A method for dynamically allocating VPNs

Abstract

The application discloses a VPN dynamic allocation method, and relates to the technical field of digital communication, and the implementation comprises the following processes: receiving an access request of a terminal, and obtaining a MAC address of a device end; randomly obtaining an IP pair from an IP resource pool, one IP address is allocated to the terminal as a dynamic IP address, and the other IP address is allocated to a gateway interface in a VPN allocation system; taking the dynamic IP address of the terminal and a corresponding public key as a Peer configuration, and adding the Peer configuration to a configuration file of WireGuard; mapping and configuring a fixed service port of the terminal in a WireGuard private network, the dynamic IP address, a public network port and a security domain name, dynamically generating an access address containing the security domain name; the VPN allocation system provides the security access address to the terminal, and completes encrypted communication between two terminals based on the security access address. Through the scheme, dynamic allocation of IP addresses in the VPN is realized, all used IP addresses and ports are mapped to the same security domain name, and multiple access addresses are covered by one security domain name.

Description

Technical Field

[0001] This invention relates to the field of digital communication technology, and more specifically to a VPN dynamic allocation method. Background Technology

[0002] Wireguard, as a representative of the next generation of VPNs, like other VPN technologies, can be used to establish a secure channel between two ports, thereby allowing access to data and applications on the internal network. However, compared to other VPN technologies, Wireguard's design prioritizes simplicity.

[0003] The principle of Wireguard is as follows: Figure 1 As shown, the kernel creates a corresponding WireGuard interface, named wg0 here. The interface is configured with the IP addresses for communication between the two parties (10.66.66.1 and 10.66.66.2). When a program on the physical machine accesses the address 10.66.66.2 using the address 10.66.66.1, the kernel encrypts the data packet, encapsulates the encrypted packet into a UDP packet, and sends it to the other party. The other party's kernel decrypts the packet and sends the decrypted data packet to the user, thus completing the VPN tunnel function.

[0004] Currently, WireGuard faces the following issues in implementing IP address allocation and device access: 1. After WireGuard allocates terminal IP addresses, the configuration of the corresponding IP address on the terminal cannot be dynamically changed, posing a certain security risk; 2. After WireGuard allocates IP addresses and provides them to terminal clients, if there are many terminals, security protocols need to be added to the corresponding IP configurations for security. If a security domain name is provided for each IP, a lot of security protocol configurations are required, resulting in resource consumption and inconvenience for maintenance. Summary of the Invention

[0005] The purpose of this invention is to provide a VPN dynamic allocation method, which, based on a central server, enables the dynamic allocation of IP addresses within the VPN, as well as the dynamic allocation of secure domain names.

[0006] To achieve the above objectives, the technical solution adopted by the present invention is as follows:

[0007] A VPN dynamic allocation method, the implementation of which includes the following process:

[0008] Step S1: The VPN allocation system receives the access request from the device, parses the access request, and obtains the device's MAC address;

[0009] Step S2: The VPN allocation system randomly obtains IP pairs from the IP resource pool. One IP address is assigned to the device as a dynamic IP address, and the other IP address is assigned to the same gateway interface in the VPN allocation system as a logical gateway IP address.

[0010] Step S3: The IP address and corresponding public key dynamically assigned to the device by the VPN allocation system are added to the WireGuard configuration file as a Peer configuration; through Nginx reverse proxy, the fixed service port, dynamic IP address, public port of the VPN allocation system and security domain name of the device in the WireGuard private network are mapped and written to the mapping table. Each dynamic IP address is assigned a new public port. Then Nginx is hot-loaded to dynamically generate a secure access address containing the security domain name.

[0011] Step S4: The VPN allocation system provides a secure access address to the device.

[0012] Step S5: Complete encrypted communication between the device and the control terminal based on the secure access address;

[0013] Step S5 is implemented as follows:

[0014] The control terminal receives a one-time access token issued by the VPN allocation system and a secure access address bound to the device, and initiates a connection to the VPN allocation system via HTTPS;

[0015] After the VPN distribution system verifies the validity of the token and temporarily writes the control terminal's public key into the WireGuard Peer configuration, it forwards the traffic to the actual port of the device in the WireGuard private network.

[0016] The control end and the device end complete two-way authentication within the established WireGuard tunnel and begin encrypted business communication;

[0017] After communication ends, the token becomes invalid immediately, the control peer is automatically removed, and the tunnel is dismantled as needed or awaits lease expiration for recovery.

[0018] As a specific implementation scheme, the specific implementation of dynamically generating a secure access address containing a secure domain name in step S3 includes the following steps:

[0019] Step S31: The VPN allocation system sequentially allocates public network port numbers to each device from the public network port pool, establishes a one-to-one relationship with the dynamic IP address, and writes the port number and the security domain name of the VPN allocation system into the mapping table.

[0020] Step S32: Write the three-element mapping of public port number, dynamic IP address, and fixed service port into the configuration template. The template engine generates the Nginx server block and hot reloads Nginx accordingly.

[0021] Step S33: Load the wildcard SSL certificate. All newly added public ports share this certificate, enabling secure domain names and port combinations to be accessed via HTTPS.

[0022] As a specific implementation plan, the VPN allocation system includes a central server, a registration center, and Nginx nodes; the central server is configured with two programs: Nginx and WireGuard.

[0023] The central server is used for the management of the IP resource pool, including generating IP address ranges in a rule-based order, managing WireGuard keys, distributing port mapping tables to Nginx nodes, and distributing device configuration templates to the registry center.

[0024] The registration center is used to authenticate device identity, bind device terminals, dynamic IP addresses, public port numbers, generate WireGuard configuration files for the device, monitor the online status of the device with heartbeat, and provide secure access addresses;

[0025] The Nginx node is used for security protocol decryption and mapping public network ports to fixed service ports on the device's WireGuard private network.

[0026] As one specific implementation, the Wireguard configuration file includes the local private key, the local dynamic IP address, the UDP port the local machine listens on, the peer device's public key, the range of IP addresses allowed to access the device, and the fixed service port corresponding to the peer device's public key.

[0027] As one specific implementation plan, the IP recycling method is as follows:

[0028] The VPN allocation system periodically checks whether the allocated IPs are being illegally occupied. If they are, it triggers the revocation of the IP pairs.

[0029] As one specific implementation plan, the IP recycling method is as follows:

[0030] When the device is offline, it sends a DHCP Release message to trigger the immediate recycling of used IP pairs.

[0031] As one specific implementation plan, the method for generating IPs in the IP resource pool includes the following steps:

[0032] Step A: Map the country-province-city-county directly to the A, B, and C class address ranges;

[0033] Step B: Select a main network segment for each region to ensure that the main network segments of different regions do not overlap;

[0034] Step C: Refine the subnetting layer by layer within the main network segment using variable-length subnet masks;

[0035] Step D: The system outputs a list of subnet segments and starting ports in batches daily according to the administrative level script and writes it into the IP resource pool.

[0036] The present invention has the following beneficial effects:

[0037] This invention enables dynamic allocation and recycling of IP resources, allowing limited IP addresses to be used cyclically across different terminals, effectively improving address utilization. It also solves the problem of idle and wasted addresses under static address allocation. Terminal devices obtain IPs dynamically through access, so that each device can use a different IP for VPN connection, greatly improving the security of terminal device access.

[0038] This invention's VPN dynamically generates a daily IP pool using an IP generation method. Based on the dynamic configuration of port allocation, it achieves a one-to-one correspondence between secure dynamic protocols and IPs. When a terminal performs dynamic access, it can randomly and flexibly obtain the corresponding dynamic IP. When the control terminal accesses a device, it can obtain the device's secure protocol access address through the device's unique MAC address, thus achieving secure access to the device.

[0039] This invention allows multiple IP addresses to share a single secure domain name to form different access addresses. It employs intelligent port proxying to point to dynamically allocated domain names, achieving both dynamic address allocation and ensuring each address is transmitted encrypted using a secure protocol. This enables devices to access and use the device under a secure SSL protocol, improving device access security. Furthermore, dynamically generating corresponding access device addresses also enhances device security, as each connection generates a relatively dynamic address. Attached Figure Description

[0040] Figure 1 This is a schematic diagram illustrating the principle of WireGuard;

[0041] Figure 2 This is a flowchart of the present invention. Detailed Implementation

[0042] To more clearly illustrate the technical solutions in the embodiments of the present invention or the prior art, the present invention will be briefly introduced below in conjunction with the accompanying drawings and descriptions of the embodiments or the prior art. Obviously, the following description of the structure of the accompanying drawings is only some embodiments of the present invention. For those skilled in the art, other drawings can be obtained based on these drawings without creative effort. It should be noted that the description of these embodiments is for the purpose of helping to understand the present invention, but does not constitute a limitation of the present invention.

[0043] It should be understood that although the terms first, second, etc., may be used herein to describe various modules, these modules should not be limited by these terms. These terms are only used to distinguish one module from another. For example, a first module may be referred to as a second module, and similarly, a second module may be referred to as a first module, without departing from the scope of the exemplary embodiments of the invention.

[0044] It should be understood that the term "and / or" that may appear in this document is merely a description of the relationship between related objects, indicating that three relationships can exist. For example, A and / or B can mean: A exists alone, B exists alone, and both exist simultaneously.

[0045] In cases A and B; the term " / and" that may appear in this article describes another kind of relationship between related objects, indicating that two relationships can exist. For example, A / and B can mean: A exists alone, or A and B exist alone; in addition, the character " / " that may appear in this article generally indicates that the related objects before and after it are in an "or" relationship.

[0046] The first aspect of this invention provides a VPN dynamic allocation method applied to a remote control device. For ease of description, a control terminal and a device terminal are defined, wherein the control terminal remotely controls the device terminal. Both the control terminal and the device terminal are collectively referred to as terminals.

[0047] The VPN dynamic allocation method shown in this invention includes the following steps:

[0048] Step S1: The VPN allocation system receives the terminal's access request, parses the access request, and obtains the device's MAC address;

[0049] Step S2: The VPN allocation system randomly obtains IP pairs (IPs include two associated IP addresses) from the IP resource pool and assigns them to the two entities that need to establish communication between them as dynamic IP addresses; the two entities that need to establish communication between them refer to the terminal and the gateway interface in the VPN allocation system, which are used as logical gateway IP addresses.

[0050] In step S2, each terminal corresponds to a dynamic IP address of the WireGuard private network. Each dynamic IP address is assigned a unique public network port. The gateway interface remains single and the public network port corresponds one-to-one with the private network IP.

[0051] Specifically, in this step, assuming there are terminals d1, d2, d3, d4…dn, each device obtains a dynamically generated IP address paired using an IP generation method, such as:

[0052] d1(100.70.0.1),d2(100.70.0.3),d3(100.70.0.5),d4(100.70.0.7)…dn(100.70.0.n).

[0053] At this time, the gateway IP addresses corresponding to d1, d2, d3, d4...dn are (100.70.0.2), (100.70.0.4), (100.70.0.6), (100.70.0.8), ... (100.70.0.n+1).

[0054] 100.70.0.1 and 100.70.0.2 form an IP pair, with 100.70.0.1 assigned to the d1 terminal and 100.70.0.2 assigned to the gateway interface.

[0055] Step S3: The IP address and corresponding public key dynamically assigned to the terminal by the VPN allocation system are added as a Peer configuration to the WireGuard configuration file. Through Nginx reverse proxy, the fixed service port, dynamic IP address, public port of the VPN allocation system, and security domain name of the terminal in the WireGuard private network are mapped and written to the mapping table. Then, Nginx is reloaded to dynamically generate an access address containing the security domain name. Each allocated dynamic IP address corresponds to a new public port, and the dynamic IP address is written to the configuration file, thus enabling the terminal to access the network through a single security domain name (the security domain name of the VPN allocation system) and different public ports.

[0056] In step S3, each assigned dynamic IP address corresponds to a new public network port, thereby enabling the terminal to access the network through a single security domain name (the security domain name of the VPN allocation system) and different public network ports.

[0057] In step S3, a continuous range of public network port numbers that have been allowed by the firewall is selected. This range is hardcoded into the configuration table of the central server and serves as a port pool.

[0058] As a specific implementation scheme, step S3, which dynamically generates an access address containing a security domain name, includes the following steps:

[0059] Step S31: The VPN allocation system sequentially allocates public network port numbers to each terminal from the public network port pool, establishes a one-to-one relationship with the dynamic IP address, and writes the port number and the security domain name of the VPN allocation system into the mapping table.

[0060] Step S32: Write the three-element mapping of public port number, dynamic IP address, and fixed service port into the configuration template. The template engine generates the Nginx server block and hot reloads Nginx accordingly.

[0061] Step S33: Load the wildcard SSL certificate. All newly added public ports share this certificate, enabling secure domain names and port combinations to be accessed via HTTPS.

[0062] In step S31, the ports are reused in sequence after being recycled.

[0063] Step S4: The VPN allocation system provides secure access addresses to the terminals (device and control terminals).

[0064] Step S5: Complete encrypted communication between the two terminals (device and control terminals) based on the secure access address.

[0065] Step S5 is implemented as follows:

[0066] The control terminal initiates a connection to the VPN allocation system via HTTPS using a one-time access token and a secure access address issued by the VPN allocation system.

[0067] After the VPN distribution system verifies the validity of the token and temporarily writes the control terminal's public key into the WireGuard Peer configuration, it forwards the traffic to the actual port of the target device in the WireGuard private network.

[0068] The control end and the device end complete two-way authentication within the established WireGuard tunnel and begin encrypted business communication;

[0069] After communication ends, the token becomes invalid immediately, the control peer is automatically removed, and the tunnel is dismantled as needed or awaits lease expiration for recovery.

[0070] Specifically, the VPN allocation system includes a central server, a registration center, and Nginx nodes; the central server is configured with two programs: Nginx and WireGuard.

[0071] The central server is used for the management of the IP resource pool, including generating IP address ranges in a rule-based order, managing WireGuard keys, distributing port mapping tables to Nginx nodes, and distributing terminal configuration templates to the registry center.

[0072] The registration center is used to authenticate device identity (MAC address and device certificate), bind terminals, dynamic IP addresses, public port numbers, generate WireGuard configuration files for terminals, monitor terminal online status with heartbeat, and provide secure access addresses.

[0073] The Nginx node is used for secure protocol decryption and mapping public network ports to fixed service ports on the terminal within the WireGuard private network.

[0074] In this embodiment, the VPN address in the VPN allocation system is configured as a fixed address, serving as the device access point. Nginx maps the domain name to different services or resources. An SSL certificate is configured for the domain name to ensure encrypted data transmission. In the Nginx configuration, requests are proxied to different IP addresses under the same domain name via different ports. For example, requests on port 8080 are proxied to 192.168.1.100, and requests on port 8081 are proxied to 192.168.1.101. This allows users to access multiple services through the same secure domain name; the specific service accessed is determined by the port.

[0075] This step allows multiple IP addresses to share a single secure domain name to form different access addresses, achieving dynamic address allocation while ensuring each address is transmitted encrypted using a secure protocol. This enables terminals to access and use the device under a secure SSL certificate, improving terminal access security. Simultaneously, dynamically generating corresponding access terminal addresses also enhances device security, as each connection generates relatively dynamic address information.

[0076] In this embodiment, the Wireguard configuration file includes the local private key, the local dynamic IP address, the UDP port that the local machine listens on, the peer device public key, the range of IP addresses allowed to access the device, and the fixed service port corresponding to the peer device public key.

[0077] In this embodiment, the IP address will be reclaimed. The specific implementation method is as follows:

[0078] 1. The VPN allocation system periodically checks whether the allocated IPs are being illegally occupied. If they are, it triggers the revocation of the IP pairs.

[0079] 2. When the terminal is offline, a DHCP Release message is sent to trigger the immediate recycling of used IP pairs.

[0080] Furthermore, the IP resource pool is generated based on regionalization, as described below:

[0081] IP segmentation technology is used to achieve a flexible IP generation method for each region. Several IP pairs are generated daily according to rules and provided to the VPN allocation system for allocation.

[0082] The IP generation method is as follows:

[0083] Step A: Map the country-province-city-county directly to the A, B, and C class address ranges;

[0084] Class A addresses (1.0.0.0~126.0.0.0): allocated to national or large-scale inter-provincial networks, such as when the backbone network of an operator covers multiple provinces; Class B addresses (172.16.0.0~172.31.255.255): suitable for provincial or medium-sized regional networks (such as a provincial government cloud platform); Class C addresses (192.168.0.0~192.168.255.255): used for city and county level or enterprise intranets, with each subnet supporting a maximum of 254 devices.

[0085] Step B: Select a main network segment for each region (e.g., 172.16.0.0 / 16) to ensure that the main network segments of different regions do not overlap;

[0086] The implementation example of step B is as follows: provincial networks use Class B addresses, and municipal networks divide Class C subnets based on them; different regions use non-overlapping address ranges (for example, Beijing uses 10.0.0.0 / 8, and Shanghai uses 172.16.0.0 / 12).

[0087] Select the main network segment (allocate 172.16.0.0 / 16, Class B) - divide into subnets (split into 172.16.1.0 / 24~172.16.100.0 / 24, covering 21 prefecture-level cities) - reserve addresses (reserve 172.16.255.0 / 24 for regional gateways and servers).

[0088] Step C: Refine the main network segment layer by layer using VLSM (Variable Length Subnet Mask);

[0089] Implementation example of step C: Use 255.255.255.0 ( / 24) to divide a Class C address into multiple municipal district subnets (e.g., 192.168.1.0 / 24 corresponds to Baiyun District, Guangzhou City);

[0090] Finer-grained partitioning can be achieved through VLSM (Variable Length Subnet Mask), for example, splitting 192.168.1.0 / 26 into 4 subnets, each supporting 62 devices.

[0091] Step D: The system outputs a list of subnet segments and starting ports in batches daily according to the administrative level script and writes it into the IP resource pool.

[0092] In this invention, the IP generation method described above enables the following: terminals can obtain network segments within the same city / province upon login; VPN tunnels provide direct access with minimal latency; and when the number of terminals surges, the system automatically switches to smaller subnets based on administrative levels, eliminating the need for manual routing changes. Regionalized address pools provide natural isolation, preventing VPN peer disconnection due to IP conflicts. If a provincial segment is blocked, only terminals within that province switch to backup regional network segments, ensuring service continuity. A single script can generate all subnets according to "province-city-county," which can be reused upon recycling, and expansion only requires changing the subnet mask.

[0093] Example 1

[0094] The VPN allocation process on the device side is as follows:

[0095] When the device starts up, it sends an access request to the registry center via a WebSocket persistent connection, and the request carries the device's unique identifier (MAC address).

[0096] Based on the device's MAC address, the registration center allocates an available dynamic IP address from the IP resource pool for the day, and also assigns an available port number.

[0097] The registration center binds the assigned dynamic IP address, port number, daily key, and device MAC address to the database and sets the lease validity period to 24 hours.

[0098] The registry center returns a secure access address to the device via WebSocket.

[0099] Example 2

[0100] The VPN allocation process on the control end is as follows:

[0101] The control terminal requests access permissions from the registration center via two-factor authentication, providing the MAC address of the target device.

[0102] After verifying the controller's permissions, the registration center queries the database for the security access address currently bound to the target device and generates a one-time access token.

[0103] The registration center returns the device's secure access address and one-time token to the control terminal;

[0104] The control terminal uses this secure access address to carry a one-time token in the HTTPS request and accesses the target device through the VPN allocation system;

[0105] The VPN allocation system forwards requests to the corresponding device IP address based on the port number in the secure access address, thereby establishing a secure connection.

[0106] Finally, it should be noted that the above description is merely a preferred embodiment of the present invention and is not intended to limit the scope of protection of the present invention. Any modifications, equivalent substitutions, improvements, etc., made within the spirit and principles of the present invention should be included within the scope of protection of the present invention.

Claims

1. A VPN dynamic allocation method, characterized in that, Its implementation includes the following processes: Step S1: The VPN allocation system receives the access request from the device, parses the access request, and obtains the device's MAC address; Step S2: The VPN allocation system randomly obtains IP pairs from the IP resource pool. One IP address is assigned to the device as a dynamic IP address, and the other IP address is assigned to the same gateway interface in the VPN allocation system as a logical gateway IP address. Step S3: The IP address and corresponding public key dynamically assigned to the device by the VPN allocation system are added to the WireGuard configuration file as a Peer configuration; through Nginx reverse proxy, the fixed service port, dynamic IP address, public port of the VPN allocation system and security domain name of the device in the WireGuard private network are mapped and written to the mapping table. Each dynamic IP address is assigned a new public port. Then Nginx is hot-loaded to dynamically generate a secure access address containing the security domain name. Step S4: The VPN allocation system provides a secure access address to the device. Step S5: Complete encrypted communication between the device and the control terminal based on the secure access address; Step S5 is implemented as follows: The control terminal receives a one-time access token issued by the VPN allocation system and a secure access address bound to the device, and initiates a connection to the VPN allocation system via HTTPS; After the VPN distribution system verifies the validity of the token and temporarily writes the control terminal's public key into the WireGuard Peer configuration, it forwards the traffic to the actual port of the device in the WireGuard private network. The control end and the device end complete two-way authentication within the established WireGuard tunnel and begin encrypted business communication; After communication ends, the token becomes invalid immediately, the control peer is automatically removed, and the tunnel is dismantled as needed or awaits lease expiration for recovery.

2. The VPN dynamic allocation method according to claim 1, characterized in that, The specific implementation of dynamically generating a secure access address containing a secure domain name in step S3 includes the following steps: Step S31: The VPN allocation system sequentially allocates public network port numbers to each device from the public network port pool, establishes a one-to-one relationship with the dynamic IP address, and writes the port number and the security domain name of the VPN allocation system into the mapping table. Step S32: Write the three-element mapping of public port number, dynamic IP address, and fixed service port into the configuration template. The template engine generates the Nginx server block and hot reloads Nginx accordingly. Step S33: Load the wildcard SSL certificate. All newly added public ports share this certificate, enabling secure domain names and port combinations to be accessed via HTTPS.

3. A VPN dynamic allocation method according to any one of claims 1-2, characterized in that, The VPN allocation system includes a central server, a registration center, and Nginx nodes; the central server is configured with two programs: Nginx and WireGuard. The central server is used for the management of the IP resource pool, including generating IP address ranges in a rule-based order, managing WireGuard keys, distributing port mapping tables to Nginx nodes, and distributing device configuration templates to the registration center. The registration center is used to authenticate device identity, bind device terminals, dynamic IP addresses, public port numbers, generate WireGuard configuration files for the device, monitor the online status of the device with heartbeat, and provide secure access addresses; The Nginx node is used for security protocol decryption and mapping public network ports to fixed service ports on the device's WireGuard private network.

4. The VPN dynamic allocation method according to claim 1, characterized in that, The Wireguard configuration file includes the local private key, the local dynamic IP address, the UDP port the local machine listens on, the peer device's public key, the range of IP addresses allowed to access the device, and the fixed service port corresponding to the peer device's public key.

5. A VPN dynamic allocation method according to claim 1, characterized in that, The method for IP pair reclamation is as follows: The VPN allocation system periodically checks whether the allocated IPs are being illegally occupied. If they are being illegally occupied, the IP pair reclamation is triggered.

6. The VPN dynamic allocation method according to claim 1, characterized in that, The method for IP pair recycling is as follows: when the device is offline, a DHCP Release message is sent to trigger the immediate recycling of used IP pairs.

7. A VPN dynamic allocation method according to claim 1, characterized in that, The method for generating IPs in the IP resource pool includes the following steps: Step A: Map the country-province-city-county directly to the A, B, and C class address ranges; Step B: Select a main network segment for each region to ensure that the main network segments of different regions do not overlap; Step C: Refine the subnet layer by layer within the main network segment using variable-length subnet masks; Step D: The system outputs a list of subnet segments and starting ports in batches daily according to the administrative level script and writes it into the IP resource pool.

Images