Data forwarding method, system and device and storage medium

Abstract

The embodiment of the invention provides a data forwarding method and system, and the method comprises the steps: extracting an outgoing source IP private network address from an outgoing data packet when an NAT gateway server configured with Open vSwitch receives the outgoing data packet from an internal network to a public network; when the first flow table judges that the outgoing source IP private network address needs to be subjected to network address translation, the outgoing source IP private network address is translated into a corresponding outgoing source IP public network address through a network address translation flow table, and the outgoing source IP private network address in the outgoing data packet is replaced; and sending the outgoing data packet with the replaced network address to the outgoing destination IP address. According to the technical scheme, the OVS flow table based on the Open vSwitch is arranged on the NAT gateway server, conversion between the intranet address and the public network address is carried out through the flow table, the method has the advantages of being high in performance, simple in configuration, extensible and the like, and due to the unique design of the OVS flow table Pipeline, the network address conversion process is optimized, and the processing delay and expenditure of data packets are reduced.

Description

Technical Field

[0001] The present invention relates to the field of network technology, and in particular to a data forwarding method, system, device and storage medium. Background Art

[0002] Network Address Translation, abbreviated as NAT, is a technology that implements IP address reuse in computer networks. It can convert private IP addresses of internal networks into public IP addresses of public networks, so that multiple hosts in the internal network can share one or a small number of public IP addresses, saving IP address resources and improving network security and manageability.

[0003] The most common and classic way to implement NAT is through the iptables function provided by Linux. NAT servers in production environments are generally set up in active-standby mode or BGP (Border Gateway Protocol) cluster. The active-standby mode is relatively simple, but the equipment utilization efficiency is low, and only one server provides services at the same time. In the BGP cluster mode, VIP (virtual IP) is not managed by keepalived, but the switch is responsible for allocating the accessed VIP to multiple NAT servers in an equal-cost routing manner. In this way, when the intranet server accesses the external network through the gateway, the traffic will be distributed to multiple NAT devices.

[0004] In the process of implementing the present invention, the inventors found that there are at least the following problems in the prior art:

[0005] Implementing NAT through iptables has problems such as complex configuration, poor flexibility and scalability, and poor search performance due to a large number of iptables rules. Overall, the iptables implementation has obvious performance bottlenecks. In production environments, CPU alarms caused by high traffic volume of a certain business are often encountered. Therefore, how to achieve high-performance network address translation is a problem that needs to be solved. Summary of the invention

[0006] The embodiments of the present invention provide a data forwarding method and system to solve the problems of poor performance and poor flexibility in the existing data forwarding process.

[0007] To achieve the above-mentioned purpose, on the one hand, an embodiment of the present invention provides a data forwarding method, comprising: when a network address translation NAT gateway server receives an outgoing data packet from an intranet to a public network, extracting an outgoing source IP private network address and an outgoing destination IP address from the outgoing data packet; wherein the NAT gateway server is configured with an open virtual switching standard OpenvSwitch software; when it is determined through a preset first flow table that the outgoing source IP private network address needs to be converted to a network address, through a preset network address translation flow table, converting the outgoing source IP private network address to a corresponding outgoing source IP public network address, the network address translation flow table is configured with an IP mapping rule for indicating the correspondence between the private network address and the public network address, and both the first flow table and the network address translation flow table are Open vSwitch flow tables preset in the NAT gateway server; replacing the outgoing source IP private network address in the outgoing data packet with the outgoing source IP public network address; and sending the outgoing data packet with the network address replaced to the outgoing destination IP address.

[0008] On the other hand, an embodiment of the present invention provides a data forwarding system, including: a network address extraction module, which is used to extract an outgoing source IP private network address and an outgoing destination IP address from an outgoing data packet when a network address translation NAT gateway server receives an outgoing data packet from an intranet to a public network; wherein the NAT gateway server is configured with an open virtual switching standard Open vSwitch software; a network address translation module, which is used to convert the outgoing source IP private network address into a corresponding outgoing source IP public network address through a preset network address translation flow table when it is determined through a preset first flow table that the outgoing source IP private network address needs to be translated, the network address translation flow table is configured with an IP mapping rule for indicating the corresponding relationship between the private network address and the public network address, and both the first flow table and the network address translation flow table are Open vSwitch flow tables preset in the NAT gateway server; the outgoing source IP public network address is used to replace the outgoing source IP private network address in the outgoing data packet; and a transmission module is used to send the outgoing data packet with the network address replaced to the outgoing destination IP address.

[0009] At the same time, an embodiment of the present invention further provides a computer-readable storage medium on which a computer program is stored. When the program is executed by a processor, the aforementioned data forwarding method is implemented.

[0010] In addition, an embodiment of the present invention further provides a computer device, which includes: one or more processors; a storage device for storing one or more programs; when the one or more programs are executed by one or more processors, the one or more processors implement the aforementioned data forwarding method.

[0011] The above technical solution has the following beneficial effects:

[0012] In this technical solution, the NAT gateway server is configured with Open vSwitch software and OVS flow table, and the first flow table is used to determine whether the outgoing source IP private network address of the outgoing data packet needs to be converted to a network address. If so, the applicable network address conversion rule is further determined, and the conversion from the internal network address to the public network address is realized through the preset network address conversion flow table, and then the outgoing source IP private network address in the outgoing data packet is replaced with the corresponding outgoing source IP public network address before sending the data. Compared with the NAT gateway server realized by the iptables function in the prior art, the network address conversion process of this technical solution has the outstanding advantage of high performance, and does not have obvious performance bottlenecks like the existing iptables implementation method, and the technical solution has the advantages of simple configuration and scalability, and through the unique OVS flow table and Pipeline design, the network address conversion process is optimized, and the processing delay and overhead of the data packet are reduced. BRIEF DESCRIPTION OF THE DRAWINGS

[0013] In order to more clearly illustrate the embodiments of the present invention or the technical solutions in the prior art, the drawings required for use in the embodiments or the description of the prior art will be briefly introduced below. Obviously, the drawings described below are only some embodiments of the present invention. For ordinary technicians in this field, other drawings can be obtained based on these drawings without paying creative work.

[0014] Figure 1 is a flow chart of a data forwarding method according to an embodiment of the present invention;

[0015] Figure 2 It is a structural framework diagram of a data forwarding system according to an embodiment of the present invention;

[0016] Figure 3 The present invention is a flowchart of a network address translation process for sending a data packet according to a specific embodiment of the present invention. DETAILED DESCRIPTION

[0017] The following will be combined with the drawings in the embodiments of the present invention to clearly and completely describe the technical solutions in the embodiments of the present invention. Obviously, the described embodiments are only part of the embodiments of the present invention, not all of the embodiments. Based on the embodiments of the present invention, all other embodiments obtained by ordinary technicians in this field without creative work are within the scope of protection of the present invention.

[0018] like Figure 1 As shown, an embodiment of the present invention provides a data forwarding method, including:

[0019] S101, when the network address translation NAT gateway server receives an outgoing data packet from the intranet to the public network, extracting an outgoing source IP private network address and an outgoing destination IP address from the outgoing data packet; wherein the NAT gateway server is configured with an open virtual switching standard Open vSwitch software;

[0020] S102, when it is determined through a preset first flow table that the outgoing source IP private network address needs to be converted to a corresponding outgoing source IP public network address through a preset network address conversion flow table, the network address conversion flow table is configured with an IP mapping rule for indicating the correspondence between the private network address and the public network address, the first flow table and the network address conversion flow table are both Open vSwitch (OVS for short) flow tables preset in the NAT gateway server, and the first flow table is configured with IP addresses that need to be converted to a network address;

[0021] S103, using the outgoing source IP public network address to replace the outgoing source IP private network address in the outgoing data packet;

[0022] S104: Send the outgoing data packet with the network address replaced to the outgoing destination IP address.

[0023] Further, the IP mapping rules include NAT (network address translation) rules and EIP (elastic public IP) rules; the network address translation flow table includes a NAT conversion flow table preset with the NAT rules, and an EIP conversion flow table preset with the EIP rules;

[0024] The step S102 includes:

[0025] Determine the IP mapping rule applicable to the outbound source IP private network address through the first flow table;

[0026] When the outgoing source IP private network address conforms to the NAT rule, the NAT conversion flow table is used to convert the outgoing source IP private network address into the corresponding outgoing source IP public network address;

[0027] When the outbound source IP private network address complies with the EIP rule, the EIP conversion flow table is used to convert the outbound source IP private network address into a corresponding outbound source IP public network address.

[0028] Furthermore, after step S104, the method further includes: writing the corresponding outbound source IP private network address, outbound source IP public network address, and outbound destination IP address into the connection tracking table.

[0029] Furthermore, the data forwarding method further includes:

[0030] When the NAT gateway server receives a return data packet from the public network to the intranet, extracting a return source IP address and a return destination IP address from the return data packet;

[0031] Determine the outgoing destination IP address corresponding to the return source IP address;

[0032] Through the connection tracking table, the outbound source IP private network address corresponding to the outbound destination IP address is queried as the outbound original address;

[0033] The return data packet is sent to the outgoing original address.

[0034] Furthermore, before step S101, the method further includes:

[0035] The first flow table and the network address translation flow table are sent to the NAT gateway server in the form of OpenFlow protocol through the controller Controller of the Open vSwitch software configured by the NAT gateway server.

[0036] like Figure 2 As shown, an embodiment of the present invention provides a data forwarding system, including:

[0037] The network address extraction module 21 is used for extracting the outgoing source IP private network address and the outgoing destination IP address from the outgoing data packet when the network address translation NAT gateway server receives the outgoing data packet from the intranet to the public network; wherein the NAT gateway server is configured with the open virtual switching standard Open vSwitch software;

[0038] A network address translation module 22 is used for, when it is determined through a preset first flow table that the outgoing source IP private network address needs to be translated, to translate the outgoing source IP private network address into a corresponding outgoing source IP public network address through a preset network address translation flow table, wherein the network address translation flow table is configured with an IP mapping rule for indicating the correspondence between the private network address and the public network address, and both the first flow table and the network address translation flow table are Open vSwitch flow tables preset in the NAT gateway server; and to replace the outgoing source IP private network address in the outgoing data packet with the outgoing source IP public network address;

[0039] The transmission module 23 is used to send the outgoing data packet with the network address replaced to the outgoing destination IP address.

[0040] Further, the IP mapping rules include NAT rules and EIP rules; the network address conversion flow table includes a NAT conversion flow table preset with the NAT rules, and an EIP conversion flow table preset with the EIP rules;

[0041] The network address translation module 22 is specifically used to: determine the IP mapping rule applicable to the outbound source IP private network address through the first flow table; when the outbound source IP private network address meets the NAT rule, use the NAT conversion flow table to convert the outbound source IP private network address into the corresponding outbound source IP public network address; when the outbound source IP private network address meets the EIP rule, use the EIP conversion flow table to convert the outbound source IP private network address into the corresponding outbound source IP public network address.

[0042] Furthermore, the data forwarding system also includes a connection tracking recording module 24: the connection tracking recording module 24 is used to write the corresponding outbound source IP private network address, the outbound source IP public network address, and the outbound destination IP address into a connection tracking table, and the connection tracking table is used to record the relationship between the outbound source IP private network address, the outbound source IP public network address, and the outbound destination IP address during the outbound process, so that when receiving a data packet returned from the public network, it can be correctly forwarded to the source address.

[0043] Further, the network address extraction module 21 is also used for: when the NAT gateway server receives a return data packet from the public network to the intranet, extracting a return source IP address and a return destination IP address from the return data packet; determining an outgoing destination IP address corresponding to the return source IP address;

[0044] The connection tracking recording module 24 is further used to: query the outbound source IP private network address corresponding to the outbound destination IP address through the connection tracking table as the outbound original address;

[0045] The transmission module 23 is further configured to send the return data packet to the outgoing original address.

[0046] Furthermore, the data forwarding system also includes a configuration module 10, which is used to send the first flow table and the network address translation flow table to the NAT gateway server in the form of OpenFlow protocol through the controller Controller of the OpenvSwitch software configured by the NAT gateway server before the network address translation NAT gateway server receives a data packet sent from the intranet to the public network.

[0047] The above technical solution of the embodiment of the present invention is described in detail below with reference to a specific application example:

[0048] In this specific embodiment, the controller sends a predefined OVS flow table to the NAT gateway server, and designs a set of Figure 3 The pipeline process pipeline shown is used to perform network address translation for outbound (from the intranet to the public network) data. The workflow of the pipeline is as follows:

[0049] Outgoing data packets enter the OVS processing flow through Local input, and the first flow table (i.e. Figure 3 Table 0 in the figure) is classified according to the source IP address information carried by the outgoing data packet, and the packets that hit the EIP rule are redirected to the EIP conversion flow table (i.e. Figure 3 Table 10 in the table performs address translation processing, and jumps to the NAT conversion flow table (i.e. Figure 3 The others that do not require address conversion (for example, a private IP accesses the public IP in the same computer room. Since the data packets will not be routed to the Internet, no conversion is required) are redirected to another flow table Table105 and directly handed over to local processing; after Table10 and Table20 complete the conversion from private IP addresses to public IP addresses, they are handed over to flow table Table30 to change the MAC address for routing forwarding.

[0050] The completion workflow of this specific embodiment is as follows:

[0051] 1) OVS configuration and management: Install and configure Open vSwitch software on the NAT gateway server, and set up a virtual switch (bridge) to handle traffic.

[0052] 2) Distribution of NAT rules and EIP rules: The piping system writes the defined NAT rules and EIP rules, including the mapping relationship between the source IP address and the destination IP address, into the database, and distributes them to the NAT gateway server in the form of an openflow flow table through the controller.

[0053] 3) Packet conversion: When a packet enters the NAT gateway server, OVS replaces the source IP address or destination IP address of the packet according to the corresponding rules based on the flow table pipeline to implement the network address translation function.

[0054] 4) Connection tracking and state management: The NAT gateway server maintains a connection tracking table to record the converted connection information so that the return data packets can be correctly forwarded to the source address.

[0055] 5) Routing processing: The data packets converted by NAT are forwarded according to the routing table to ensure that the data packets reach the destination along the correct path.

[0056] 6) Data packet return: When the host in the public network returns a data packet (also called a return data packet), the NAT gateway server replaces the destination IP address in the return data packet with the IP address in the private network (intranet), which is the private IP address of the original outbound source IP in the original outbound process, and forwards the data packet back to the host that previously sent the data out, that is, the private IP address of the outbound source IP.

[0057] The disclosed embodiments are described above to enable any person skilled in the art to implement or use the present invention. Various modifications of these embodiments are obvious to those skilled in the art, and the general principles defined herein may also be applied to other embodiments without departing from the spirit and scope of the present disclosure. Therefore, the present disclosure is not limited to the embodiments given herein, but is consistent with the broadest scope of the principles and novel features disclosed in this application.

[0058] The specific implementation methods described above further illustrate the objectives, technical solutions and beneficial effects of the present invention in detail. It should be understood that the above description is only a specific implementation method of the present invention and is not intended to limit the scope of protection of the present invention. Any modifications, equivalent substitutions, improvements, etc. made within the spirit and principles of the present invention should be included in the scope of protection of the present invention.

Claims

1. A data forwarding method, characterized in that: include: When the network address translation NAT gateway server receives an outgoing data packet from the intranet to the public network, it extracts the outgoing source IP private network address and the outgoing destination IP address from the outgoing data packet; wherein the NAT gateway server is configured with the open virtual switching standard Open vSwitch software; In the case where it is determined through a preset first flow table that the outgoing source IP private network address needs to be converted to a corresponding outgoing source IP public network address through a preset network address conversion flow table, the network address conversion flow table is configured with an IP mapping rule for indicating the corresponding relationship between the private network address and the public network address, and the first flow table and the network address conversion flow table are both OpenvSwitch flow tables preset in the NAT gateway server; Use the outgoing source IP public network address to replace the outgoing source IP private network address in the outgoing data packet; The outgoing data packet with the network address replaced is sent to the outgoing destination IP address.

2. The data forwarding method according to claim 1, characterized in that: The IP mapping rules include NAT rules and EIP rules; the network address translation flow table includes a NAT conversion flow table configured with the NAT rules, and an EIP conversion flow table configured with the EIP rules; The converting the outbound source IP private network address into the corresponding outbound source IP public network address through a preset network address translation flow table includes: Determine the IP mapping rule applicable to the outbound source IP private network address through the first flow table; When the outgoing source IP private network address conforms to the NAT rule, the NAT conversion flow table is used to convert the outgoing source IP private network address into the corresponding outgoing source IP public network address; When the outbound source IP private network address complies with the EIP rule, the EIP conversion flow table is used to convert the outbound source IP private network address into a corresponding outbound source IP public network address.

3. The data forwarding method according to claim 2, characterized in that: After sending the outgoing data packet with the network address replaced to the outgoing destination IP address, the method further includes: writing the corresponding outgoing source IP private network address, outgoing source IP public network address, and outgoing destination IP address into a connection tracking table.

4. The data forwarding method according to claim 3, characterized in that: The method further comprises: When the NAT gateway server receives a return data packet from the public network to the intranet, extracting a return source IP address and a return destination IP address from the return data packet; Determine the outgoing destination IP address corresponding to the return source IP address; Through the connection tracking table, the outbound source IP private network address corresponding to the outbound destination IP address is queried as the outbound original address; The return data packet is sent to the outgoing original address.

5. The data forwarding method according to claim 1, characterized in that: Before the NAT gateway server receives an outgoing data packet from the intranet to the public network, the method further includes: The first flow table and the network address translation flow table are sent to the NAT gateway server in the form of OpenFlow protocol through the controller Controller of the Open vSwitch software configured by the NAT gateway server.

6. A data forwarding system, characterized in that: include: A network address extraction module is used to extract an outgoing source IP private network address and an outgoing destination IP address from an outgoing data packet when a network address translation NAT gateway server receives an outgoing data packet from an intranet to a public network; wherein the NAT gateway server is configured with an open virtual switching standard Open vSwitch software; A network address translation module, for, when it is determined through a preset first flow table that the outgoing source IP private network address needs to be translated, converting the outgoing source IP private network address into a corresponding outgoing source IP public network address through a preset network address translation flow table, wherein the network address translation flow table is configured with an IP mapping rule for indicating the correspondence between the private network address and the public network address, and both the first flow table and the network address translation flow table are Open vSwitch flow tables preset in the NAT gateway server; and, replacing the outgoing source IP private network address in the outgoing data packet with the outgoing source IP public network address; The transmission module is used to send the outgoing data packet with the network address replaced to the outgoing destination IP address.

7. The data forwarding system according to claim 6, characterized in that: The IP mapping rules include NAT rules and EIP rules; the network address conversion flow table includes a NAT conversion flow table pre-set with the NAT rules, and an EIP conversion flow table pre-set with the EIP rules; The network address translation module is specifically used to: determine the IP mapping rule applicable to the outbound source IP private network address through the first flow table; when the outbound source IP private network address meets the NAT rule, use the NAT conversion flow table to convert the outbound source IP private network address into the corresponding outbound source IP public network address; when the outbound source IP private network address meets the EIP rule, use the EIP conversion flow table to convert the outbound source IP private network address into the corresponding outbound source IP public network address.

8. The data forwarding system according to claim 6, characterized in that: Also includes a configuration module, where: The configuration module is used to send the first flow table and the network address translation flow table to the NAT gateway server in the form of OpenFlow protocol through the controller Controller of the Open vSwitch software configured by the NAT gateway server before the network address translation NAT gateway server receives a data packet sent from the intranet to the public network.

9. A computer-readable storage medium having a computer program stored thereon, characterized in that: When the program is executed by a processor, the data forwarding method as described in any one of claims 1 to 5 is implemented.

10. A computer device, characterized in that: It includes: one or more processors; A storage device for storing one or more programs; When the one or more programs are executed by the one or more processors, the one or more processors implement the data forwarding method according to any one of claims 1 to 5.

Images