypted data packet to the target VPN gateway based on the third flow table. The target VPN gateway decrypts the second encrypted data packet, generates a second target data packet, and forwards the second target data packet to the VPC via the tenant gateway.

[0057] Among them, the third flow table represents the IP packet flow table in the inbound direction of the VPN gateway eth2 port. The second encrypted data packet is matched through the third flow table to determine the physical address of the eth2 port of the target VPN gateway, so as to send the second encrypted data packet to the eth2 port of the target VPN gateway.

[0058] After receiving the second encrypted data packet, the target VPN gateway decrypts and decapsulates it to obtain the original data packet (i.e., the second target data packet). The second target data packet is transmitted through the eth1 interface (e.g., Figure 2 As shown in Figure 2), and the tenant gateway, forwarding to the cloud host in the VPC.

[0059] Specifically, in the above step S402, the open virtual switch determines the third flow table based on the preset flow table rule, and forwards the second encrypted data packet to the target VPN gateway based on the third flow table, including:

[0060] Step S4021: Perform flow table matching on the second encrypted data packet based on preset flow table rules to determine a third flow table.

[0061] The third flow table at least includes the physical address of the second encrypted data packet at the entrance of the open virtual switch and the entrance of the target VPN gateway in the inbound direction.

[0062] Step S4022: modify the physical address of the second encrypted data packet to the physical address of the ingress of the target VPN gateway in the inbound direction, so as to send the second encrypted data packet to the target VPN gateway.

[0063] See also Figure 2 , the inlet of the target VPN gateway in the inbound direction is eth2, and the inlet of the open virtual switch is vxlan1. According to the preset flow table rules, the rule of the third flow table is that the data enters from the inlet vxlan1 of the open virtual switch, and the destination address is the IP address of eth2, then the physical address of the second encrypted data packet is modified to the physical address of eth2 of the target VPN gateway, and the second encrypted data packet is sent to the data port corresponding to eth2 of the target VPN gateway, so that the target VPN gateway receives the second encrypted data packet.

[0064] The VPN gateway traffic forwarding method provided by the embodiment of the present invention formulates an open virtual switch flow table related to the external network port of the VPN gateway, and can effectively improve the performance of the open virtual switch and reduce the risk of network paralysis by answering the ARP request of the external network port of the VPN gateway and clarifying the forwarding path of the IP packets in its inbound and outbound directions. Both the speed-limiting gateway and the traffic diversion gateway are implemented in a clustered manner, which can reduce the failures that may be caused by a single node and improve the availability and reliability of the overall system.

[0065] As a specific application example of the present invention, Figure 2 The VPN gateway traffic forwarding method provided by the present invention is described.

[0066] In the present invention, users can create customized VPC networks and related subnets in the public cloud environment (cloud environment), and have several virtual machines in the corresponding subnets. The traffic of the VPN gateway in the cloud is interconnected with the traffic of the client side outside the cloud. The outbound traffic path is: VPN gateway in the cloud -> speed-limited gateway -> b-leaf node -> public network -> customer VPN gateway, and the inbound traffic path is: customer VPN gateway -> public network -> b-leaf node -> diversion gateway -> speed-limited gateway -> VPN gateway in the cloud.

[0067] For example, if the VPC network segment is 192.168.0.0 / 16, the subnet network segment is 192.168.10.0 / 24, and the intranet IP address of the cloud host is 192.168.10.10. And the user has opened a VPN for the VPC, and the corresponding VPN gateway IP address on the client side of the cloud environment is: 100.127.17.17, which is accessible to the public network, and the bandwidth value of the VPN is set to 1000bps. At this time, the cloud environment will also allocate a floating IP address of the cloud environment to the VPN, such as 100.126.16.16, which is accessible to the public network and is used to connect to the VPN gateway address on the client side. The client side of the cloud environment has a computing node, and its intranet IP address is: 192.168.20.20.

[0068] When the host in the cloud uses the VPN function to access the computer on the client side of the cloud environment, for example, when pinging 192.168.20.20 on the 192.168.10.10 machine, there will be data packet 1:

[0069] 192.168.10.10->192.168.20.20. The data packet will reach the tenant gateway through the outbound VXLAN tunnel in the VPC. The tenant gateway queries the corresponding route and sends the data packet to eth1 of the VPN gateway through the VXLAN tunnel.

[0070] The VPN gateway is implemented in the form of a virtual machine, that is, it exists on a physical machine, and a VXLAN tunnel exists between the physical machine and the tenant gateway. The IP on the eth1 port of the VPN gateway is an intranet address, which is connected to the tenant gateway. The IP address on the eth2 port of the VPN gateway is a floating IP automatically assigned by the cloud environment, that is, 100.126.16.16, which is accessible to the public network and is not an intranet address. The VPN gateway will establish a VPN tunnel between the eth2 port and the VPN gateway on the client side of the cloud environment. The two can communicate with each other, that is, 100.126.16.16 and 100.127.17.17 can communicate with each other at Layer 3. After the VPN gateway receives the above data packet 1 (i.e. 192.168.10.10->192.168.20.20), it will encrypt and encapsulate the data packet, and then send the encrypted and encapsulated data packet out of the eth2 port. At this time, the source IP address of the sent data packet (data packet 2) is 100.126.16.16, and the destination IP address is 100.127.17.17, that is, data packet 2: 100.126.16.16->100.127.17.17.

[0071] In this embodiment, since the VPN gateway is a virtual machine, its eth1 port and eth2 port both need to be connected to the OVS of the physical machine, that is, the sending and receiving of data packets need to be controlled by OVS and flow table. The present invention adopts the following flow table rules to realize the connection between the VPN gateway eth2 port and the speed-limited gateway cluster:

[0072] 1.table=0,priority=100,actions=goto_table:10

[0073] 2.table=10, priority=100, actions=goto_table:20

[0074] 3.table=21, priority=100, actions=goto_table:22

[0075] 4.table=22, priority=100, actions=goto_table:30

[0076] 5.table=20,priority=300,arp,in_port="vhuxxxxxxxx-01",

[0077] arp_spa=100.126.16.16, arp_op=1, actions=goto_table:21

[0078] 6.table=30,priority=300,arp,in_port="vhuxxxxxxxx-01",

[0079] arp_spa=100.126.16.16,arp_op=1,actions=move:NXM_OF_ETH_SRC[]->NXM_OF_ETH_DST[],set_field:fe:00:00:00:00:02->eth_src,set_field:2->arp_op,move:NXM_N X_ARP_SHA[]->NXM_NX_ARP_THA[],set_field:fe:00:00:00:00:02->arp_sha,move:NXM_OF_ARP_TPA[]->NXM_OF_ARP_SPA[],set_field:100.126.16.16->arp_tpa,IN_PORT

[0080] 7.table=20,priority=200,ip,in_port="vhuxxxxxxxx-01",nw_src=100.126.16.16,actions=set_field:0xf fffff->tun_id,set_field:55.55.55.55->tun_dst,set_field:fe:00:00:00:00:02->eth_dst,output:vxlan1

[0081] 8.table=20,priority=200,ip,in_port=vxlan1,nw_dst=100.126.16.16, actions=set_field:fa:00:00:00:00:01->eth_dst,output:"vhuxxxxxxxx-01"

[0082] Among them, flow tables 1 to 4 are basic flow tables, which are the default forwarding rules for data packets.

[0083] The 5th and 6th flow tables are the ARP proxy flow tables for the outbound direction of the VPN gateway eth2 port, which are used to match the ARP request packets in the outbound direction of the VPN gateway eth2 port and send ARP reply packets. Among them, vhuxxxxxxxx-01 is the interface name of the VPN gateway eth2 port on OVS, 100.126.16.16 is the floating IP address on the VPN gateway eth2 port, arp_op=1 indicates that the packet is an ARP request packet, goto_table:21 indicates that the packet is sent to flow table 21, fe:00:00:00:00:02 indicates the overlay mac address of the speed-limiting gateway (the mac address can be changed according to the actual situation of the speed-limiting gateway, the mac address here is only used as an example), and set_field:2->arp_op indicates that the type of the packet is set to ARP reply.

[0084] The seventh flow table is the IP packet flow table for the outbound direction of the VPN gateway eth2 port. Its function is to match the IP packets in the outbound direction of the VPN gateway eth2 port, modify the VNI value of the VXLAN tunnel, the VTEP_IP of the VXLAN tunnel, and the destination MAC address of the Ethernet frame, and finally send the data packet to the vxlan1 port. Among them, vhuxxxxxxxx-01 is the interface name of the VPN gateway eth2 port on OVS, 100.126.16.16 is the floating IP address on the eth2 port of the VPN gateway, 0xffffff is the VNI value of the VXLAN tunnel, 55.55.55.55 is the VTEP_IP of the speed-limiting gateway, and fe:00:00:00:00:02 indicates the overlay mac address of the speed-limiting gateway. The above values ​​can be changed according to the actual situation, and are only used as examples here.

[0085] The eighth flow table is the IP packet flow table for the incoming direction of the VPN gateway eth2 port. Its function is to match the IP packet received by the vxlan1 port whose destination address is the floating IP of the VPN gateway eth2 port, and after modifying the destination MAC address of the Ethernet frame, send the data packet to the VPN gateway eth2 port.

[0086] Among them, vhuxxxxxxxx-01 is the interface name of the VPN gateway eth2 port on OVS, 100.126.16.16 is the floating IP address of the VPN gateway eth2 port, and fa:00:00:00:00:01 is the MAC address of the VPN gateway eth2 port. The above values ​​can be changed according to actual conditions, and are only used as examples here.

[0087] After being forwarded by the above flow table rules, the aforementioned data packet 2 will be able to accurately reach the bond-LAN port of the speed-limited gateway without using the network flooding method, effectively improving the performance of OVS and reducing the risk of network paralysis.

[0088] The speed-limiting gateway is implemented in the form of a cluster, that is, there are at least two speed-limiting gateway nodes in the cloud environment, and the status of each speed-limiting gateway node is equal, so the aforementioned data packet 2 may reach the bond-LAN port of any speed-limiting gateway node.

[0089] The speed-limiting gateway has the function of speed-limiting management. After the bond-LAN port of a speed-limiting gateway node receives the data packet, the speed-limiting gateway node will record and analyze the traffic of the specified IP (such as 100.126.16.16 of the aforementioned data packet). When the traffic rate of the source IP continues to be greater than the speed-limiting threshold for a period of time, the speed-limiting gateway will discard the data packet to achieve the purpose of speed limiting. The period of time can be specified based on experience or business rules, such as 10 seconds. The speed-limiting threshold is the bandwidth value specified by the user when opening the VPN service, such as 1000bps. For example, in the aforementioned VPN service, when the data packet traffic with the source IP address of 100.126.16.16 and the destination IP address of 100.127.17.17 continues to be greater than 1000bps in the last 10 seconds, the speed-limiting gateway will discard the data packet. If the traffic rate of the specified IP does not exceed the specified threshold, the speed-limiting network element forwards the data packet according to the pre-specified business rules. In this embodiment, to simplify the description, the rate-limiting network element here forwards all data packets to the b-leaf node via the bond-WAN port.

[0090] After receiving the above data packet, b-leaf forwards the data packet to the public network according to the BGP routing rules managed on it, and then reaches the VPN gateway on the client side through the public network. The VPN gateway on the client side decrypts the data packet. At this time, the VPN gateway on the client side can see the decrypted original data packet 1: 192.168.10.10 ping 192.168.20.20, and then sends the data packet to the computing node with the IP address according to the destination IP (192.168.20.20). At this point, the path for VPC traffic in the cloud to reach the computing node on the client side outside the cloud through VPN is completed.

[0091] The following describes in detail the path for traffic from the client-side computing node outside the cloud to the VPC inside the cloud through the VPN.

[0092] After receiving the above data packet 1, the computing node on the client side outside the cloud will reply to the cloud host in the VPC in the cloud with a reply message, namely data packet 3: 192.168.20.20->192.168.10.10. This data packet 3 is forwarded to the client-side VPN gateway, which encrypts and encapsulates it into data packet 4: 100.127.17.17->100.126.16.16. The client-side VPN gateway then forwards data packet 4 to the b-leaf node via the public network.

[0093] After receiving data packet 4, the b-leaf node parses the message to obtain its destination IP: 100.126.16.16, and forwards data packet 4 to the diversion gateway according to the BGP routing rules managed on it.

[0094] The drainage gateway is implemented in the form of a cluster, that is, there are at least two drainage gateway nodes in the cloud environment, and the status of each drainage gateway node is equal, so the aforementioned data packet 4 may reach any drainage gateway node. Each node of the drainage gateway uses the BPG protocol to synchronize the routing of the floating IP with the b-leaf node, so that the routing of the specified floating IP can be published to the b-leaf node, realizing the drainage function of the specified floating IP.

[0095] As described above, when the VPN function is enabled, the cloud environment will allocate a floating IP (such as 100.126.16.16) to it. At this time, the cloud environment will publish a route with the destination IP being the floating IP on each node of the drainage gateway, such as a 32-bit detailed route: 100.126.16.16 / 32via 0.0.0.0, or a network segment route: 100.126.16.0 / 24via0.0.0.0. The specific routing rules can be changed according to the actual situation. This is just an example. In addition, each node of the drainage gateway uses the BGP protocol to synchronize routes with the b-leaf node in real time, so the b-leaf node will also have this route, so that the VPN traffic (packet 4) can reach the drainage gateway node through the b-leaf node.

[0096] After receiving data packet 4, the traffic diversion node forwards the data packet to the rate-limiting gateway node through the VXLAN tunnel.

[0097] As mentioned above, the speed limit gateway has a speed limit management function, which records and analyzes the traffic of the specified IP (such as 100.126.16.16 of data packet 4) and makes a speed limit judgment on the data packet. The speed limit judgment and management method are the same as those in the previous outgoing direction, so I will not repeat them here.

[0098] If the rate-limiting gateway does not limit or discard packet 4, it will forward the packet to the physical machine where the VPN gateway is located, and then reach the eth2 port of the VPN gateway via the OVS on the physical machine. On the OVS here, the aforementioned flow table 8 will be matched:

[0099] table=20,priority=200,ip,in_port=vxlan1,nw_dst=100.126.16.16, actions=set_field:fa:00:00:00:00:01->eth_dst,output:"vhuxxxxxxxxx-01"

[0100] The rule of this flow table is that for IP data packets coming from vxlan1 port and with the destination address of 100.126.16.16, the MAC address of the packet will be modified to the MAC address of eth2 of the VPN gateway, and the data packet will be sent to the data port corresponding to eth2 of the VPN. Based on this, the eth2 port of the VPN gateway can receive the data packet 4.

[0101] After receiving data packet 4, the VPN gateway will decrypt and decapsulate it to obtain the original data packet 3: 192.168.20.20->192.168.10.10. Then it will forward data packet 3 to the tenant gateway through the eth1 port.

[0102] The tenant gateway eventually forwards data packet 3 to the cloud host in the VPC, thereby enabling traffic to flow from the client-side computing node outside the cloud to the cloud host inside the cloud via VPN.

[0103] At this point, the complete forwarding process of data packets between the cloud host and the client-side computing node in the cloud through VPN is realized.

[0104] The tenant gateway can be implemented in a cluster manner, that is, the tenant gateway uses at least two servers to form a cluster, which improves the redundancy of the tenant gateway, thereby improving the availability and reliability of the tenant gateway.

[0105] The implementation method of the present invention formulates the OVS flow table rules adapted to the VPN gateway as follows:

[0106] 1.table=20,priority=300,arp,in_port="vhuxxxxxxxx-01",arp_spa=100.126.16.16,arp_op=1,actions=goto_table:21

[0107] 2.table=30,priority=300,arp,in_port="vhuxxxxxxxx-01",arp_spa=100.126.16.16,arp_op=1,actions=move:NXM_OF_ETH_SRC[]->NXM_OF_ETH_DST[],set_fiel d:fe:00:00:00:00:02->eth_src,set_field:2->arp_op,move:NXM_NX_ARP_SHA[]->NXM_NX_ARP_THA[],set_field:fe:00:00:00:00:02->arp_sha,move:NXM_OF_AR P_TPA[]->NXM_OF_ARP_SPA[],set_field:100.126.16.16->arp_tpa,IN_PORT

[0108] 3.table=20,priority=200,

[0109] ip,in_port="vhuxxxxxxxx-01",nw_src=100.126.16.16,actions=set_field:0xffffff->tun_id,set_field:55.55.55.55->tun_dst,set_field:fe:00:00:00:00:02->eth_dst,output:vxlan1

[0110] 4.table=20,priority=200,ip,in_port=vxlan1,nw_dst=100.126.16.16, actions=set_field:fa:00:00:00:00:01->eth_dst,output:"vhuxxxxxxxx-01"

[0111] In the prior art, the OVS flow table connected to the VPN gateway mainly uses action=NORMAL to forward data packets of the VPN external network port. For example, forwarding ARP request packets will cause ARP request packets to flood the network. When the flooding volume is large, it will seriously affect the performance of OVS and other computing nodes in the current network environment, and even cause network paralysis. The present invention accurately formulates the OVS flow table related to the external network port of the VPN gateway, and by answering the ARP request of the VPN gateway external network port and clarifying the forwarding path of the IP packets in its inbound and outbound directions, it can effectively improve the performance of OVS and reduce the risk of network paralysis.

[0112] In this embodiment, a VPN gateway traffic forwarding device is also provided, which is used to implement the above-mentioned embodiments and preferred implementation modes, and the descriptions that have been made will not be repeated. As used below, the term "module" can implement a combination of software and / or hardware for a predetermined function. Although the devices described in the following embodiments are preferably implemented in software, the implementation of hardware, or a combination of software and hardware, is also possible and conceivable.

[0113] This embodiment provides a VPN gateway traffic forwarding device, such as Figure 4 As shown, including:

[0114] A data packet receiving module receives a first target data packet sent by a tenant gateway, wherein the first target data packet is used to represent outgoing traffic;

[0115] An encryption module, used for encrypting the first target data packet based on the VPN gateway to obtain a first encrypted data packet;

[0116] The data packet parsing module is used to parse the first encrypted data packet based on the preset flow table rules, and determine the target speed limit gateway node based on the parsing result, and forward the first encrypted data packet to the target speed limit gateway node. The target speed limit gateway node performs speed limit processing and sends the first encrypted data packet to the client gateway.

[0117] In some optional implementations, the data packet parsing module includes:

[0118] A first data packet receiving unit is used to open the virtual switch to receive a first encrypted data packet sent by the VPN gateway, and parse the first encrypted data packet based on a preset flow table rule to determine a virtual extended LAN tunnel and a target speed-limiting gateway node;

[0119] A first data packet forwarding unit is used to forward the first encrypted data packet from the virtual extended LAN tunnel to the target rate-limiting gateway node based on a first flow table, wherein the first encrypted data packet is generated by the VPN gateway based on the ARP reply data packet sent by the open virtual switch, and the first flow table is generated based on the preset flow table rule, and the first flow table is used to characterize the IP packet flow table in the outgoing direction.

[0120] In some optional embodiments, the device further comprises:

[0121] A reply packet generation module is used for the open virtual switch to receive the ARP request packet sent by the VPN gateway, and to reply to the ARP request packet based on a second flow table to generate an ARP reply packet, wherein the second flow table is used to characterize the ARP proxy reply flow table, and the second flow table is generated based on the preset flow table rule, and the ARP reply packet includes at least the physical address of the target speed limit gateway node.

[0122] In some optional implementations, the first data packet receiving unit includes:

[0123] The address modification subunit is used for the open virtual switch to parse the first encrypted data packet based on the preset flow table rule, and to modify the physical address of the target speed-limiting gateway node, the identification number and endpoint address of the virtual extended LAN tunnel based on the parsing result to determine the virtual extended LAN tunnel and the target speed-limiting gateway node.

[0124] In some optional implementations, the target rate-limiting gateway node includes:

[0125] A comparison unit, configured for the target speed-limiting gateway node to compare the flow rate of the first encrypted data packet with a preset speed-limiting threshold;

[0126] A rate limiting forwarding unit is used to forward the first encrypted data packet to the client gateway if the flow rate of the first encrypted data packet does not exceed the preset rate limiting threshold.

[0127] In some optional embodiments, the device further comprises:

[0128] A second data packet receiving module is used to receive a second encrypted data packet sent by the speed limiting gateway node, the second encrypted data packet is used to represent the inbound traffic, and the second encrypted data packet is forwarded by the traffic diversion gateway node to the speed limiting gateway node;

[0129] A second data packet forwarding module is used for the open virtual switch to determine a third flow table based on a preset flow table rule, and forward the second encrypted data packet to a target VPN gateway based on the third flow table. The target VPN gateway decrypts the second encrypted data packet, generates a second target data packet, and forwards the second target data packet to the VPC via the tenant gateway.

[0130] In some optional implementations, the second data packet forwarding module includes:

[0131] A third flow table determination unit, configured to perform flow table matching on the second encrypted data packet based on a preset flow table rule, and determine the third flow table, wherein the third flow table at least includes a physical address of an entrance of the second encrypted data packet at the entrance of the open virtual switch and an entrance of the target VPN gateway in an inbound direction;

[0132] The physical address modification unit is used to modify the physical address of the second encrypted data packet to the physical address of the ingress of the target VPN gateway in the ingress direction, so as to send the second encrypted data packet to the target VPN gateway.

[0133] The further functional description of each of the above modules and units is the same as that of the above corresponding embodiments and will not be repeated here.

[0134] The VPN gateway traffic forwarding device in this embodiment is presented in the form of a functional unit, where the unit refers to an ASIC (Application Specific Integrated Circuit) circuit, a processor and memory that executes one or more software or fixed programs, and / or other devices that can provide the above functions.

[0135] An embodiment of the present invention further provides an electronic device having the above-mentioned VPN gateway traffic forwarding device.

[0136] See also Figure 5 , Figure 5 is a schematic diagram of the structure of an electronic device provided by an optional embodiment of the present invention, such as Figure 5 As shown, the electronic device includes: one or more processors 10, a memory 20, and interfaces for connecting various components, including high-speed interfaces and low-speed interfaces. The various components are connected to each other using different buses for communication, and can be installed on a common mainboard or installed in other ways as needed. The processor can process instructions executed in the electronic device, including instructions stored in or on the memory to display graphical information of the GUI on an external input / output device (such as a display device coupled to the interface). In some optional embodiments, if necessary, multiple processors and / or multiple buses can be used together with multiple memories and multiple memories. Similarly, multiple electronic devices can be connected, and each device provides some necessary operations (for example, as a server array, a group of blade servers, or a multi-processor system). Figure 5 A processor 10 is taken as an example.

[0137] The processor 10 may be a central processing unit, a network processor or a combination thereof. The processor 10 may further include a hardware chip. The hardware chip may be a dedicated integrated circuit, a programmable logic device or a combination thereof. The programmable logic device may be a complex programmable logic device, a field programmable gate array, a general purpose array logic or any combination thereof.

[0138] The memory 20 stores instructions executable by at least one processor 10, so that the at least one processor 10 executes the method shown in the above embodiment.

[0139] The memory 20 may include a program storage area and a data storage area, wherein the program storage area may store an operating system, an application required for at least one function; the data storage area may store data created according to the use of the electronic device, etc. In addition, the memory 20 may include a high-speed random access memory, and may also include a non-transient memory, such as at least one disk storage device, a flash memory device, or other non-transient solid-state storage device. In some optional embodiments, the memory 20 may optionally include a memory remotely arranged relative to the processor 10, and these remote memories may be connected to the electronic device via a network. Examples of the above-mentioned network include, but are not limited to, the Internet, an intranet, a local area network, a mobile communication network, and combinations thereof.

[0140] The memory 20 may include a volatile memory, such as a random access memory; the memory may also include a non-volatile memory, such as a flash memory, a hard disk or a solid state drive; the memory 20 may also include a combination of the above types of memory.

[0141] The electronic device further comprises a communication interface 30 for the electronic device to communicate with other devices or a communication network.

[0142] The embodiment of the present invention also provides a computer-readable storage medium. The method according to the embodiment of the present invention can be implemented in hardware, firmware, or can be implemented as a computer code that can be recorded in a storage medium, or can be implemented as a computer code that is originally stored in a remote storage medium or a non-temporary machine-readable storage medium and will be stored in a local storage medium through a network download, so that the method described herein can be stored in such software processing on a storage medium using a general-purpose computer, a dedicated processor, or programmable or dedicated hardware. Among them, the storage medium can be a magnetic disk, an optical disk, a read-only storage memory, a random access memory, a flash memory, a hard disk or a solid-state hard disk, etc.; further, the storage medium can also include a combination of the above types of memories. It can be understood that a computer, a processor, a microprocessor controller, or programmable hardware includes a storage component that can store or receive software or computer code. When the software or computer code is accessed and executed by a computer, a processor, or hardware, the method shown in the above embodiment is implemented.

[0143] Although the embodiments of the present invention have been described in conjunction with the accompanying drawings, those skilled in the art may make various modifications and variations without departing from the spirit and scope of the present invention. Such modifications and variations are all within the scope defined by the present invention.

Claims

1. A VPN gateway traffic forwarding method, characterized in that: Applied to a physical machine in a public cloud system, the public cloud system includes at least a VPC, a tenant gateway, a physical machine, a rate-limiting gateway node, and a traffic-diverting gateway node, the physical machine includes a VPN gateway and an open virtual switch, and the method includes: Receive a first target data packet sent by a tenant gateway, where the first target data packet is used to represent outbound traffic; Encrypting the first target data packet based on the VPN gateway to obtain a first encrypted data packet; The first encrypted data packet is parsed based on the preset flow table rules, and the target speed limit gateway node is determined based on the parsing result, and the first encrypted data packet is forwarded to the target speed limit gateway node. The target speed limit gateway node performs speed limit processing and sends the first encrypted data packet to the client gateway.

2. The method according to claim 1, characterized in that The step of parsing the first encrypted data packet based on a preset flow table rule, determining a target speed limit gateway node based on a parsing result, and forwarding the first encrypted data packet to the target speed limit gateway node includes: The open virtual switch receives the first encrypted data packet sent by the VPN gateway, and parses the first encrypted data packet based on a preset flow table rule to determine the virtual extended LAN tunnel and the target speed-limiting gateway node; Based on the first flow table, the first encrypted data packet is forwarded from the virtual extended LAN tunnel to the target speed limit gateway node, the first encrypted data packet is generated by the VPN gateway based on the ARP reply data packet sent by the open virtual switch, the first flow table is generated based on the preset flow table rule, and the first flow table is used to characterize the IP packet flow table in the outgoing direction.

3. The method according to claim 2, characterized in that The ARP reply data packet is generated as follows: The open virtual switch receives the ARP request data packet sent by the VPN gateway, and responds to the ARP request data packet based on a second flow table to generate an ARP response data packet, wherein the second flow table is used to characterize the ARP proxy response flow table, and the second flow table is generated based on the preset flow table rule, and the ARP response data packet includes at least the physical address of the target speed limit gateway node.

4. The method according to claim 3, characterized in that The step of parsing the first encrypted data packet based on a preset flow table rule to determine a virtual extended local area network tunnel and a target speed-limiting gateway node includes: The open virtual switch parses the first encrypted data packet based on the preset flow table rule, and modifies the physical address of the target speed-limiting gateway node, the identification number and endpoint address of the virtual extended LAN tunnel based on the parsing result to determine the virtual extended LAN tunnel and the target speed-limiting gateway node.

5. The method according to claim 1, characterized in that The target speed limit gateway node sends the first encrypted data packet to the client gateway after executing the speed limit processing, including: The target speed limit gateway node compares the flow rate of the first encrypted data packet with a preset speed limit threshold; If the flow rate of the first encrypted data packet does not exceed the preset speed limit threshold, the first encrypted data packet is forwarded to the client gateway.

6. The method according to claim 1, characterized in that The method further comprises: receiving a second encrypted data packet sent by the rate-limiting gateway node, where the second encrypted data packet is used to represent inbound traffic, and the second encrypted data packet is forwarded by the traffic diversion gateway node to the rate-limiting gateway node; The open virtual switch determines a third flow table based on preset flow table rules, and forwards the second encrypted data packet to the target VPN gateway based on the third flow table. The target VPN gateway decrypts the second encrypted data packet, generates a second target data packet, and forwards the second target data packet to the VPC via the tenant gateway.

7. The method according to claim 6, characterized in that The open virtual switch determines a third flow table based on a preset flow table rule, and forwards the second encrypted data packet to a target VPN gateway based on the third flow table, including: Perform flow table matching on the second encrypted data packet based on a preset flow table rule to determine the third flow table, wherein the third flow table at least includes the physical address of the second encrypted data packet at the entrance of the open virtual switch and the entrance of the target VPN gateway in the inbound direction; The physical address of the second encrypted data packet is modified to the physical address of the ingress of the target VPN gateway in the ingress direction, so as to send the second encrypted data packet to the target VPN gateway.

8. A VPN gateway traffic forwarding device, characterized in that: The device comprises: A data packet receiving module receives a first target data packet sent by a tenant gateway, wherein the first target data packet is used to represent outgoing traffic; An encryption module, used for encrypting the first target data packet based on the VPN gateway to obtain a first encrypted data packet; The data packet parsing module is used to parse the first encrypted data packet based on the preset flow table rules, and determine the target speed limit gateway node based on the parsing result, and forward the first encrypted data packet to the target speed limit gateway node. The target speed limit gateway node performs speed limit processing and sends the first encrypted data packet to the client gateway.

9. An electronic device, characterized in that: include: A memory and a processor, wherein the memory and the processor are communicatively connected to each other, the memory stores computer instructions, and the processor executes the VPN gateway traffic forwarding method according to any one of claims 1 to 7 by executing the computer instructions.

10. A computer-readable storage medium, characterized in that: The computer-readable storage medium stores computer instructions, and the computer instructions are used to enable a computer to execute the VPN gateway traffic forwarding method according to any one of claims 1 to 7.

Images