VPN gateway traffic forwarding method and apparatus, electronic device, and storage medium

Abstract

The application relates to the technical field of network security, and discloses a VPN gateway traffic forwarding method and device, electronic equipment and a storage medium, which are applied to a physical machine of a public cloud system. The method comprises the following steps: receiving a first target data packet sent by a tenant gateway, encrypting the first target data packet, obtaining a first encrypted data packet, analyzing the first encrypted data packet to determine a target rate limiting gateway node, and forwarding the first encrypted data packet to the target rate limiting gateway node. The first encrypted data packet is sent to a client gateway after being subjected to rate limiting processing by the target rate limiting gateway. According to the method, the out-direction traffic is sent to the rate limiting gateway, and then forwarded to the client gateway by the rate limiting gateway. Therefore, the VPN gateway does not need to realize the rate limiting management function, the out-direction traffic is subjected to rate limiting management by the rate limiting gateway, and the implementation complexity of the VPN gateway is reduced.

Description

TECHNICAL FIELD

[0001] The present application relates to the technical field of network security, and in particular to a VPN gateway traffic forwarding method and device, electronic equipment and a storage medium. BACKGROUND

[0002] A public cloud computing network is a cloud computing service mode deployed on the Internet, and users can access and use shared resource pools provided by cloud service providers through the Internet. In the current mainstream public cloud computing network, VPN (Virtual Private Network) functions and SNAT / PNAT (Source / Port Network Address Translation) functions for accessing public networks can be implemented for tenant VPCs (Virtual Private Clouds). Both the VPN function and the SNAT / PNAT function have floating IP (Internet Protocol) traffic accessing public networks, but the traffic paths of the two are not unified, and the floating IP diversion methods and traffic speed limit management methods of the two are inconsistent, which is not convenient for troubleshooting and later maintenance, and the maintenance cost is high. SUMMARY

[0003] Therefore, the present application provides a VPN gateway traffic forwarding method and device, electronic equipment and a storage medium to solve the problem of non-uniform traffic paths of different functions in a public cloud computing network.

[0004] In a first aspect, the present application provides a VPN gateway traffic forwarding method applied to a physical machine in a public cloud system, wherein the public cloud system at least includes a VPC, a tenant gateway, a physical machine, a speed limit gateway node and a diversion gateway node, and the physical machine includes a VPN gateway and an open virtual switch. The method comprises the following steps:

[0005] receiving a first target data packet sent by the tenant gateway, wherein the first target data packet is used to represent outbound traffic;

[0006] encrypting the first target data packet based on the VPN gateway to obtain a first encrypted data packet;

[0007] analyzing the first encrypted data packet based on a preset flow table rule, determining a target speed limit gateway node based on the analysis result, and forwarding the first encrypted data packet to the target speed limit gateway node, wherein the target speed limit gateway node sends the first encrypted data packet to a client gateway after performing speed limit processing.

[0008] In a second aspect, the present application provides a VPN gateway traffic forwarding device, which comprises:

[0009] a data packet receiving module configured to receive a first target data packet sent by a tenant gateway, the first target data packet being used to represent out-direction traffic;

[0010] an encryption module configured to encrypt the first target data packet based on a VPN gateway to obtain a first encrypted data packet;

[0011] a data packet analyzing module configured to analyze the first encrypted data packet based on a preset flow table rule, and determine a target rate limiting gateway node based on an analysis result, and forward the first encrypted data packet to the target rate limiting gateway node, wherein the target rate limiting gateway node sends the first encrypted data packet to a client gateway after performing rate limiting processing.

[0012] In a third aspect, the present application provides an electronic device, comprising a memory and a processor, the memory and the processor are communicatively connected, the memory stores computer instructions, and the processor executes the computer instructions to perform the method of the first aspect or any of the corresponding embodiments thereof.

[0013] In a fourth aspect, the present application provides a computer readable storage medium, which stores computer instructions, and the computer instructions are used to make a computer execute the method of the first aspect or any of the corresponding embodiments thereof.

[0014] The VPN gateway traffic forwarding method provided by the embodiments of the present application is applied to a physical machine of a public cloud system, and the method comprises the following steps: receiving a first target data packet sent by a tenant gateway, the first target data packet being out-direction traffic; encrypting the first target data packet to obtain a first encrypted data packet; analyzing the first encrypted data packet based on a preset flow table rule to determine a target rate limiting gateway node; forwarding the first encrypted data packet to the target rate limiting gateway node; and sending the first encrypted data packet to a client gateway after the target rate limiting gateway node performs rate limiting processing. According to the method, the out-direction traffic is sent to the rate limiting gateway, and then forwarded to the client gateway by the rate limiting gateway, so that the VPN gateway does not need to realize the rate limiting management function, the rate limiting gateway performs rate limiting management on the out-direction traffic, and the implementation complexity of the VPN gateway is reduced. The VPN function is connected to the public network by using the same method and traffic path as other functions, so that the troubleshooting efficiency of each function is improved, and the problem of high later maintenance cost caused by different functions is reduced. BRIEF DESCRIPTION OF DRAWINGS

[0015] In order to more clearly illustrate the technical solutions in the specific embodiments of the present application or the prior art, the following will briefly introduce the drawings needed to be used in the specific embodiments or prior art description. Obviously, the drawings described below are some embodiments of the present application, and for those skilled in the art, other drawings can also be obtained from these drawings without creative labor.

[0016] Figure 1 is a network topology diagram of public cloud computing in the prior art according to an embodiment of the present application;

[0017] Figure 2 is a network topology diagram of a VPN gateway traffic forwarding method according to an embodiment of the present application;

[0018] Figure 3 is a flowchart of a VPN gateway traffic forwarding method according to an embodiment of the present application;

[0019] Figure 4 is a structural block diagram of a VPN gateway traffic forwarding device according to an embodiment of the present application;

[0020] Figure 5 is a hardware structure schematic diagram of an electronic device according to an embodiment of the present application. DETAILED DESCRIPTION

[0021] In order to make the purpose, technical solutions and advantages of the embodiments of the present application clearer, the following will combine the drawings in the embodiments of the present application to clearly and completely describe the technical solutions in the embodiments of the present application. Obviously, the described embodiments are some of the embodiments of the present application, not all the embodiments. Based on the embodiments in the present application, all other embodiments obtained by those skilled in the art without creative labor are within the protection scope of the present application.

[0022] VPC (Virtual Private Cloud, virtual private cloud) is a network mode for isolating cloud hosts of different tenants on a public cloud. VPN (Virtual Private Network, virtual private network) establishes a stable tunnel between two networks by using a specific encryption method to achieve secure communication between the two networks. The tenant gateway is one of the basic network elements in the cloud computing network, which is the default gateway of the tenant and is used to forward traffic in and out of the tenant VPC, realizing the interconnection and intercommunication of the tenant VPC and other networks. The VPN gateway is one of the basic network elements in the cloud computing network, which is a gateway that implements VPN functions. The rate limiting gateway is one of the basic network elements in the cloud computing network, which is connected to the tenant gateway and is used to implement bandwidth management and traffic rate limiting of the tenant. The flow guide gateway is one of the basic network elements in the cloud computing network, which is connected to the b-leaf node (border leaf node) and is used to synchronize BGP (Border Gateway Protocol, border gateway protocol) routes with the b-leaf node to realize the flow guide of public network traffic. The b-Leaf node is usually used as a basic network element for network boundaries in cloud computing networks, responsible for connecting external networks and internal data centers, and undertaking tasks such as route learning, traffic forwarding, and network security.

[0023] In the current mainstream public cloud computing network, when implementing the VPN function for the tenant VPC, the cooperation of nodes such as the tenant gateway, the VPN gateway, and the b-leaf node is usually involved, and the network topology diagram is as follows Figure 1For a tenant VPC, the outbound traffic path is as follows: virtual machine traffic exits the VPC to the tenant gateway, which forwards the traffic to the VPN gateway's internal network interface (eth1). The VPN gateway encrypts and rates the data packets, then forwards the traffic from its external network interface (eth2) to the b-leaf node. Finally, the b-leaf node forwards the traffic through a public network tunnel to the client's VPN gateway. For a tenant VPC, the inbound traffic path is the reverse of the outbound path. To enable connectivity between the cloud-based VPN gateway and the client-side VPN gateway, a floating IP address needs to be assigned to the cloud-based VPN gateway's external network interface (eth2). On the other hand, when implementing SNAT / PNAT for a tenant VPC to access the public network, the outbound traffic path is as follows: virtual machine traffic exits the VPC to the tenant gateway, which forwards the traffic to the NAT (Network Address Translation) gateway. The NAT gateway then forwards the traffic to the rate-limiting gateway for bandwidth management, and the rate-limiting gateway then forwards the traffic to the b-leaf node for access to the public network. The public network inbound traffic path is as follows: public network traffic reaches the b-leaf node, the b-leaf node queries the BGP route and forwards the traffic to the referral gateway, the referral gateway then forwards the traffic to the rate limiting gateway, the rate limiting gateway then forwards the traffic to the NAT gateway, the NAT gateway then forwards the traffic to the tenant gateway, and finally the tenant gateway forwards the traffic into the VPC. To enable cloud traffic to be forwarded over the public network, a floating IP is assigned to the NAT gateway. Therefore, both VPN and SNAT / PNAT functions involve traffic entering and leaving the public network via floating IPs, but their traffic paths are not consistent, and their floating IP referral methods and traffic rate limiting management methods are also inconsistent. This makes troubleshooting and subsequent maintenance difficult and results in high maintenance costs.

[0024] Based on this, this invention provides a VPN gateway traffic forwarding method. This solution can be used in scenarios where VPN functions are implemented in public clouds, specifically applied to physical machines in public cloud systems. The public cloud system includes at least VPC, tenant gateway, physical machines, rate limiting gateway nodes, and traffic redirection gateway nodes. The physical machines include VPN gateways and open virtual switches.

[0025] This invention provides a VPN gateway traffic forwarding method, such as... Figure 2 As shown, the public cloud system is Figure 2In the cloud environment, a user can create a custom VPC network and related subnets, and has several virtual machines in the corresponding subnets. The cloud environment automatically allocates a corresponding tenant gateway to the VPC, and all three-layer traffic in and out of the VPC is forwarded by the tenant gateway. Correspondingly, the traffic of the VPN service in and out of the VPC also needs to pass through the tenant gateway. The tenant gateway can be implemented in the form of a physical machine or a virtual machine. For the VPC network with the VPN service, the cloud environment allocates a VPN gateway to the VPC network, and the VPN gateway can be implemented in the form of a physical machine or a virtual machine. Taking the virtual machine as an example, a virtual machine is created on a physical machine, and the virtual machine acts as a VPN gateway and is used to forward the traffic of the VPN service. The cloud environment also deploys a rate-limiting gateway and a flow guiding gateway, which can be implemented in the form of a cluster, that is, the cloud environment has at least two rate-limiting gateway nodes and flow guiding gateway nodes.

[0026] According to the embodiments of the present application, a VPN gateway traffic forwarding method is provided. It should be noted that the steps shown in the flowchart of the accompanying drawings can be executed in a computer system such as a set of computer executable instructions, and although the logical order is shown in the flowchart, in some cases, the steps shown or described can be executed in an order different from that shown here.

[0027] In this embodiment, a VPN gateway traffic forwarding method is provided, which can be used for the physical machine in the public cloud system described above, Figure 3 is a flowchart of the VPN gateway traffic forwarding method according to the embodiments of the present application, as Figure 3 shown, the flow includes the following steps:

[0028] Step S101, receiving a first target data packet sent by a tenant gateway.

[0029] The first target data packet is used to represent the out-direction flow, which refers to the flow sent from the public cloud system to outside. The first target data packet of the virtual machine in the VPC is forwarded to the tenant gateway through a VXLAN (Virtual Extensible Local Area Network) tunnel, and the tenant gateway sends the first target data packet to the physical machine in the embodiment. Specifically, the first target data packet is forwarded from the internal network port (eth1 port) of the VPN gateway to the VPN gateway on the physical machine. The VPN gateway has at least two network ports: eth1 and eth2. The IP address on the eth1 port is an internal network address, which is connected to the tenant gateway in the cloud environment and used to forward the flow in and out of the tenant gateway. The IP address on the eth2 port is a public network floating IP, that is, the VPN gateway on the customer side in the external cloud environment can access the floating IP through the public network, and the eth2 port is connected to the rate limiting gateway through the OVS (Open vSwitch) of the physical machine.

[0030] In step S102, the VPN gateway encrypts the first target data packet to obtain a first encrypted data packet.

[0031] In order to protect the security and privacy of data, the data is encrypted before transmission. The VPN gateway encrypts the first target data packet to obtain a first encrypted data packet.

[0032] In step S103, the first encrypted data packet is parsed based on a preset flow table rule, and a target rate limiting gateway node is determined based on the parsing result, and the first encrypted data packet is forwarded to the target rate limiting gateway node.

[0033] The preset flow table rule defines how to process and forward the data packet according to the characteristics of the data packet (such as source address, destination address, port number, etc.). According to the flow table rule, the encrypted data packet is matched and parsed to identify its characteristics and destination address. Based on the parsing result, the target rate limiting gateway node is determined, and the IP address of the target rate limiting gateway node can be specifically determined. There are at least two rate limiting gateway nodes in the cloud environment. The rate limiting gateway node can be implemented in the form of a physical machine or in the form of a virtual machine.

[0034] The target rate limiting gateway node sends the first encrypted data packet to the client gateway after performing rate limiting processing.

[0035] Each rate limiting gateway node has at least two network ports, such as Figure 2The bond-LAN port is connected with the physical machine where the VPN gateway is located, and the bond-WAN port can be directly connected with the b-leaf node and is used to forward the out direction traffic to the client gateway in the cloud environment through the b-leaf node. In the embodiment, the target rate limiting gateway node performs rate limiting management on the first encrypted data packet and then forwards the first encrypted data packet to the b-leaf node, and the b-leaf node forwards the first encrypted data packet to the client VPN gateway in the cloud environment through the public network. The b-leaf node has the function of a switch, and in the out direction, the b-leaf node is connected with the public network and the rate limiting gateway node, and when receiving the first encrypted data packet with the specified floating IP as the source IP from the rate limiting gateway, the b-leaf node forwards the first encrypted data packet to the public network. The client gateway decrypts the first encrypted data packet, so as to see the decrypted original data packet, and sends the data packet to the computing node with the IP address contained in the original data packet.

[0036] The VPN gateway traffic forwarding method provided in the embodiment is applied to a physical machine of a public cloud system, and the method comprises the following steps: receiving a first target data packet sent by a tenant gateway, the first target data packet being out direction traffic; encrypting the first target data packet to obtain a first encrypted data packet; analyzing the first encrypted data packet based on a preset flow table rule, so as to determine a target rate limiting gateway node; and forwarding the first encrypted data packet to the target rate limiting gateway node, and sending the first encrypted data packet to a client gateway after the target rate limiting gateway performs rate limiting processing. The method sends the out direction traffic to the rate limiting gateway, and the rate limiting gateway forwards the out direction traffic to the client gateway, so that the VPN gateway does not need to implement the rate limiting management function, the rate limiting gateway performs rate limiting management on the out direction traffic, and the implementation complexity of the VPN gateway is reduced. The VPN function is connected with the public network through the same method and traffic path as other functions, so that the troubleshooting efficiency of each function is improved, and the problem that the later maintenance cost is high due to different functions is reduced.

[0037] In some optional embodiments, the step S103 comprises the following steps:

[0038] In step S201, the open virtual switch receives a first encrypted data packet sent by a VPN gateway, and analyzes the first encrypted data packet based on a preset flow table rule to determine a virtual extended local area network tunnel and a target rate limiting gateway node.

[0039] The physical machine of the public cloud system also deploys an open virtual switch (Open vSwitch, OVS), such as Figure 2As shown, the eth2 port of the VPN gateway is connected with the rate limiting gateway through the OVS. After the VPN gateway generates the first encrypted data packet, the first encrypted data packet is sent from the eth2 port to the OVS, and the OVS analyzes the first encrypted data packet through the preset flow table rule to determine the corresponding virtual extension local area network (VXLAN) tunnel and the target rate limiting gateway node.

[0040] Further, the step S201 of analyzing the first encrypted data packet based on the preset flow table rule to determine the virtual extension local area network tunnel and the target rate limiting gateway node comprises: the open virtual switch analyzes the first encrypted data packet based on the preset flow table rule, and modifies the physical address of the target rate limiting gateway node, the identification number of the virtual extension local area network tunnel and the end point address based on the analysis result to determine the virtual extension local area network tunnel and the target rate limiting gateway node.

[0041] The first encrypted data packet is an IP packet, and the first encrypted data packet is analyzed through the preset flow table rule. Specifically, the IP packet flow table representing the direction flow is matched with the first encrypted data packet to determine the physical address (i.e. the destination MAC address of the Ethernet frame) of the target rate limiting gateway, the identification number (VNI value) of the virtual extension local area network tunnel and the end point address (VTEP_IP), and finally the first encrypted data packet is sent to the vxlan1 port of the open virtual switch (as shown in Figure 2 After the first encrypted data packet is sent out from the vxlan1 port, it will be sent to the bond-LAN port of the target rate limiting gateway node through the virtual extension local area network tunnel of the physical machine.

[0042] In step S202, the first encrypted data packet is forwarded to the target rate limiting gateway node from the virtual extension local area network tunnel based on the first flow table.

[0043] The first encrypted data packet is generated by the VPN gateway based on the ARP response data packet sent by the open virtual switch, and the first flow table is generated based on the preset flow table rule, and the first flow table is used to represent the direction IP packet flow table.

[0044] The ARP response data packet is generated in the following manner: the open virtual switch receives the ARP request data packet sent by the VPN gateway, and generates the ARP response data packet based on the second flow table in response to the ARP request data packet, the second flow table is used to represent the ARP response flow table, the second flow table is generated based on the preset flow table rule, and the ARP response data packet at least includes the physical address of the target rate limiting gateway node.

[0045] ARP (Address Resolution Protocol) is a protocol used to resolve network layer addresses (such as IPv4 addresses) to link layer addresses (such as Ethernet MAC addresses). When a device (such as a computer, router, etc.) needs to send a packet to another device, it first needs to know the physical address (MAC address) of the target device. If the sender does not know the MAC address of the target device, it will send an ARP request. In the present embodiment, the VPN gateway sends an ARP request packet from the eth2 port, and the second flow table indicates the ARP response flow table from the eth2 port, which matches the ARP request packet from the eth2 port of the VPN gateway and sends an ARP response packet. For the eth2 port of the VPN gateway, only the rate limiting gateway needs to be connected, and the floating IP address on the eth2 port does not need a specific gateway, so all traffic from the eth2 port of the VPN gateway should be forwarded to the rate limiting gateway. Based on this, for the ARP request packet from the eth2 port of the VPN gateway, the second flow table can be used on the br-int (integration bridge) bridge of the OVS to respond to the ARP request, i.e. directly responding to the ARP request by the second flow table, and sending an ARP response packet to the eth2 port of the VPN gateway.

[0046] After receiving the ARP response packet, the VPN gateway can determine the physical address of the target rate limiting gateway node, and then modify and encrypt the first target data packet to determine the first encrypted data packet, which at least contains the physical address of the target rate limiting gateway node. The first flow table indicates the IP packet flow table from the direction, which matches the IP packet (i.e. the first encrypted data packet) from the eth2 port of the VPN gateway, and modifies the physical address of the rate limiting gateway (i.e. the destination MAC address of the Ethernet frame), the identification number (VNI value) of the virtual extended local area network tunnel and the endpoint address (VTEP IP).

[0047] In some optional embodiments, step S104 in the above embodiment includes:

[0048] In step S301, the target rate limiting gateway node compares the traffic rate of the first encrypted data packet with the preset rate limiting threshold.

[0049] When the target rate limiting gateway node receives the first encrypted data packet, the target rate limiting gateway node records and analyzes the traffic (i.e. traffic rate) of the specified IP address (floating IP address of the eth2 port of the VPN gateway) in the first encrypted data packet, and compares the traffic rate with the preset rate limiting threshold.

[0050] Step S302, if the traffic rate of the first encrypted data packet does not exceed the preset throttling threshold, the first encrypted data packet is forwarded to the client gateway.

[0051] If the traffic rate does not exceed the preset throttling threshold, the first encrypted data packet is forwarded by the target throttling gateway node according to the pre-specified service rule. If the comparison shows that the traffic rate continuously exceeds the preset throttling threshold within the specified time length, the target throttling gateway node discards the first encrypted data packet, thereby achieving the purpose of throttling.

[0052] In the embodiment, a VPN gateway traffic forwarding method is provided, which comprises the following steps:

[0053] Step S401, a second encrypted data packet sent by a throttling gateway node is received.

[0054] The second encrypted data packet is used to represent the in-direction traffic, and is forwarded to the throttling gateway node by the flow guide gateway node.

[0055] When the second encrypted data packet is used to represent the in-direction traffic, it means that the message sent from the client gateway outside the public cloud system to the VPC is replied by the client gateway after receiving and decrypting the first encrypted data packet, and the reply message is the second target data packet, which is obtained after being encrypted and encapsulated. The second encrypted data packet first reaches the b-leaf node from the client gateway, and the b-leaf node forwards the second encrypted data packet to the flow guide gateway node through the learned BGP route, wherein the flow guide gateway node is implemented in a cluster. The flow guide gateway forwards the second encrypted data packet to the throttling gateway node through the VXLAN tunnel, and the throttling gateway node performs throttling management on the second encrypted data packet and forwards the second encrypted data packet to the physical machine, specifically to the open virtual switch of the physical machine.

[0056] Step S402, the open virtual switch determines a third flow table based on the preset flow table rule, and forwards the second encrypted data packet to the target VPN gateway based on the third flow table. The target VPN gateway decrypts the second encrypted data packet to generate a second target data packet, and forwards the second target data packet to the VPC through the tenant gateway.

[0057] The third flow table represents the IP message flow table of the eth2 port of the VPN gateway. The second encrypted data packet is matched through the third flow table, so as to determine the physical address of the eth2 port of the target VPN gateway, and then the second encrypted data packet is sent to the eth2 port of the target VPN gateway.

[0058] After receiving the second encrypted data packet, the target VPN gateway decrypts and decapsulates it to obtain the original data packet (i.e., the second target data packet). This second target data packet is then transmitted through the target VPN gateway's eth1 interface (e.g., ...). Figure 2 (as shown), and the tenant gateway, forward to the cloud host within the VPC.

[0059] Specifically, in step S402 above, the open virtual switch determines the third flow table based on preset flow table rules, and forwards the second encrypted data packet to the target VPN gateway based on the third flow table, including:

[0060] Step S4021: Perform flow table matching on the second encrypted data packet based on preset flow table rules to determine the third flow table.

[0061] The third flow table includes at least the physical address of the second encrypted data packet at the entry point of the open virtual switch and the entry point of the target VPN gateway in the inbound direction.

[0062] Step S4022: Modify the physical address of the second encrypted data packet to the physical address of the ingress point of the target VPN gateway in the inbound direction, so as to send the second encrypted data packet to the target VPN gateway.

[0063] Please see Figure 2 The target VPN gateway's inbound entry point is eth2, and the open virtual switch's entry point is vxlan1. According to the preset flow table rules, the third flow table rule states that data enters from the open virtual switch's entry point vxlan1, and the destination address is the IP address of eth2. Therefore, the physical address of the second encrypted data packet is modified to the physical address of the target VPN gateway's eth2, and the second encrypted data packet is sent to the data port corresponding to the target VPN gateway's eth2, enabling the target VPN gateway to receive the second encrypted data packet.

[0064] The VPN gateway traffic forwarding method provided in this invention establishes an open virtual switch flow table related to the VPN gateway's external network interface. By responding to ARP requests on behalf of the VPN gateway's external network interface and clarifying the forwarding paths of IP packets in both inbound and outbound directions, it effectively improves the performance of the open virtual switch and reduces the risk of network paralysis. Both the rate-limiting gateway and the traffic redirection gateway adopt a clustered implementation, which can reduce the failures that may be caused by a single node and improve the availability and reliability of the overall system.

[0065] As a specific application embodiment of the present invention, combined with Figure 2 The VPN gateway traffic forwarding method provided by this invention will be described.

[0066] In the present application, in the public cloud environment (in-cloud environment), the user can create a custom VPC network and related subnets, and has several virtual machines in the corresponding subnets. The traffic of the in-cloud VPN gateway and the traffic of the out-of-cloud customer side are interconnected, and the out-direction traffic path is: in-cloud VPN gateway -> rate limiting gateway -> b-leaf node -> public network -> customer VPN gateway, and the in-direction traffic path is: customer VPN gateway -> public network -> b-leaf node -> flow guiding gateway -> rate limiting gateway -> in-cloud VPN gateway.

[0067] Exemplarily, if the VPC network segment is 192.168.0.0 / 16, the subnet network segment is 192.168.10.0 / 24, and the in-cloud IP address of the cloud host is 192.168.10.10. The user opens a VPN for the VPC, and the corresponding VPN gateway IP address of the customer side in the out-of-cloud environment is 100.127.17.17, which is accessible in the public network, and the bandwidth value of the VPN is set to 1000bps. At this time, the in-cloud environment will also allocate a floating IP in the in-cloud environment for the VPN, for example, 100.126.16.16, which is accessible in the public network and is used to communicate with the VPN gateway address of the customer side. The customer side in the out-of-cloud environment has a computing node, and the in-cloud IP address of the computing node is 192.168.20.20.

[0068] When the cloud host in the in-cloud environment uses the VPN function to access the computer in the customer side of the out-of-cloud environment, for example, pinging 192.168.20.20 in the 192.168.10.10 machine, there will be a data packet 1:

[0069] 192.168.10.10 -> 192.168.20.20, the data packet will reach the tenant gateway in the VPC through the out-direction VXLAN tunnel. The tenant gateway queries the corresponding route, and the data packet is transmitted to the eth1 of the VPN gateway through the VXLAN tunnel again.

[0070] The VPN gateway is implemented in the form of a virtual machine, that is, it exists on a physical machine, and a VXLAN tunnel exists between the physical machine and the tenant gateway. The IP on the eth1 port of the VPN gateway is an intranet address, which is connected with the tenant gateway. The IP address on the eth2 port of the VPN gateway is a floating IP automatically allocated by the cloud environment, that is, 100.126.16.16, which is a public network accessible, non-intranet address. The VPN gateway will establish a VPN tunnel between the eth2 port and the customer-side VPN gateway in the cloud environment, and the two can intercommunicate, that is, 100.126.16.16 and 100.127.17.17 can intercommunicate in layer 3. After receiving the above data packet 1 (that is, 192.168.10.10->192.168.20.20), the VPN gateway will encrypt and encapsulate the data packet, and then send the encrypted and encapsulated data packet from the eth2 port. At this time, the source IP address of the sent data packet (data packet 2) is 100.126.16.16, and the destination IP address is 100.127.17.17, that is, data packet 2: 100.126.16.16->100.127.17.17.

[0071] In the embodiment, since the VPN gateway is a virtual machine, the eth1 port and the eth2 port of the VPN gateway need to be connected with the OVS of the physical machine, that is, the OVS and the flow table are needed to control the transmission and reception of the data packet. The present application adopts the following flow table rules to realize the communication between the eth2 port of the VPN gateway and the rate limiting gateway cluster:

[0072] 1. table=0, priority=100, actions=goto_table:10

[0073] 2. table=10, priority=100, actions=goto_table:20

[0074] 3. table=21, priority=100, actions=goto_table:22

[0075] 4. table=22, priority=100, actions=goto_table:30

[0076] 5. table=20, priority=300, arp, in_port="vhuxxxxxxxx-01",

[0077] arp_spa=100.126.16.16, arp_op=1, actions=goto_table:21

[0078] 6. table=30, priority=300, arp, in_port="vhuxxxxxxxx-01",

[0079] arp_spa=100.126.16.16, arp_op=1, actions=move:NXM_OF_ETH_SRC[]->NXM_OF_ETH_DST[], set_field:fe:00:00:00:00:02->eth_src, set_field:2->arp_op, move:NXM_NX_ARP_SHA[]->NXM_NX_ARP_THA[], set_field:fe:00:00:00:00:02->arp_sha, move:NXM_OF_ARP_TPA[]->NXM_OF_ARP_SPA[], set_field:100.126.16.16->arp_tpa, IN_PORT

[0080] 7. table=20, priority=200, ip, in_port="vhuxxxxxxxx-01", nw_src=100.126.16.16, actions=set_field:0xffffff->tun_id, set_field:55.55.55.55->tun_dst, set_field:fe:00:00:00:00:02->eth_dst, output:vxlan1

[0081] 8. table=20, priority=200, ip, in_port= vxlan1, nw_dst=100.126.16.16, actions=set_field:fa:00:00:00:00:01->eth_dst, output:"vhuxxxxxxxx-01"

[0082] Among them, the first to fourth flow table is the basic flow table, which is the default forwarding rule of the data packet.

[0083] The 5th-6th flow table is an ARP answer flow table of the VPN gateway eth2 port out direction, which matches the ARP request data packet of the VPN gateway eth2 port out direction and sends an ARP answer data packet. Among them, vhuxxxxxxxx-01 is the interface name of the VPN gateway eth2 port on the OVS, 100.126.16.16 is the floating IP address of the VPN gateway eth2 port, arp_op=1 indicates that the data packet is an ARP request packet, goto_table:21 indicates that the data packet is sent to the 21st flow table, fe:00:00:00:00:02 indicates the overlay mac address of the rate limiting gateway (the mac address can be changed according to the actual situation of the rate limiting gateway, and the mac address here is only an example), set_field:2->arp_op indicates that the type of the data packet is set to ARP answer.

[0084] The 7th flow table is an IP message flow table of the VPN gateway eth2 port out direction, which matches the IP message of the VPN gateway eth2 port out direction, modifies the VNI value of the VXLAN tunnel, the VTEP_IP of the VXLAN tunnel, and the destination MAC address of the Ethernet frame, and finally sends the data packet to the vxlan1 port. Among them, vhuxxxxxxxx-01 is the interface name of the VPN gateway eth2 port on the OVS, 100.126.16.16 is the floating IP address of the VPN gateway eth2 port, 0xffffff is the VNI value of the VXLAN tunnel, 55.55.55.55 is the VTEP_IP of the rate limiting gateway, and fe:00:00:00:00:02 indicates the overlay mac address of the rate limiting gateway. The above values can be changed according to the actual situation, and here are only examples.

[0085] The 8th flow table is an IP message flow table of the VPN gateway eth2 port in direction, which matches the IP message received by the vxlan1 port with the destination address of the VPN gateway eth2 port floating IP, modifies the destination MAC address of the Ethernet frame, and sends the data packet to the VPN gateway eth2 port.

[0086] Among them, vhuxxxxxxxx-01 is the interface name of the VPN gateway eth2 port on the OVS, 100.126.16.16 is the floating IP address of the VPN gateway eth2 port, fa:00:00:00:00:01 is the MAC address of the VPN gateway eth2 port. The above values can be changed according to the actual situation, and here are only examples.

[0087] Through the forwarding of the above flow table rules, the aforementioned data packet 2 can accurately reach the bond-LAN port of the rate limiting gateway, without using the network flooding manner, effectively improving the performance of the OVS and reducing the risk of network paralysis.

[0088] The rate limiting gateway is implemented in the form of a cluster, that is, there are at least two rate limiting gateway nodes in the cloud environment, and the status of each rate limiting gateway node is equivalent, so the aforementioned data packet 2 can reach the bond-LAN port of any rate limiting gateway node.

[0089] The rate limiting gateway has a rate limiting management function. After the bond-LAN port of a certain rate limiting gateway node receives the data packet, the rate limiting gateway node will record and analyze the traffic of the specified IP (such as the 100.126.16.16 of the aforementioned data packet). When the traffic rate of the source IP continuously exceeds the rate limiting threshold value for a period of time, the rate limiting gateway will discard the data packet to achieve the purpose of rate limiting. The period of time can be specified according to experience or business rules, such as 10 seconds. The rate limiting threshold value is the bandwidth value specified by the user when opening the VPN service, such as 1000 bps. For example, in the aforementioned VPN service, when the data packet with the source IP address of 100.126.16.16 and the destination IP address of 100.127.17.17 has a traffic rate that continuously exceeds 1000 bps in the last 10 seconds, the rate limiting gateway discards the data packet. If the traffic rate of the specified IP does not exceed the specified threshold value, the rate limiting network element forwards the data packet according to the pre-specified business rules. In this embodiment, in order to simplify the description, the rate limiting network element here forwards all data packets to the b-leaf node through the bond-WAN port.

[0090] After the b-leaf receives the aforementioned data packet, it forwards the data packet to the public network according to the BGP routing rules managed thereon, and then reaches the VPN gateway of the customer side through the public network. The VPN gateway of the customer side decrypts the data packet, at which time the VPN gateway of the customer side can see the decrypted original data packet 1: 192.168.10.10 ping 192.168.20.20, which then sends the data packet to the computing node having the IP address of 192.168.20.20 according to the destination IP (192.168.20.20). At this point, the path of the cloud internal VPC traffic reaching the computing node of the customer side through the VPN is completed.

[0091] The path of the traffic from the computing node of the customer side to the cloud internal VPC through the VPN will be described in detail below.

[0092] The computing node outside the cloud receives the data packet 1, and replies to the cloud host in the VPC with a reply message, i.e. data packet 3: 192.168.20.20->192.168.10.10. The data packet 3 is forwarded to the VPN gateway on the customer side, and is encrypted and encapsulated by the VPN gateway on the customer side into data packet 4: 100.127.17.17->100.126.16.16. Then the VPN gateway on the customer side forwards the data packet 4 to the b-leaf node via the public network.

[0093] The b-leaf node receives the data packet 4, parses the message to obtain the destination IP: 100.126.16.16, and forwards the data packet 4 to the flow guide gateway according to the BGP routing rules managed thereon.

[0094] The flow guide gateway is implemented in the form of a cluster, i.e. there are at least two flow guide gateway nodes in the cloud environment, and each flow guide gateway node has the same status. Therefore, the data packet 4 may arrive at any flow guide gateway node. Each flow guide gateway node uses the BGP protocol to synchronize the floating IP route with the b-leaf node, so that the route of the specified floating IP can be published to the b-leaf node, thereby realizing the flow guide function of the specified floating IP.

[0095] As described above, when the VPN function is opened, the cloud environment allocates a floating IP (such as 100.126.16.16) for the VPN function. At this time, the cloud environment publishes a route with the destination IP being the floating IP on each flow guide gateway node, such as a 32-bit detailed route: 100.126.16.16 / 32 via 0.0.0.0, or a network segment route: 100.126.16.0 / 24 via 0.0.0.0. The specific routing rules can be changed according to actual conditions, and this is only an example. In addition, each flow guide gateway node uses the BGP protocol to synchronize the route with the b-leaf node in real time, so that the b-leaf node also has the route, thereby realizing the transmission of the VPN traffic (data packet 4) to the flow guide gateway node via the b-leaf node.

[0096] The flow guide gateway receives the data packet 4, and forwards the data packet to the rate limiting gateway node via a VXLAN tunnel.

[0097] As described above, the rate limiting gateway has a rate limiting management function, which records and analyzes the traffic of the specified IP (such as 100.126.16.16 of the data packet 4), and performs rate limiting judgment on the data packet. The rate limiting judgment and management mode is the same as that of the out direction, and will not be described here.

[0098] If the rate-limiting gateway does not rate-limit and drop the data packet 4, the data packet is forwarded to the physical machine where the VPN gateway is located, and reaches the eth2 port of the VPN gateway via the OVS on the physical machine. On the OVS here, the aforementioned eighth flow table is matched:

[0099] table=20,priority=200,ip,in_port=vxlan1,nw_dst=100.126.16.16,actions=set_field:fa:00:00:00:00:01->eth_dst,output:"vhuxxxxxxxx-01"

[0100] The rule of the flow table is that the IP data packet coming from the vxlan1 port and having the destination address of 100.126.16.16 is modified in mac address to the mac address of the eth2 of the VPN gateway, and is sent to the data port corresponding to the eth2 of the VPN. Accordingly, the eth2 port of the VPN gateway can receive the data packet 4.

[0101] After the VPN gateway receives the data packet 4, the data packet 4 is decrypted and decapsulated, and thus the original data packet 3: 192.168.20.20->192.168.10.10 is obtained. The data packet 3 is forwarded to the tenant gateway via the eth1 port.

[0102] The tenant gateway finally forwards the data packet 3 to the cloud host in the VPC, and thus the path of the traffic from the customer-side computing node outside the cloud to the cloud host in the cloud via the VPN is realized.

[0103] Thus, the complete forwarding process of the data packet via the VPN between the cloud host in the cloud and the customer-side computing node is realized.

[0104] The tenant gateway can be realized in a cluster manner, that is, the tenant gateway uses at least two servers to form a cluster, so as to improve the redundancy of the tenant gateway, and thus the availability and reliability of the tenant gateway are improved.

[0105] The present embodiment formulates the OVS flow table rule adapted to the VPN gateway, as follows:

[0106] 1. table=20,priority=300,arp,in_port="vhuxxxxxxxx-01",arp_spa=100.126.16.16,arp_op=1,actions=goto_table:21

[0107] 2. table=30, priority=300, arp, in_port="vhuxxxxxxxx-01", arp_spa=100.126.16.16, arp_op=1, actions=move:NXM_OF_ETH_SRC[]->NXM_OF_ETH_DST[], set_field:fe:00:00:00:00:02->eth_src, set_field:2->arp_op, move:NXM_NX_ARP_SHA[]->NXM_NX_ARP_THA[], set_field:fe:00:00:00:00:02->arp_sha, move:NXM_OF_ARP_TPA[]->NXM_OF_ARP_SPA[], set_field:100.126.16.16->arp_tpa, IN_PORT

[0108] 3. table=20, priority=200,

[0109] ip, in_port="vhuxxxxxxxx-01", nw_src=100.126.16.16, actions=set_field:0xffffff->tun_id, set_field:55.55.55.55->tun_dst, set_field:fe:00:00:00:00:02->eth_dst, output:vxlan1

[0110] 4. table=20, priority=200, ip, in_port= vxlan1, nw_dst=100.126.16.16, actions=set_field:fa:00:00:00:00:01->eth_dst, output:"vhuxxxxxxxx-01"

[0111] In the prior art, the OVS flow table connected with the VPN gateway mainly adopts the action=normal mode to forward the data packet of the VPN external network port, for example, the ARP request packet, which will cause the ARP request packet to be flooded in the network, and when the flooding amount is large, the performance of the OVS and other computing nodes in the current network environment will be seriously affected, and even the network will be paralyzed. The present application precisely formulates the OVS flow table related to the external network port of the VPN gateway, and through the mode of answering the ARP request of the external network port of the VPN gateway and clearly defining the forwarding path of the IP packet of the in-out direction, the performance of the OVS can be effectively improved, and the risk of network paralysis can be reduced.

[0112] Also provided in the present embodiments is a VPN gateway traffic forwarding apparatus for implementing the above embodiments and preferred embodiments, which have been described above and will not be repeated. As used below, the term "module" can be a combination of software and / or hardware that implements a predetermined function. Although the apparatus described in the following embodiments is preferably implemented in software, implementation in hardware, or a combination of software and hardware, is also possible and contemplated.

[0113] The present embodiments provide a VPN gateway traffic forwarding apparatus, as shown in Figure 4 comprises:

[0114] a data packet receiving module configured to receive a first target data packet sent by a tenant gateway, the first target data packet being used to represent an out-direction traffic;

[0115] an encryption module configured to encrypt the first target data packet based on the VPN gateway to obtain a first encrypted data packet;

[0116] a data packet analysis module configured to analyze the first encrypted data packet based on a preset flow table rule, and determine a target rate-limiting gateway node based on an analysis result, and forward the first encrypted data packet to the target rate-limiting gateway node, the target rate-limiting gateway node sending the first encrypted data packet to a client gateway after performing rate-limiting processing.

[0117] In some optional embodiments, the data packet analysis module comprises:

[0118] a first data packet receiving unit configured to receive the first encrypted data packet sent by the VPN gateway by an open virtual switch, and analyze the first encrypted data packet based on a preset flow table rule to determine a virtual extended local area network tunnel and a target rate-limiting gateway node;

[0119] a first data packet forwarding unit configured to forward the first encrypted data packet from the virtual extended local area network tunnel to the target rate-limiting gateway node based on a first flow table, the first encrypted data packet being generated by the VPN gateway based on an ARP response data packet sent by the open virtual switch, the first flow table being generated based on the preset flow table rule, and the first flow table being used to represent an out-direction IP message flow table.

[0120] In some optional embodiments, the apparatus further comprises:

[0121] The open virtual switch receives the ARP request data packet sent by the VPN gateway, and generates an ARP response data packet based on a second flow table in response to the ARP request data packet, the second flow table being used to represent an ARP response flow table, the second flow table being generated based on the preset flow table rule, and the ARP response data packet including at least a physical address of the target rate-limiting gateway node.

[0122] In some optional embodiments, the first data packet receiving unit includes:

[0123] The address modification subunit is configured to parse the first encrypted data packet based on the preset flow table rule, and modify the physical address of the target rate-limiting gateway node, the identification number of the virtual extended local area network tunnel, and the end point address based on a result of the parsing, so as to determine the virtual extended local area network tunnel and the target rate-limiting gateway node.

[0124] In some optional embodiments, the target rate-limiting gateway node includes:

[0125] The comparison unit is configured to compare the traffic rate of the first encrypted data packet with a preset rate-limiting threshold.

[0126] The rate-limiting forwarding unit is configured to forward the first encrypted data packet to the client gateway if the traffic rate of the first encrypted data packet does not exceed the preset rate-limiting threshold.

[0127] In some optional embodiments, the apparatus further includes:

[0128] The second data packet receiving module is configured to receive a second encrypted data packet sent by the rate-limiting gateway node, the second encrypted data packet being used to represent in-directional traffic, and the second encrypted data packet being forwarded to the rate-limiting gateway node by the flow guide gateway node.

[0129] The second data packet forwarding module is configured to determine a third flow table based on a preset flow table rule, and forward the second encrypted data packet to a target VPN gateway based on the third flow table, the target VPN gateway decrypting the second encrypted data packet to generate a second target data packet, and forwarding the second target data packet to a VPC via the tenant gateway.

[0130] In some optional embodiments, the second data packet forwarding module includes:

[0131] The third flow table determining unit is configured to determine the third flow table based on preset flow table rules and flow table matching of the second encrypted data packet, wherein the third flow table at least includes a physical address of an entrance of the open virtual switch and an entrance of the target VPN gateway in an incoming direction;

[0132] The physical address modifying unit is configured to modify the physical address of the second encrypted data packet to the physical address of the entrance of the target VPN gateway in the incoming direction, so as to send the second encrypted data packet to the target VPN gateway.

[0133] Further function descriptions of the above-mentioned modules and units are the same as those of the corresponding embodiments, and will not be described here.

[0134] The VPN gateway traffic forwarding device in the embodiment is presented in the form of functional units, wherein the units refer to ASIC (Application Specific Integrated Circuit) circuits, processors and memories for executing one or more software or fixed programs, and / or other devices capable of providing the above functions.

[0135] The embodiment of the application further provides an electronic device with the above VPN gateway traffic forwarding device.

[0136] Please refer to Figure 5 , Figure 5 is a structural schematic diagram of an electronic device provided by an optional embodiment of the application, as Figure 5 shown, the electronic device includes one or more processors 10, memories 20, and interfaces for connecting various components, including high-speed interfaces and low-speed interfaces. Various components are communicatively connected with each other by using different buses, and can be installed on a common mainboard or in other manners as needed. The processor can process instructions executed in the electronic device, including instructions stored in the memory or graphics information of the memory to display a GUI on an external input / output device (such as a display device coupled to the interface). In some optional embodiments, if necessary, multiple processors and / or multiple buses can be used together with multiple memories and multiple storage devices. Similarly, multiple electronic devices can be connected, and each device provides part of the necessary operations (for example, as a server array, a group of blade servers, or a multi-processor system). Figure 5 In the embodiment, the processor 10 is taken as an example.

[0137] The processor 10 can be a central processing unit, a network processing unit, or a combination thereof. The processor 10 can further include a hardware chip. The hardware chip can be an application specific integrated circuit, a programmable logic device, or a combination thereof. The programmable logic device can be a complex programmable logic device, a field programmable logic device, a general array logic, or any combination thereof.

[0138] The memory 20 stores instructions executable by the at least one processor 10 to cause the at least one processor 10 to perform the methods illustrated in the above embodiments.

[0139] The memory 20 can include a program storage area and a data storage area. The program storage area can store an operating system, application programs required by at least one function, and the like. The data storage area can store data created according to the use of the electronic device, and the like. In addition, the memory 20 can include a high-speed random access memory, and can further include a non-transitory memory such as at least one of a magnetic disk storage device, a flash memory device, or other non-transitory solid state storage device. In some alternative embodiments, the memory 20 can optionally include a memory disposed remotely from the processor 10, and these remote memories can be connected to the electronic device through a network. Examples of the network include, but are not limited to, the Internet, an intranet, a local area network, a mobile communication network, and a combination thereof.

[0140] The memory 20 can include a volatile memory such as a random access memory, and can further include a non-volatile memory such as a flash memory, a hard disk, or a solid state disk. The memory 20 can further include a combination of the above-mentioned types of memories.

[0141] The electronic device further includes a communication interface 30 for communication of the electronic device with other devices or communication networks.

[0142] The embodiments of the present application also provide a computer readable storage medium. The above-mentioned methods according to the embodiments of the present application can be implemented in hardware, firmware, or recorded in a storage medium, or stored in a remote storage medium or a non-transitory machine readable storage medium by downloading through a network and stored in a local storage medium, so that the methods described herein can be processed by such software on a storage medium using a general purpose computer, a special purpose processor, or programmable or special purpose hardware. The storage medium can be a magnetic disk, an optical disk, a read-only memory, a random access memory, a flash memory, a hard disk, or a solid state disk, etc. Further, the storage medium can further include a combination of the above-mentioned types of memories. It can be understood that the computer, the processor, the microprocessor controller, or the programmable hardware includes a storage component that can store or receive software or computer code, when the software or computer code is accessed and executed by the computer, the processor, or the hardware, the methods illustrated in the above embodiments are implemented.

[0143] While embodiments of the present application have been described in conjunction with the appended drawings, various modifications and changes can be suggested by persons skilled in the art, and all such modifications and changes are believed to fall within the scope of the present application.

Claims

1. A VPN gateway traffic forwarding method, characterized in that, The method applies to physical machines in a public cloud system, wherein the public cloud system includes at least a VPC, a tenant gateway, physical machines, a rate-limiting gateway node, and a traffic redirection gateway node, and the physical machines include a VPN gateway and an open virtual switch. Receive a first target data packet sent by the tenant gateway, the first target data packet being used to characterize directional traffic; The first target data packet is encrypted using the VPN gateway to obtain the first encrypted data packet; The first encrypted data packet is parsed based on the preset flow table rules, and the target rate limiting gateway node is determined based on the parsing result. The first encrypted data packet is forwarded to the target rate limiting gateway node, and the target rate limiting gateway node sends the first encrypted data packet to the client gateway after performing rate limiting processing. The step of parsing the first encrypted data packet based on preset flow table rules, determining the target rate-limiting gateway node based on the parsing result, and forwarding the first encrypted data packet to the target rate-limiting gateway node includes: The open virtual switch receives the first encrypted data packet sent by the VPN gateway, and parses the first encrypted data packet based on preset flow table rules to determine the virtual extended LAN tunnel and the target rate-limiting gateway node; Based on the first flow table, the first encrypted data packet is forwarded from the virtual extended LAN tunnel to the target rate-limiting gateway node. The first encrypted data packet is generated by the VPN gateway based on the ARP reply data packet sent by the open virtual switch. The first flow table is generated based on the preset flow table rules and is used to represent the outgoing IP packet flow table.

2. The method according to claim 1, characterized in that, The ARP response data packet is generated in the following manner: The open virtual switch receives the ARP request data packet sent by the VPN gateway, and responds to the ARP request data packet based on the second flow table, generating an ARP reply data packet. The second flow table is used to characterize the ARP reply flow table, and the second flow table is generated based on the preset flow table rules. The ARP reply data packet includes at least the physical address of the target rate-limiting gateway node.

3. The method according to claim 2, characterized in that, The step of parsing the first encrypted data packet based on preset flow table rules to determine the virtual extended LAN tunnel and the target rate-limiting gateway node includes: The open virtual switch parses the first encrypted data packet based on the preset flow table rules, and modifies the physical address of the target rate-limiting gateway node, the identifier number and endpoint address of the virtual extended LAN tunnel based on the parsing result, so as to determine the virtual extended LAN tunnel and the target rate-limiting gateway node.

4. The method according to claim 1, characterized in that, After performing rate limiting, the target rate-limiting gateway node sends the first encrypted data packet to the client gateway, including: The target rate-limiting gateway node compares the traffic rate of the first encrypted data packet with the preset rate-limiting threshold. If the traffic rate of the first encrypted data packet does not exceed the preset rate limit threshold, the first encrypted data packet is forwarded to the client gateway.

5. The method according to claim 1, characterized in that, The method further includes: The system receives a second encrypted data packet sent by the rate-limiting gateway node. The second encrypted data packet is used to represent inbound traffic and is forwarded from the traffic redirection gateway node to the rate-limiting gateway node. The open virtual switch determines a third flow table based on preset flow table rules, and forwards the second encrypted data packet to the target VPN gateway based on the third flow table. The target VPN gateway decrypts the second encrypted data packet, generates a second target data packet, and forwards the second target data packet to the VPC via the tenant gateway.

6. The method according to claim 5, characterized in that, The open virtual switch determines a third flow table based on preset flow table rules, and forwards the second encrypted data packet to the target VPN gateway based on the third flow table, including: The second encrypted data packet is matched against the flow table based on the preset flow table rules to determine the third flow table. The third flow table includes at least the physical address of the entry point of the second encrypted data packet on the open virtual switch and the entry point of the target VPN gateway in the inbound direction. The physical address of the second encrypted data packet is modified to the physical address of the inbound entry point of the target VPN gateway, so as to send the second encrypted data packet to the target VPN gateway.

7. A VPN gateway traffic forwarding device, characterized in that, The device includes: The data packet receiving module receives a first target data packet sent by the tenant gateway, the first target data packet being used to characterize directional traffic; An encryption module is used to encrypt the first target data packet based on the VPN gateway to obtain a first encrypted data packet; The data packet parsing module is used to parse the first encrypted data packet based on preset flow table rules, determine the target rate limiting gateway node based on the parsing result, forward the first encrypted data packet to the target rate limiting gateway node, and the target rate limiting gateway node sends the first encrypted data packet to the client gateway after performing rate limiting processing. The data packet parsing module includes: The first data packet receiving unit is used to open the virtual switch to receive the first encrypted data packet sent by the VPN gateway, and to parse the first encrypted data packet based on preset flow table rules to determine the virtual extended LAN tunnel and the target rate-limiting gateway node. The first packet forwarding unit is used to forward the first encrypted packet from the virtual extended LAN tunnel to the target rate-limiting gateway node based on the first flow table. The first encrypted packet is generated by the VPN gateway based on the ARP reply packet sent by the open virtual switch. The first flow table is generated based on the preset flow table rules. The first flow table is used to represent the outgoing IP packet flow table.

8. An electronic device, characterized in that, include: A memory and a processor are communicatively connected, the memory stores computer instructions, and the processor executes the VPN gateway traffic forwarding method according to any one of claims 1 to 6 by executing the computer instructions.

9. A computer-readable storage medium, characterized in that, The computer-readable storage medium stores computer instructions for causing a computer to perform the VPN gateway traffic forwarding method according to any one of claims 1 to 6.

Images