VPN network address translation method and device

Abstract

The invention relates to the technical field of network communication, and provides a VPN (Virtual Private Network) network address translation method and device. In the invention, an access gateway searches a corresponding VPWS tunnel according to local area network side VNI and QinQ information of a user terminal message; the VPWS tunnel transmits the user terminal message to a service gateway; the service gateway allocates corresponding address conversion information to the QinQ information; and the service gateway converts the source IP address of the user terminal message into a public IP address according to the address conversion information, so that the public IP address is conveniently used for accessing the Internet, and the problem that the network performance of data communication by adopting a VPN tunnel establishment mode is poor due to the fact that a traditional VPN tunnel technology is not suitable for an FTTR environment is solved.

Description

Technical Field

[0001] The present invention relates to the technical field of network communication, and in particular to a VPN network address translation method and device. Background Art

[0002] Currently, Virtual Private Network (VPN) and Network Address Translation (NAT) technologies are widely used in various network scenarios to deal with the shortage of Internet Protocol Address (IP address) and network security issues. VPN is used to establish a private network on a public network for encrypted communication. NAT is used to use private addresses in a local network and use global IP addresses when connecting to the Internet. By mapping internal private IP addresses to external global IP addresses, multiple terminal devices can share a public IP address. If secure data communication is required between two places that are physically far apart, a VPN tunnel can be established between the two to achieve data sharing within the VPN.

[0003] Traditional VPN tunnel technology is usually designed for relatively few, fixed network connections. For example, in a campus network scenario, multiple users in the same dormitory often share the same optical modem (i.e., optical modem), that is, the QinQ information of each user terminal in the dormitory using the campus network is the same. When establishing a VPN tunnel for data communication, in the past, due to the operator's restriction that a campus network account only supports two user terminals, the maximum number of user terminals that can be supported under one QinQ information does not exceed 64, so the number of IP addresses required for VPN is relatively small, that is, the NAT pool does not need to be large to meet the Internet access needs of a school.

[0004] However, now each user is likely to have more than two user terminals. In order to meet the actual needs of users, a campus network account needs to support multiple user terminals. In this large-scale fiber to the room (Fiber to the Room, abbreviated as FTTR) environment, a large number of users and / or user terminals are connected under the same QinQ, and the maximum number of user terminals that can be supported under one QinQ information is large. At this time, there will be a large number of concurrent network connections, and the amount of data transmission in the network is often very large. Among them, FTTR refers to extending the optical fiber from the communication base station to every corner of the room, thereby providing extremely high-speed Internet access services for indoor users. Since the data transmission speed is often limited when processing a large amount of data transmission, and at this time the VPN tunnel also needs to occupy certain network resources and computing resources, the VPN tunnel is very likely to become a bottleneck of network performance, limiting the data transmission speed, resulting in increased network delay and reduced throughput. In the FTTR environment, the use of traditional VPN tunnel technology for data communication is less practical.

[0005] In view of this, overcoming the defects of the prior art is an urgent problem to be solved in the field of this technology. Summary of the invention

[0006] The technical problem to be solved by the present invention is to provide a VPN network address translation method and device, the purpose of which is that the access gateway forwards the user terminal message to the service gateway through the corresponding VPWS tunnel according to the LAN side VNI and QinQ information of the user terminal message, the service gateway allocates corresponding address translation information for the QinQ information, and converts the source IP address of the user terminal message into a public IP address, so as to support the allocation of the IP address required by VPN according to the QinQ information, and solves the problem that the traditional VPN tunnel technology is not suitable for the FTTR environment, resulting in poor network performance of data communication using the VPN tunnel.

[0007] The present invention adopts the following technical solution:

[0008] In a first aspect, the present invention provides a VPN network address translation method, wherein there is at least one VPWS tunnel between an access gateway and a service gateway;

[0009] The VPN network address translation method comprises:

[0010] The access gateway finds the corresponding VPWS tunnel according to the LAN side VNI and QinQ information of the user terminal message; the VPWS tunnel transmits the user terminal message to the service gateway;

[0011] The service gateway allocates corresponding address conversion information to the QinQ information;

[0012] The service gateway converts the source IP address of the user terminal message into a public IP address according to the address conversion information, so as to access the Internet using the public IP address.

[0013] Further, the address translation information includes a public IP address and a corresponding port range;

[0014] The service gateway allocates corresponding address conversion information to the QinQ information, including:

[0015] According to the maximum number of concurrent connections of each campus network account during peak hours, the maximum number of accounts that can be assigned to a public IP address in the VPN is obtained;

[0016] Based on the maximum number of accounts of each campus network link and the maximum number of allocatable accounts, obtaining the required number of public IP addresses;

[0017] Obtaining the VPN corresponding to the VPWS tunnel; wherein one VPWS tunnel corresponds to one VPN;

[0018] According to the currently available public IP address segment, a public IP address and a corresponding port range are allocated to the VPN.

[0019] Further, the service gateway converts the source IP address of the user terminal message into a public IP address according to the address conversion information, comprising:

[0020] The service gateway modifies the source MAC address of the user terminal message into the corresponding sub-interface MAC address to obtain the first target message;

[0021] The first target message is forwarded from the designated sub-interface of the VPN to the public IP address.

[0022] Further, when MAC tracing is required, after the service gateway assigns corresponding address conversion information to the QinQ information, it also includes:

[0023] The service gateway forwards the user terminal message to the corresponding VPN;

[0024] When the user terminal message passes through the NAT device, the NAT device converts the source IP address into the public IP address; wherein the NAT device is located inside the VPN;

[0025] The source MAC address of the user terminal message remains unchanged to obtain a second target message, so as to forward the second target message from the designated sub-interface of the VPN to the public IP address.

[0026] Furthermore, when IP tracing and MAC tracing are required, after the service gateway assigns corresponding address conversion information to the QinQ information, it also includes:

[0027] The service gateway keeps the source MAC address of the user terminal message unchanged to obtain a third target message, so as to forward the third target message from the designated sub-interface of the VPN to the public IP address;

[0028] The service gateway establishes a forwarding table for the VPN; wherein the forwarding table is used to maintain a mapping relationship between a source MAC address and a public IP address, where one source MAC address corresponds to one public IP address:

[0029] The service gateway establishes a forwarding mapping relationship between the source MAC address in the third target message and the public IP address, and updates the forwarding mapping relationship to the forwarding table.

[0030] Further, after forwarding the third target message from the designated sub-interface of the VPN to the public IP address, the method further includes:

[0031] The service gateway receives the original return message from the public IP address;

[0032] The service gateway searches the forwarding table for the source MAC address corresponding to the public IP address according to the forwarding mapping relationship;

[0033] The service gateway modifies the public IP address in the original return message to the source IP address to obtain a target return message;

[0034] The service gateway forwards the target return message to the internal network device corresponding to the source IP address.

[0035] Further, when the data traffic in the VPN exceeds the VPN traffic threshold, the service gateway limits the data traffic transmitted from the designated cloud service to the internal network to within the application traffic threshold;

[0036] and / or, the service gateway limits the data traffic from the specified user account to within a user traffic threshold range;

[0037] And / or, the service gateway limits the data traffic from the designated user terminal to within a terminal traffic threshold range.

[0038] Furthermore, the service gateway collects VPN traffic information and stores the VPN traffic information to a designated FTP server to facilitate audit analysis of the VPN traffic information; wherein the VPN traffic information is data traffic information transmitted through the VPN, and the VPN traffic information is reported by the VPN to the operator.

[0039] In a second aspect, the present invention further provides a VPN network address translation device, comprising:

[0040] At least one processor; and a memory in communication with the at least one processor; wherein the memory stores instructions executable by the at least one processor, and the instructions are executed by the processor to execute the VPN network address translation method described in the first aspect.

[0041] In a third aspect, the present invention further provides a non-volatile computer storage medium, wherein the computer storage medium stores computer executable instructions, and the computer executable instructions are executed by one or more processors to complete the VPN network address translation method described in the first aspect.

[0042] In a fourth aspect, a computer program product comprising instructions is provided. When the instructions are executed on a computer or a processor, the computer or the processor executes the VPN network address translation method as described in the first aspect to the third aspect and any one of the above.

[0043] In a fifth aspect, the present invention further provides a VPN network address translation system, comprising the VPN network address translation device as in the second aspect, and using the VPN network address translation method as in the first aspect to complete the interaction of the VPN network address translation device of the second aspect.

[0044] Different from the prior art, the present invention has at least the following beneficial effects:

[0045] The access gateway of the present invention determines the corresponding VPWS tunnel according to the LAN side VNI and QinQ information of the user terminal message, and forwards the user terminal message to the service gateway through the VPWS tunnel; the service gateway allocates corresponding address conversion information for the QinQ information, converts the source IP address of the user terminal message into a public IP address, and uses the public IP address to access the Internet; in the scenario where the user terminal message needs to be transmitted from the LAN to the Internet, it supports the allocation of the IP address required by the VPN according to the QinQ information, while meeting the use requirements of multiple user terminals under the same QinQ information, avoiding the waste of IP address resources as much as possible, thereby solving the problem that the traditional VPN tunnel technology is not suitable for the FTTR environment, resulting in poor network performance of data communication using the VPN tunnel. BRIEF DESCRIPTION OF THE DRAWINGS

[0046] In order to more clearly illustrate the technical solutions of the embodiments of the present invention, the following briefly introduces the drawings required for use in the embodiments of the present invention. Obviously, the drawings described below are only some embodiments of the present invention, and for ordinary technicians in this field, other drawings can be obtained based on these drawings without creative work.

[0047] Figure 1 It is a structural diagram of a specific example of gateway connection in a campus network scenario provided by an embodiment of the present invention;

[0048] Figure 2 It is a flowchart of a first VPN network address translation method provided by an embodiment of the present invention;

[0049] Figure 3 is a schematic diagram of a specific example of using tunnel technology provided by an embodiment of the present invention;

[0050] Figure 4 It is a schematic diagram of a specific example of forming a virtual private network provided by an embodiment of the present invention;

[0051] Figure 5 It is a schematic diagram of a specific example of address conversion between a private network and the Internet provided by an embodiment of the present invention;

[0052] Figure 6 is a flow chart of step 20 provided in an embodiment of the present invention;

[0053] Figure 7 is a flow chart of step 30 provided in an embodiment of the present invention;

[0054] Figure 8 It is a flow chart of a second VPN network address translation method provided by an embodiment of the present invention;

[0055] Fig. 9 It is a flow chart of a third VPN network address translation method provided by an embodiment of the present invention;

[0056] Fig.10 It is a flowchart of a fourth VPN network address translation method provided by an embodiment of the present invention;

[0057] Fig.11 The present invention provides a VPN network address translation device. DETAILED DESCRIPTION

[0058] In order to make the purpose, technical solution and advantages of the present invention more clearly understood, the present invention is further described in detail below in conjunction with the accompanying drawings and embodiments. It should be understood that the specific embodiments described herein are only used to explain the present invention and are not intended to limit the present invention.

[0059] Unless the context requires otherwise, throughout the specification and claims, the term "including" is to be interpreted as open inclusion, that is, "including, but not limited to". In the description of the specification, the terms "one embodiment", "some embodiments", "exemplary embodiments", "examples", "specific examples" or "some examples" and the like are intended to indicate that specific features, structures, materials or characteristics associated with the embodiment or example are included in at least one embodiment or example of the present disclosure. The schematic representation of the above terms does not necessarily refer to the same embodiment or example. In addition, the specific features, structures, materials or characteristics may be included in any one or more embodiments or examples in any appropriate manner, that is, although they may be carried in the embodiments or examples of the above terms due to reasons such as the order and position of appearance, it is not limited to that they can be carried in combination by one embodiment or example.

[0060] In the description of the present invention, it is necessary to understand that the terms "center", "up", "down", "front", "back", "left", "right", "vertical", "horizontal", "top", "bottom", "inside", "outside", etc., indicating orientations or positional relationships, are based on the orientations or positional relationships shown in the accompanying drawings, and are only for the convenience of describing the present disclosure and simplifying the description, and do not indicate or imply that the device or element referred to must have a specific orientation, be constructed and operated in a specific orientation, and therefore should not be understood as a limitation on the present disclosure.

[0061] In the description of the present invention, the terms "first" and "second" are used only for descriptive purposes, and cannot be understood as indicating or implying relative importance or implicitly indicating the number of indicated technical features. Thus, the features defined as "first" and "second" may explicitly or implicitly include one or more of the features. In the description of the embodiments of the present disclosure, unless otherwise specified, the meaning of "multiple" is two or more. In addition, for example, the same type of nouns may be described as two independent individuals by adding "A" and "B" at the end. In this case, the corresponding features defined as "A" and "B" are only used to distinguish the same type of individuals for description purposes, and cannot be understood as indicating or implying relative importance or implicitly indicating the number of indicated technical features.

[0062] When describing some embodiments, the expressions "coupling", "coupling" and "connection" and their derivatives may be used. For example, when describing some embodiments, the term "connection" may be used to indicate that two or more components are in direct physical or electrical contact with each other. For another example, when describing some embodiments, the term "coupling" may be used to indicate that two or more components are in direct physical or electrical contact. However, the terms "connection" or "coupling" may also refer to two or more components that are not in direct contact with each other, but still cooperate or interact with each other, such as "optical path coupling", "wireless connection", etc. The embodiments disclosed herein are not necessarily limited to the contents of the present invention.

[0063] In the description of the present invention, the expression "A and / or B" (where A and B are used to formally represent specific characteristic contents) will be involved, and the corresponding expressions include the following three combinations: only A, only B, and a combination of A and B.

[0064] As used herein, "about," "substantially," or "approximately" includes the stated value and an average value that is within an acceptable range of deviation from the particular value as determined by one of ordinary skill in the art taking into account the measurements in question and the errors associated with the measurement of the particular quantity (i.e., the limitations of the measurement system).

[0065] Embodiment 1:

[0066] In order to solve the above problems, an embodiment of the present invention provides a VPN network address translation method. In order to better illustrate the VPN network address translation method of the embodiment of the present invention, the network structure of the embodiment of the present invention is first introduced below:

[0067] like Figure 1 The figure shows a specific example of gateway connection in a campus network scenario. The access gateway is the access server, which is responsible for accessing the Internet and is the first node server for all user traffic to flow into; the service gateway is the server through which the east-west mobile edge computing (MEC) service flows. The east-west MEC service refers to the data exchange and communication between MEC nodes within one or more data centers.

[0068] Among them, there are multiple network devices between the user terminal and the access gateway ( Figure 1(not shown); in one embodiment, the multiple network devices between the user terminal and the access gateway may be: the user terminal is connected to the optical network unit (Optical Network Unit, abbreviated as ONU); the ONU is connected to the optical cable terminal (Optical Line Terminal, abbreviated as OLT); the OLT is connected to the data center switch (Data Center Switches, abbreviated as DCSW); the DCSW is connected to the access gateway through the virtual extended local area network (Virtual Extensible Local Area Network, abbreviated as VXLAN); the OLT and DCSW are used to forward user traffic (i.e., user terminal messages) to the access gateway. Among them, the user traffic processed by the OLT carries QinQ information. After the user traffic processed by the OLT enters the DCSW, the DCSW encapsulates the VXLAN header for the corresponding message. The VXLAN header includes a VXLAN network identifier (VXLAN Network Identifie, abbreviated as VNI), and the VNI is used to identify different virtual networks in the VXLAN network. The QinQ information and VNI constitute the identification information of the user traffic.

[0069] Among them, QinQ is a layer 2 VPN technology, which encapsulates the user's private network message with an outer virtual local area network (VLAN) tag on the operator's edge network device, so that the message containing QinQ information carries two layers of VLAN tags to pass through the operator's backbone network (i.e., the Internet); wherein, QinQ information includes an inner VLAN Tag (representing the user's local area network VLAN) and an outer VLAN Tag (representing the Internet VLAN assigned to the user by the operator). The network equipment in the Internet only forwards the message according to the outer VLAN tag, and learns the source media access control (MAC) address table of the message into the MAC address table of the VLAN where the outer tag is located, and the user's local area network VLAN tag will be used as the data part of the message for transmission during the transmission process. When the user terminal wants to access the Internet, it will send a message to the access gateway; after receiving the message from the user terminal, the access gateway will forward the received message to the service gateway according to the QinQ information and VNI, and cooperate with other related network devices to complete the forwarding and routing of the message, and finally achieve access to the Internet. Among them, other related network devices are determined by the specific network configuration. Figure 1Not shown in the figure, for example, a broadband access server (Broadband Remote Access Server, abbreviated as BRAS) device, etc., the access gateway implements dial-up Internet access through the BRAS device.

[0070] like Figure 2 Specifically, the VPN network address translation method includes:

[0071] Step 10: The access gateway searches for the corresponding VPWS tunnel according to the LAN-side VNI and QinQ information of the user terminal message; the VPWS tunnel transmits the user terminal message to the service gateway.

[0072] When a user terminal message arrives at the access gateway, the access gateway first checks the destination Internet Protocol (IP) address carried by the user terminal message, and searches for a corresponding service configuration (i.e., a specific forwarding path for the destination IP address) based on the destination IP address, and then forwards the user terminal message according to the specific forwarding path found.

[0073] The data transmission method is described below in conjunction with the applicable scenarios of the embodiments of the present invention:

[0074] like Figure 3 As shown in the figure, location A and location B are two branches that are physically far away, and it is hoped that secure data communication can be carried out between the two locations. A VPN tunnel is established between location A and location B, so that the user terminal message X from location A can be encrypted and processed to obtain the target message Y, which is securely transmitted to location B based on the VPN tunnel, thereby realizing data sharing within the VPN.

[0075] like Figure 4 As shown, there is at least one VPWS tunnel between the access gateway and the service gateway. The edge services of the campus network all establish a virtual private wire service (Virtual Private Wire Service, abbreviated as VPWS) tunnel between the access gateway and the service gateway, and then distinguish the service type through VPN isolation, so as to realize mutual access from user terminals to edge MEC services.

[0076] Based on the above data transmission mode, the access gateway of the embodiment of the present invention searches for the service route according to the LAN side VNI and QinQ information in the user terminal message; if the service route search is successful, the message will be forwarded to the service gateway. Among them, the selected service route points to a specific VPWS tunnel and outbound interface; the service route routes the user terminal's request to a pre-configured Ethernet Virtual Private Network (EVPN) service instance, so as to use the EVPN instance for data transmission.

[0077] In one embodiment, a combination of LAN-side VNI, QinQ information, and the service name of the service route can be used to find an outbound interface, which is used to forward the user terminal message into the corresponding VPWS tunnel. The LAN-side VNI and QinQ information carried by the user terminal message are identification information of the user terminal message (i.e., user traffic). According to the LAN-side VNI and QinQ information, a matching service name is found in the VLAN configuration; the service name corresponds to a specific VPN, and the message forwarding path of the specific VPN is obtained; according to the forwarding path, the outbound interface entering the VPWS tunnel from the access gateway is determined.

[0078] Step 20: The service gateway allocates corresponding address translation information to the QinQ information.

[0079] The service gateway allocates NAT information (i.e., address translation information) in the VPN to the QinQ information according to the binding relationship between the VPWS tunnel and the VPN. The address translation information is used to convert IP addresses between the internal network (i.e., LAN) and the external network (i.e., the Internet).

[0080] In an embodiment of the present invention, the service gateway sends down the configuration information related to the VPN; in a campus network scenario, when a certain campus needs to deploy FTTR networking, a large NAT address pool needs to be used after the network environment changes, and it is necessary to pre-configure and select the NAT function of the large NAT address pool on the VPN, so that when the user terminal message is received, it can be processed according to the operating steps in Example 1 of the present invention; among them, generally speaking, for campuses that do not need to perform Internet behavior analysis, the allocation strategy of the NAT address pool is selected according to QINQ allocation, that is, the address conversion information is allocated using the operating steps in Example 1 of the present invention.

[0081] Since user terminals in a local area network usually use private IP addresses (for example, 192.168.xx or 10.xxx), these private IP addresses are not unique globally and cannot be directly routed to the Internet. NAT is used to convert internal IP addresses in a private network into public IP addresses (i.e., NATIP), and use public IP addresses to forward user terminal messages to achieve communication with the external network; NAT converts private IP addresses (i.e., internal IP addresses) in a local area network into globally usable public IP addresses (i.e., external IP addresses) when communicating with the outside world, thereby achieving the sharing of Internet connections by multiple internal devices under limited public IP address resources.

[0082] like Figure 5 As shown in FIG. 1 , a private network is a network dedicated to some departments with high confidentiality requirements, such as an internal LAN of an enterprise; in the address architecture of the Internet, a private network refers to a LAN using a private IP address. In an embodiment of the present invention, a service gateway (e.g., Figure 5 The network device with the address 210.24.46.5 in the figure is a NAT device. The NAT device is a bridge for data communication between the local area network and the Internet. A NAT device has one or more Internet public IP addresses. These public IP addresses can be reused and do not belong to a certain user or a certain user terminal. When a user terminal in the local area network wants to access the Internet, the NAT device will select one from multiple public IP addresses and assign it to the user terminal, and record the corresponding relationship between the public IP address and the private IP address at this time, and also record other information such as the corresponding port; in one embodiment, the above correspondence can be recorded in Figure 5 When receiving the return response (ie, return message) of the user terminal message, the NAT device forwards the return message to the private IP address according to the recorded corresponding relationship.

[0083] Step 30: The service gateway converts the source IP address of the user terminal message into a public IP address according to the address conversion information, so as to access the Internet using the public IP address.

[0084] Among them, the source IP address is an internal IP address that can only be used in the local area network; the public IP address, namely NATIP, is an external IP address that can be used on the Internet.

[0085] The access gateway of the present invention determines the corresponding VPWS tunnel according to the LAN side VNI and QinQ information of the user terminal message, and forwards the user terminal message to the service gateway through the VPWS tunnel; the service gateway allocates corresponding address conversion information for the QinQ information, converts the source IP address of the user terminal message into a public IP address, and uses the public IP address to access the Internet; in the scenario where the user terminal message needs to be transmitted from the LAN to the Internet, it supports the allocation of the IP address required by the VPN according to the QinQ information, while meeting the use requirements of multiple user terminals under the same QinQ information, avoiding the waste of IP address resources as much as possible, thereby solving the problem that the traditional VPN tunnel technology is not suitable for the FTTR environment, resulting in poor network performance of data communication using the VPN tunnel.

[0086] To illustrate the process of allocating address translation information, Figure 6 As shown, the step 20 includes:

[0087] Step 201: According to the maximum number of concurrent connections of each campus network account during the peak period, the maximum number of accounts that can be allocated to a public IP address in the VPN is obtained.

[0088] When user terminals access the network through VPN, public IP addresses are allocated to these user terminals or accounts; the number and allocation method of public IP addresses will directly affect the scalability, performance and security of the network.

[0089] Each user terminal or user account may establish multiple data streams during the peak period of network traffic, and the number of established data streams is the maximum number of concurrent connections; for example, 1000 data streams are established. In one embodiment, the maximum number of concurrent connections can be an empirical value obtained from the existing network (i.e., the communication network currently in operation).

[0090] In a communication network, a port is a data transmission channel used to distinguish different services or applications. Each port number is a 16-bit number ranging from 0 to 65535, with a total of 65536 ports, and 65535 is used as the maximum number of available ports. In order to simplify the calculation, the embodiment of the present invention approximately equals the first 1024 port numbers to 1000 port numbers, which are reserved values ​​and are not allocated, so the 1000 port numbers need to be subtracted from the maximum number of available ports; then the maximum number of accounts that can be allocated to a public IP address (i.e., the maximum number of allocable accounts) is: ((65535-1000)%1000)=64.

[0091] Step 202: Based on the maximum number of accounts of each campus network link and the maximum number of allocatable accounts, the required number of public IP addresses is obtained.

[0092] The maximum number of accounts is the maximum number of accounts that can be accommodated by a campus network link. In one embodiment, the maximum number of accounts can be 5,000.

[0093] For example, the QinQ information needs to configure (5000%64+1)=79 public IP addresses.

[0094] Step 203: Obtain the VPN corresponding to the VPWS tunnel; wherein one VPWS tunnel corresponds to one VPN.

[0095] The service gateway searches for the VPN bound to the VPWS tunnel based on the identifier of the VPWS tunnel to ensure that the NAT allocation is performed for a specific VPN.

[0096] Step 204: Allocate a public IP address and a corresponding port range to the VPN according to the currently available public IP address segment.

[0097] The address translation information includes the public IP address and the corresponding port range; the public IP address is the address accessible by the Internet, and the port number is used to distinguish different VPNs.

[0098] When the number of accounts under the same QinQ information exceeds the maximum number of allocatable accounts (for example, 64), it is necessary to move to the next IP allocation port_range; when performing NAT, multiple public IP addresses will be divided into several segments with a step length of 2000, for example: "[1025,3024]" and "[3025,5024]".

[0099] For example, when the calculated number of public IP addresses is 79, there are 5000 port_ranges in total.

[0100] In one embodiment, the NAPT method is used for network address translation. During the NAT process, in addition to converting the source IP address of the user terminal message into a public IP address, the source port needs to be modified to the port after NAT (i.e., NATPort), that is, the port number of the user terminal message is converted through the NAT device to ensure that the user terminal message can be forwarded correctly.

[0101] After NAT, such as Figure 7 As shown, the step 30 then includes:

[0102] Step 301: The service gateway modifies the source MAC address of the user terminal message to the corresponding sub-interface MAC address to obtain a first target message.

[0103] The corresponding sub-interface MAC address refers to a virtual or physical sub-interface on a service gateway associated with a specific service, and these sub-interfaces are used to connect to different networks or provide different services. In order to ensure that the user terminal message can be correctly identified and processed in subsequent network transmission, the embodiment of the present invention modifies the source MAC address to the sub-interface MAC address.

[0104] Step 302: Forward the first target message from the designated sub-interface of the VPN to the public IP address.

[0105] The first target message after NAT processing will be sent out from the designated sub-interface of the VPN; wherein the designated sub-interface is a virtual interface in the VPN network, which is used to implement routing and communication between different VPNs.

[0106] When the return message arrives at the NAT device, the NAT device will search the corresponding record in the NAPT translation table according to the destination IP address and port number of the return message, so as to convert the public IP address back to the source IP address according to the NAPT table, that is, the return normally performs the destination address translation (Destination Network Address Translation, abbreviated as DNAT), which will not be described here. Among them, the return message is the message returned from the Internet (that is, the public IP address) to the internal network.

[0107] On this basis, in the campus network scenario, when the data flow of a campus internal network in the VPN is too large, it is necessary to limit the speed of the campus internal network. The business gateway sends down the configuration information related to the speed limit function to enable the speed limit function for a specific VPN service. The business gateway limits the speed according to different granularities, and the different granularities can be service downlink, single user uplink, and single terminal uplink. Specifically, for the service downlink speed limit, when the data flow in the VPN exceeds the VPN flow threshold, the business gateway will limit the data flow transmitted from the specified cloud service to the internal network within the application flow threshold.

[0108] The VPN traffic threshold and the application traffic threshold are selected by those skilled in the art according to specific usage scenarios and are not limited here.

[0109] And / or, for the uplink speed limit of a single user, the service gateway may limit the data flow from the specified user account within the user flow threshold range. The user flow threshold is selected by those skilled in the art according to the specific usage scenario and is not limited here.

[0110] And / or, for the uplink speed limit of a single terminal, the service gateway may limit the data flow from the designated user terminal to within a terminal flow threshold range. The terminal flow threshold is selected by those skilled in the art according to a specific usage scenario and is not limited here.

[0111] In a campus network scenario, when a campus needs to audit the Internet access records of campus network accounts accessing the campus and beyond, it is necessary to enable the intranet audit function on the VPN; after enabling it, support for reporting and auditing internal network traffic can be achieved in the following manner, that is, traffic analysis and reporting of specific VPN services; the service gateway collects VPN traffic information and stores the VPN traffic information to a designated FTP server to facilitate audit analysis of the VPN traffic information; wherein the VPN traffic information is data traffic information transmitted through the VPN, and the VPN traffic information is reported by the VPN to the operator.

[0112] The VPN traffic information is the traffic information of user terminal messages from a certain user terminal forwarded through a specific VPN. After the VPN traffic information is reported to the operator by the VPN, the service gateway collects the VPN traffic information from the service provided by the operator.

[0113] In one embodiment, the service gateway periodically collects VPN traffic information and reports it to a designated File Transfer Protocol (FTP) server for storage via Kafka for further audit analysis; Kafka is a high-throughput distributed publish-subscribe messaging system; the way in which the operator conducts audit analysis is selected by those skilled in the art based on the specific usage scenario and is not limited here.

[0114] Embodiment 2:

[0115] On the basis of Example 1 of the present invention, Figure 8 As shown, when MAC tracing is required, after step 20, the following steps are further included:

[0116] Step 401: The service gateway forwards the user terminal message to the corresponding VPN.

[0117] It should be noted that in a campus network scenario, when a campus needs to perform MAC tracing on a user terminal, it is necessary to enable the MAC tracing function on the VPN in advance, and the service gateway sends configuration information related to MAC tracing on the VPN.

[0118] Step 402: When the user terminal message passes through the NAT device, the NAT device converts the source IP address into the public IP address; wherein the NAT device is located inside the VPN.

[0119] During the NAT process, in addition to converting the source IP address of the user terminal message to a public IP address, the source port also needs to be modified to the port after NAT, that is, the port number of the user terminal message is converted by the NAT device to ensure that the user terminal message can be forwarded correctly.

[0120] Step 403: Keep the source MAC address of the user terminal message unchanged to obtain a second target message, so as to forward the second target message from the designated sub-interface of the VPN to the public IP address.

[0121] In order to facilitate the operator to find the MAC address (ie, perform MAC tracing), except that the source MAC address remains unchanged, other operations are the same as those in Example 1 and will not be repeated here.

[0122] The embodiment of the present invention can also support VPN speed limiting and support intranet traffic reporting auditing. The implementation method is the same as that in Embodiment 1 of the present invention, and will not be repeated here.

[0123] Embodiment 3:

[0124] On the basis of Example 1 of the present invention, Fig. 9 As shown, when IP tracing and MAC tracing are required, after the service gateway assigns corresponding address conversion information to the QinQ information, it also includes:

[0125] Step 501: The service gateway keeps the source MAC address of the user terminal message unchanged and obtains a third target message, so as to forward the third target message from the designated sub-interface of the VPN to the public IP address.

[0126] It should be noted that in a campus network scenario, when a campus needs to perform MAC tracing on a user terminal, it is necessary to enable the MAC tracing function on the VPN in advance, and the service gateway sends configuration information related to MAC tracing on the VPN.

[0127] Step 502: The service gateway establishes a forwarding table for the VPN; wherein the forwarding table is used to maintain a mapping relationship between a source MAC address and a public IP address, where one source MAC address corresponds to one public IP address.

[0128] In a campus network scenario, when a campus needs to perform IP tracing, it is necessary to allocate a VPN address pool by MAC. Specifically: In order to facilitate operators to find IP addresses and MAC addresses (that is, perform IP tracing and MAC tracing), it is necessary to create a forwarding table to record the mapping relationship between the source MAC address and the public IP address. Each source MAC address occupies an exclusive public IP address.

[0129] Step 503: The service gateway establishes a forwarding mapping relationship between the source MAC address in the third target message and the public IP address, and updates the forwarding mapping relationship to the forwarding table.

[0130] The forwarding mapping relationship ensures that the user terminal message can be correctly converted and routed when passing through NAT.

[0131] Among them, when MAC tracing is required, the service gateway converts the source IP address of the user terminal message into a public IP address according to the address conversion information, and keeps the source MAC address of the user terminal message unchanged; directly encapsulates the public IP address and the MAC address of the user terminal that sends the user terminal message (i.e., the source MAC address) into the second target message.

[0132] In another optional embodiment, when MAC tracing is not required, after the source IP address of the user terminal message is converted into a public IP address, the service gateway modifies the source MAC address of the user terminal message to the corresponding sub-interface MAC address, and encapsulates the public IP address and the sub-interface MAC address into the first target message, as in step 301 in Example 1 of the present invention.

[0133] Then, if Fig.10 As shown, after forwarding the third target message from the designated sub-interface of the VPN to the public IP address, the method includes:

[0134] Step 601: The service gateway receives an original return message from the public IP address.

[0135] Step 602: The service gateway searches the forwarding table for a source MAC address corresponding to the public IP address according to the forwarding mapping relationship.

[0136] Step 603: The service gateway modifies the public IP address in the original return message to the source IP address to obtain a target return message.

[0137] During the DNAT process, in addition to converting the public IP address of the user terminal message into the source IP address, the port after NAT needs to be modified to the source port to ensure that the return message can be forwarded correctly.

[0138] Step 604: The service gateway forwards the target return message to the internal network device corresponding to the source IP address.

[0139] This embodiment can also support VPN speed limiting and support intranet traffic reporting auditing. The implementation method is the same as that in Example 1 of the present invention and will not be repeated here.

[0140] Embodiment 4:

[0141] like Fig.11 , which is a schematic diagram of the architecture of a VPN network address translation device according to an embodiment of the present invention. The VPN network address translation device according to this embodiment includes one or more processors 21 and a memory 22. Fig.11 A processor 21 is taken as an example.

[0142] The processor 21 and the memory 22 may be connected via a bus or other means. Fig.11 The example of connecting through bus is taken in the following.

[0143] The memory 22 is a non-volatile computer-readable storage medium that can be used to store non-volatile software programs and non-volatile computer executable programs, such as the VPN network address translation method in this embodiment. The processor 21 executes the VPN network address translation method by running the non-volatile software programs and instructions stored in the memory 22.

[0144] The memory 22 may include a high-speed random access memory, and may also include a non-volatile memory, such as at least one disk storage device, a flash memory device, or other non-volatile solid-state storage devices. In some embodiments, the memory 22 may optionally include a memory remotely arranged relative to the processor 21, and these remote memories may be connected to the processor 21 via a network. Examples of the above-mentioned network include, but are not limited to, the Internet, an intranet, a local area network, a mobile communication network, and combinations thereof.

[0145] The program instructions / modules are stored in the memory 22, and when executed by the one or more processors 21, the VPN network address translation method in the above embodiment is executed, for example, each step of the VPN network address translation method in the embodiment of the present invention described above is executed.

[0146] An embodiment of the present invention further provides a non-volatile computer storage medium, wherein the computer storage medium stores computer executable instructions, and the computer executable instructions are executed by one or more processors, such as Fig.11A processor 21 can enable the above one or more processors to execute the VPN network address translation method in the specific implementation mode of the present invention, for example, to execute the various steps of the VPN network address translation method in the embodiment of the present invention described above; it can also realize Fig.11 The modules and units described above; or executing the VPN network address translation method in the specific implementation mode of the present invention, for example, executing the steps of the VPN network address translation method in the embodiment of the present invention described above; it can also be implemented Fig.11 The various modules and units described.

[0147] It is worth noting that the information interaction, execution process, etc. between the modules and units within the above-mentioned devices and systems are based on the same concept as the processing method embodiment of the present invention. The specific contents can be found in the description of the method embodiment of the present invention and will not be repeated here.

[0148] A person skilled in the art may understand that all or part of the steps in the various methods of the embodiments may be completed by instructing related hardware through a program, and the program may be stored in a computer-readable storage medium, and the storage medium may include: a read-only memory (ROM), a random access memory (RAM), a disk or an optical disk, etc.

[0149] The above description is only a preferred embodiment of the present invention and is not intended to limit the present invention. Any modifications, equivalent substitutions and improvements made within the spirit and principles of the present invention should be included in the protection scope of the present invention.

Claims

1. A VPN network address translation method, characterized in that: There is at least one VPWS tunnel between the access gateway and the service gateway; The VPN network address translation method comprises: The access gateway finds the corresponding VPWS tunnel according to the LAN side VNI and QinQ information of the user terminal message; the VPWS tunnel transmits the user terminal message to the service gateway; The service gateway allocates corresponding address conversion information to the QinQ information; The service gateway converts the source IP address of the user terminal message into a public IP address according to the address conversion information, so as to access the Internet using the public IP address.

2. The VPN network address translation method according to claim 1, characterized in that: Address translation information includes public IP addresses and corresponding port ranges; The service gateway allocates corresponding address conversion information to the QinQ information, including: According to the maximum number of concurrent connections of each campus network account during peak hours, the maximum number of accounts that can be assigned to a public IP address in the VPN is obtained; Based on the maximum number of accounts of each campus network link and the maximum number of allocatable accounts, obtaining the required number of public IP addresses; Obtaining the VPN corresponding to the VPWS tunnel; wherein one VPWS tunnel corresponds to one VPN; According to the currently available public IP address segment, a public IP address and a corresponding port range are allocated to the VPN.

3. The VPN network address translation method according to claim 2, characterized in that: After the service gateway converts the source IP address of the user terminal message into a public IP address according to the address conversion information, the following steps are included: The service gateway modifies the source MAC address of the user terminal message into the corresponding sub-interface MAC address to obtain the first target message; The first target message is forwarded from the designated sub-interface of the VPN to the public IP address.

4. The VPN network address translation method according to claim 2, characterized in that: When MAC tracing is required, after the service gateway assigns corresponding address translation information to the QinQ information, the method further includes: The service gateway forwards the user terminal message to the corresponding VPN; When the user terminal message passes through the NAT device, the NAT device converts the source IP address into the public IP address; wherein the NAT device is located inside the VPN; The source MAC address of the user terminal message remains unchanged to obtain a second target message, so as to forward the second target message from the designated sub-interface of the VPN to the public IP address.

5. The VPN network address translation method according to claim 2, characterized in that: When IP tracing and MAC tracing are required, after the service gateway assigns corresponding address conversion information to the QinQ information, the method further includes: The service gateway keeps the source MAC address of the user terminal message unchanged to obtain a third target message, so as to forward the third target message from the designated sub-interface of the VPN to the public IP address; The service gateway establishes a forwarding table for the VPN; wherein the forwarding table is used to maintain a mapping relationship between a source MAC address and a public IP address, where one source MAC address corresponds to one public IP address: The service gateway establishes a forwarding mapping relationship between the source MAC address in the third target message and the public IP address, and updates the forwarding mapping relationship to the forwarding table.

6. The VPN network address translation method according to claim 5, characterized in that: After forwarding the third target message from the designated sub-interface of the VPN to the public IP address, the method further comprises: The service gateway receives the original return message from the public IP address; The service gateway searches the forwarding table for the source MAC address corresponding to the public IP address according to the forwarding mapping relationship; The service gateway modifies the public IP address in the original return message into the source IP address to obtain a target return message; The service gateway forwards the target return message to the internal network device corresponding to the source IP address.

7. The VPN network address translation method according to any one of claims 1 to 6, characterized in that: When the data traffic in the VPN exceeds the VPN traffic threshold, the service gateway limits the data traffic transmitted from the specified cloud service to the internal network to within the application traffic threshold; and / or, the service gateway limits the data traffic from the specified user account to within a user traffic threshold range; And / or, the service gateway limits the data traffic from the designated user terminal to within a terminal traffic threshold range.

8. The VPN network address translation method according to any one of claims 1 to 6, characterized in that: The service gateway collects VPN traffic information and stores the VPN traffic information to a designated FTP server to facilitate audit analysis of the VPN traffic information; wherein the VPN traffic information is data traffic information transmitted through the VPN, and the VPN traffic information is reported by the VPN to the operator.

9. A VPN network address translation device, characterized in that: The VPN network address translation device includes at least one processor and a memory, wherein the at least one processor and the memory are connected via a data bus, and the memory stores instructions executable by the at least one processor, and after being executed by the processor, the instructions are used to implement the VPN network address translation method described in any one of claims 1-8.

10. A non-volatile computer storage medium, characterized in that: The computer storage medium stores computer executable instructions, and the computer executable instructions are executed by one or more processors to complete the VPN network address translation method according to any one of claims 1-8.

Images