Information processing method and device based on firewall, server and storage medium

Abstract

The invention provides an information processing method and device based on a firewall, a server and a storage medium, and relates to the technical field of network information security. The method comprises the following steps: receiving target information sent by the switch; the target information comprises a target identifier of the VLAN and target communication data to be processed; determining a corresponding target firewall interface according to the target identifier; determining a target firewall policy corresponding to the target firewall interface; and performing corresponding data processing on the target communication data according to the target firewall policy. According to the information processing method based on the firewall, a server is in communication connection with a switch through a relay Trunk link, a plurality of firewall interfaces are arranged in the server, and the firewall interfaces are in one-to-one correspondence with virtual local area networks (VLANs) of the switch. Therefore, the problem that a single-interface firewall is difficult to effectively process a large number of VLANs can be solved, and a physical interface does not need to be added.

Description

Technical Field

[0001] The present application belongs to the field of network information security technology, and specifically relates to a firewall-based information processing method, device, server and storage medium. Background Art

[0002] Due to inherent flaws in the TCP / IP (Transmission Control Protocol / Internet Protocol) protocol suite and inherent vulnerabilities in various application systems, many risks exist for user information security. Among technologies used to ensure computer network security, firewall technology is primarily used at the switch level.

[0003] In the related art, a single-interface firewall is difficult to effectively handle a large number of VLANs (Virtual Local Area Networks) or subnets due to the limited number of physical interfaces. Solving this problem by expanding the physical interface often increases costs and system complexity.

[0004] Therefore, a new multi-interface firewall solution is needed to solve the problem that the above-mentioned single-interface firewall is difficult to effectively handle a large number of VLANs. Summary of the Invention

[0005] The technical problem to be solved by the present application is to address the above-mentioned deficiencies in the prior art and to provide a firewall-based information processing method, device, server and storage medium. By using the firewall-based information processing method, a large amount of VLAN information can be effectively processed.

[0006] In a first aspect, an embodiment of the present application provides a firewall-based information processing method, which is applied to a server. The server is connected to a switch via a trunk link, and the server is provided with multiple firewall interfaces, each firewall interface corresponding to each virtual local area network (VLAN) of the switch. The firewall interface is a logical interface. The method includes:

[0007] Receive target information sent by the switch; the target information includes the target identifier of the VLAN and the target communication data to be processed;

[0008] Determine the corresponding target firewall interface according to the target identifier;

[0009] Determine the target firewall policy corresponding to the target firewall interface;

[0010] Perform corresponding data processing on the target communication data according to the target firewall policy.

[0011] In some embodiments of the first aspect, the server is a Linux server; the Linux server is pre-installed with an IP packet filtering system iptables; the target firewall policy is pre-configured by iptables;

[0012] Perform corresponding data processing on the target communication data according to the target firewall policy, including:

[0013] If the target firewall policy is to allow only HTTP data to pass through, then determine whether all target communication data complies with the HTTP protocol. If it is determined that all target communication data complies with the HTTP protocol, then allow the target communication data to pass through.

[0014] If it is determined that part of the target communication data complies with the Hypertext Transfer Security Protocol, the target communication data is filtered to allow part of the data that complies with the Hypertext Transfer Security Protocol to pass.

[0015] In some implementations of the first aspect, before receiving the target information sent by the switch, the method further includes:

[0016] Configure the primary network card of the Linux server;

[0017] Configure multiple VLAN network cards for Linux servers;

[0018] Set up the routing and forwarding function of the Linux server;

[0019] Use iptables to configure the firewall policy corresponding to each firewall interface; wherein each firewall interface includes the target firewall interface.

[0020] In some implementations of the first aspect, configuring a primary network card of a Linux server includes:

[0021] Set the network interface type of the primary network card to Ethernet;

[0022] Set the configuration mode of the Internet Protocol address to configure a static address;

[0023] Set the logical interface name and physical network card device name according to the name of the physical network card device in the Linux server;

[0024] Configure the Linux server to automatically activate the primary network card interface at startup.

[0025] In some implementations of the first aspect, configuring multiple VLAN network cards of a Linux server includes:

[0026] Perform the following steps for each VLAN network card:

[0027] Set the interface type of the current VLAN network card to VLAN interface;

[0028] Set the configuration mode of the Internet Protocol address to configure a static address;

[0029] Set the VLAN interface name according to the name of the physical network card device in the Linux server;

[0030] Enable the VLAN function in the Linux server.

[0031] Set the Internet Protocol address of the current VLAN network card;

[0032] Set the subnet range corresponding to the interface of the current VLAN network card.

[0033] In some implementations of the first aspect, configuring a firewall policy corresponding to each firewall interface using iptables includes:

[0034] In response to the user's rule configuration operation on each firewall interface based on iptables, a firewall policy corresponding to each firewall interface is generated.

[0035] In some implementations of the first aspect, before determining the target firewall policy corresponding to the target firewall interface, the method further includes:

[0036] Conduct compliance verification of target identification;

[0037] If the verification result of the target identifier is determined to be compliant, the step of determining a target firewall policy corresponding to the target firewall interface is performed.

[0038] Based on the same inventive concept, in a second aspect, an embodiment of the present application further provides a firewall-based information processing device, which is located on a server. The server is communicatively connected to a switch via a trunk link, and the server is provided with multiple firewall interfaces, each of which corresponds to a virtual local area network (VLAN) of the switch. The firewall interface is a logical interface, and the device includes:

[0039] The receiving module is used to receive the target information sent by the switch; the target information includes the target identifier of the VLAN and the target communication data to be processed;

[0040] A first determining module, configured to determine a corresponding target firewall interface according to a target identifier;

[0041] A second determining module is used to determine a target firewall policy corresponding to a target firewall interface;

[0042] The processing module is used to perform corresponding data processing on the target communication data according to the target firewall policy.

[0043] In some embodiments of the second aspect, the server is a Linux server; the Linux server is pre-installed with an IP packet filtering system iptables; the target firewall policy is pre-configured by iptables;

[0044] The processing module is specifically used to:

[0045] If the target firewall policy is to only allow data that complies with the Hypertext Transfer Security Protocol to pass through, then determine whether all the target communication data complies with the Hypertext Transfer Security Protocol. If it is determined that all the target communication data complies with the Hypertext Transfer Security Protocol, then allow the target communication data to pass through; if it is determined that part of the target communication data complies with the Hypertext Transfer Security Protocol, then filter the target communication data to allow the part that complies with the Hypertext Transfer Security Protocol to pass through.

[0046] In some embodiments of the second aspect, the apparatus further comprises:

[0047] The configuration module is used to configure the main network card of the Linux server; configure multiple VLAN network cards of the Linux server; set the routing and forwarding function of the Linux server; use iptables to configure the firewall policy corresponding to each firewall interface; among which, each firewall interface includes a target firewall interface.

[0048] In some implementations of the second aspect, the configuration module is specifically used, when configuring the primary network card of the Linux server:

[0049] Set the network interface type of the primary network card to Ethernet; set the Internet Protocol address configuration method to configure a static address; set the logical interface name and physical network card device name according to the name of the physical network card device in the Linux server; set the Linux server to automatically activate the interface of the primary network card when it starts.

[0050] In some implementations of the second aspect, the configuration module is specifically configured to:

[0051] Perform the following steps for each VLAN network card:

[0052] Set the interface type of the current VLAN network card to VLAN interface; set the configuration method of the Internet Protocol address to configure a static address; set the VLAN interface name according to the name of the physical network card device in the Linux server; set the VLAN function in the Linux server to enable; set the Internet Protocol address of the current VLAN network card; set the subnet range corresponding to the interface of the current VLAN network card.

[0053] In some embodiments of the second aspect, the configuration module is specifically configured to:

[0054] In response to a rule configuration operation of each firewall interface based on iptables by a user, the firewall policy corresponding to each firewall interface is generated.

[0055] In some embodiments of the second aspect, the second determination module is further configured to:

[0056] Conduct compliance verification on the target identifier; if it is determined that the verification result of the target identifier is compliant, the step of determining the target firewall policy corresponding to the target firewall interface is executed.

[0057] Based on the same inventive concept, in a third aspect, the embodiments of the present application further provide a server, which comprises:

[0058] a memory and a processor;

[0059] The memory stores computer execution instructions;

[0060] The processor executes the computer execution instructions stored in the memory to implement the firewall-based information processing method according to any one of the first aspect.

[0061] Based on the same inventive concept, in a fourth aspect, the embodiments of the present application further provide a computer readable storage medium, which stores computer execution instructions, and the computer execution instructions are executed by a processor to implement the firewall-based information processing method according to any one of the first aspect.

[0062] According to the firewall-based information processing method, device, server and storage medium provided by the embodiments of the present application, since the server is in communication connection with the switch through a trunk link, and the server is provided with a plurality of firewall interfaces, each firewall interface corresponds to each virtual local area network (VLAN) of the switch. When receiving target information sent by the switch, the corresponding target firewall interface is determined according to the target identifier; the target firewall policy corresponding to the target firewall interface is determined, and the corresponding data processing is performed on the target communication data according to the target firewall policy, so that the problem that a single interface firewall cannot effectively process a large number of VLANs can be solved, and the physical interface does not need to be increased. BRIEF DESCRIPTION OF DRAWINGS

[0063] Figure 1 Fig. 1 shows a flow diagram of a firewall-based information processing method according to an embodiment of the present application;

[0064] Figure 2 Fig. 2 shows another flow diagram of a firewall-based information processing method according to an embodiment of the present application;

[0065] Figure 3 A schematic diagram of a network topology provided in an embodiment of the present application is shown;

[0066] Figure 4 A schematic diagram of a multi-vlan connection architecture provided by an embodiment of the present application is shown;

[0067] Figure 5 A schematic structural diagram of a firewall-based information processing device provided in an embodiment of the present application is shown. DETAILED DESCRIPTION

[0068] In order to enable those skilled in the art to better understand the technical solution of the present application, the present application is further described in detail below with reference to the accompanying drawings and embodiments.

[0069] The features and exemplary embodiments of various aspects of the present application will be described in detail below. In order to make the purpose, technical solutions and advantages of the present application clearer, the present application will be further described in detail below in conjunction with the accompanying drawings and specific embodiments. It should be understood that the specific embodiments described herein are only configured to explain the present application and are not configured to limit the present application. For those skilled in the art, the present application can be implemented without the need for some of these specific details. The following description of the embodiments is merely to provide a better understanding of the present application by illustrating the examples of the present application.

[0070] It should be noted that, in this document, relational terms such as first and second, etc., are used only to distinguish one entity or operation from another entity or operation, and do not necessarily require or imply any actual relationship or order between these entities or operations. Moreover, the terms "comprises," "comprising," or any other variations thereof are intended to cover non-exclusive inclusion, such that a process, method, article, or apparatus that includes a list of elements includes not only those elements but also other elements not explicitly listed, or elements inherent to such process, method, article, or apparatus.

[0071] Single-interface firewalls in related technologies struggle to effectively handle large numbers of VLANs or subnets due to their limited number of physical interfaces. Addressing this issue by expanding physical interfaces often increases costs and system complexity. Therefore, a new multi-interface firewall solution is needed to address the difficulty of single-interface firewalls in effectively handling large numbers of VLANs.

[0072] Example 1

[0073] The firewall-based information processing method provided in the embodiment of the present application can be executed by a firewall-based information processing device and a server, etc. The following description will be made by taking the firewall-based information processing method executed by a server as an example.

[0074] like Figure 1 As shown, the firewall-based information processing method provided in the embodiment of the present application is applied to a server. The server is connected to a switch via a trunk link, and the server is provided with multiple firewall interfaces. Each firewall interface corresponds to a virtual local area network (VLAN) of the switch. The firewall interface is a logical interface. The firewall-based information processing method provided in the embodiment of the present application may include steps S101 to S104.

[0075] S101: Receive target information sent by a switch, including a target identifier of a VLAN and target communication data to be processed.

[0076] Exemplarily, a relay Trunk link is generally used to solve the communication problem of multiple VLANs between multiple switches. In this embodiment, the server is connected to the switch through a relay Trunk link to solve the communication problem between a single physical interface of the server and multiple VLANs of the switch.

[0077] Trunk transmits multiple VLAN traffic through a single physical link, eliminating the need for additional wiring and adding no additional hardware costs.

[0078] Exemplarily, a plurality of firewall interfaces are provided in the server, and each firewall interface corresponds to each VLAN of the switch one by one.

[0079] For example, firewall interface a corresponds to VLAN 1, firewall interface b corresponds to VLAN 2, and firewall interface c corresponds to VLAN 3. That is, firewall interface a is responsible for processing access information from VLAN 1, firewall interface b is responsible for processing access information from VLAN 2, and firewall interface c is responsible for processing access information from VLAN 3.

[0080] For example, the server can be a Linux server. Linux not only offers stable system performance, but its core firewall component is highly efficient and easy to configure, ensuring system security. Using the firewall component built into the Linux server can further enhance information security.

[0081] Exemplarily, the target identifier of the VLAN may be the name of the VLAN, the IP address of the VLAN, or the like.

[0082] S102: Determine the corresponding target firewall interface according to the target identifier.

[0083] Exemplarily, since there is a one-to-one correspondence between firewall interfaces and VLANs, the corresponding target firewall interface can be directly determined based on the target identifier of the VLAN, thereby improving the efficiency of determining the firewall interface responsible for processing information.

[0084] S103: Determine a target firewall policy corresponding to the target firewall interface.

[0085] Exemplarily, the target firewall policy can be pre-configured according to each firewall interface. The target firewall policy includes access control policy, source / destination IP management, protocol and port control, etc., which are used to restrict access to, forward, filter, etc. of data.

[0086] In some implementations, before S103, a process is also included to determine whether the access information is allowed to pass:

[0087] Perform compliance verification on the target identity.

[0088] If the verification result of the target identifier is determined to be compliant, S103 is executed.

[0089] For example, performing compliance verification on the target identifier can further enhance network information security. Only when the verification result of the target identifier is compliant, the subsequent step of determining the target firewall policy will be performed.

[0090] Exemplarily, the target identification may also include a device identification. If the access information comes from, for example, a blacklisted device, an unknown device, etc., when performing compliance verification on the target identification, it is also possible to verify whether the device meets the requirements, thereby further improving network information security.

[0091] S104: Perform corresponding data processing on the target communication data according to the target firewall policy.

[0092] For example, according to the target firewall policy, the target communication data may be processed by, for example, filtering, access restriction, etc. The target firewall policy may be preset by the user, and the user may also modify the firewall policy at any time.

[0093] In some embodiments, the server is a Linux server, wherein the Linux server is pre-installed with an IP packet filtering system iptables, and the target firewall policy is pre-configured by iptables.

[0094] S104 may be specifically as follows:

[0095] If the target firewall policy is to only allow data with the Hypertext Transfer Protocol Security to pass through, then determine whether all target communication data complies with the Hypertext Transfer Protocol Security. If it is determined that all target communication data complies with the Hypertext Transfer Protocol Security, then allow the target communication data to pass through.

[0096] If it is determined that part of the target communication data complies with the Hypertext Transfer Security Protocol, the target communication data is filtered to allow part of the data that complies with the Hypertext Transfer Security Protocol to pass.

[0097] For example, the IP packet filtering system iptables is a firewall tool integrated into the Linux kernel. Iptables can implement network traffic control for WLAN by configuring rules, mainly including functions such as access control and network address translation.

[0098] Exemplarily, the target firewall policy may also be other policies, such as allowing data of the basic protocol to pass through, time access restriction, destination address translation, source address translation, etc.

[0099] Using iptables, you can achieve fine-grained control of logarithmic flows, including source address, destination address, port, etc. Due to the rich configuration options of iptables, you can easily add, delete, modify, and check rules to meet continuous network needs, ensuring the flexibility and scalability of security policies.

[0100] According to the firewall-based information processing method provided in an embodiment of the present application, since the server is connected to the switch via a relay trunk link, and the server is provided with multiple firewall interfaces, each firewall interface corresponds to each virtual local area network (VLAN) of the switch. When receiving target information sent by the switch, the corresponding target firewall interface is determined based on the target identifier. The target firewall policy corresponding to the target firewall interface is determined, and the target communication data is processed accordingly according to the target firewall policy. This solves the problem that a single-interface firewall cannot effectively handle a large number of VLANs, and does not require additional physical interfaces.

[0101] Example 2

[0102] like Figure 2 As shown, the firewall-based information processing method provided in the embodiment of the present application is further explained on the basis of the firewall-based information processing method provided in Example 1 of the present application. The server used in this embodiment is a Linux server, and the method steps may include steps S201 to S208.

[0103] S201. Configure the primary network card of the Linux server.

[0104] For example, the Linux server's primary network card is the network card corresponding to the physical interface. By determining that the Linux server's primary network card can provide the underlying bearer for the VLAN subinterface, this provides the foundation for subsequent VLAN network card configuration. All virtual VLAN subinterfaces must rely on the physical network card for data transmission. As the hardware device that actually sends and receives data, the physical network card is a prerequisite for the existence of a VLAN subinterface. Furthermore, the physical network card can be configured in trunk mode to receive and send data frames carrying VLAN tags.

[0105] In some embodiments, S201 is specifically as follows:

[0106] Set the network interface type of the primary network card to Ethernet.

[0107] Set the IP address configuration method to static address.

[0108] Set the logical interface name and physical network card device name according to the name of the physical network card device in the Linux server.

[0109] Configure the Linux server to automatically activate the primary network card interface at startup.

[0110] For example, Ethernet is a widely used local area network technology standard and is the main standard used by the main network card.

[0111] For example, setting the configuration mode of the Internet Protocol address to configure a static address can improve network stability and network security.

[0112] Exemplarily, the logical interface name and the physical network card device name are set according to the name of the physical network card device in the Linux server. For example, the name of the physical network card device can be directly used as the logical interface name and the physical network card device name.

[0113] Exemplarily, setting the Linux server to automatically activate the interface of the primary network card when starting up can process traffic forwarding of all sub-interfaces each time the Linux server starts up without the need for manual startup by the user.

[0114] S202. Configure multiple VLAN network cards of the Linux server.

[0115] For example, the number of VLAN network cards can be set according to actual applications, for example, 2 or 5 can be set.

[0116] In some implementations, S202 may be specifically as follows:

[0117] Perform the following steps for each VLAN network card:

[0118] Set the interface type of the current VLAN network card to VLAN interface.

[0119] Set the IP address configuration method to static address.

[0120] Set the VLAN interface name according to the name of the physical network card device in the Linux server.

[0121] Enable the VLAN function on the Linux server.

[0122] Set the Internet Protocol address of the current VLAN network card.

[0123] Set the subnet range corresponding to the interface of the current VLAN network card.

[0124] For example, if two VLAN network cards need to be set, and the current VLAN network card is VLAN network card 1, the above steps are performed for VLAN network card 1.

[0125] Exemplarily, setting the VLAN interface name according to the name of the physical network card device in the Linux server can be to add a subname used to represent each VLAN network card after the name of the physical network card device. For example, if the name of the physical network card device is eth0, the VLAN interface name can be ens0.10.

[0126] S203: Set the routing and forwarding function of the Linux server.

[0127] For example, after the routing and forwarding function is enabled, the Linux server can connect to multiple physically isolated subnets, thereby upgrading the Linux server from an ordinary server to a network core hub, providing a basis for effectively processing information from multiple VLANs.

[0128] S204: Use iptables to configure the firewall policy corresponding to each firewall interface, wherein each firewall interface includes the target firewall interface.

[0129] Using iptables, you can achieve fine-grained control of logarithmic flows, including source address, destination address, port, etc. Due to the rich configuration options of iptables, you can easily add, delete, modify, and check rules to meet continuous network needs, ensuring the flexibility and scalability of security policies.

[0130] For example, a firewall program may be used to configure the firewall policy corresponding to each firewall interface.

[0131] In some embodiments, S204 is specifically used to:

[0132] In response to the user's rule configuration operation on each firewall interface based on iptables, a firewall policy corresponding to each firewall interface is generated.

[0133] For example, the user can match various iptables rules with the firewall interface to generate a firewall policy corresponding to each firewall interface.

[0134] S205: Receive target information sent by the switch.

[0135] The implementation of S205 in this embodiment is similar to that of S101 in the previous embodiment, and will not be repeated here.

[0136] S206: Determine the corresponding target firewall interface according to the target identifier.

[0137] The implementation of S206 in this embodiment is similar to that of S102 in the previous embodiment, and will not be repeated here.

[0138] S207: Determine the target firewall policy corresponding to the target firewall interface.

[0139] The implementation of S207 in this embodiment is similar to that of S103 in the previous embodiment, and will not be repeated here.

[0140] S208: Perform corresponding data processing on the target communication data according to the target firewall policy.

[0141] The implementation of S208 in this embodiment is similar to that of S104 in the previous embodiment, and will not be repeated here.

[0142] This embodiment provides a firewall-based information processing method that connects a switch to a Linux server using a trunk connection, enabling data transmission from multiple VLANs over a single physical link. Furthermore, the switch's VLAN functionality is combined with the Linux server's firewall software to form a multi-interface firewall system. By configuring firewall rules using iptables or firewall on the Linux server, packets from different VLANs can be filtered and controlled.

[0143] The firewall-based information processing method provided in this embodiment can achieve precise management and security control of switch VLAN and physical port data flows. This method not only improves network security, but also provides administrators with an expanded security solution to adapt to the ever-changing network environment.

[0144] In order to better understand the firewall-based information processing method provided in the embodiment of the present application, a specific application implementation method is described below.

[0145] This embodiment of the application leverages the synergy between the switch's VLAN functionality and the Linux server. By dividing VLANs on the switch and treating each VLAN as a logical interface for the Linux server, it achieves isolation and management of different VLANs. Through this collaborative operation, the Linux server can simultaneously process packets from different VLANs.

[0146] like Figure 3As shown, the Linux server (i.e. LINUX in the figure) is connected to the switch through a TRUNK connection. On the Linux server, a plurality of virtual interfaces are configured, such as eth0.10, eth0.20 to eth0.n in Figure 3 . Each virtual interface is configured with a corresponding firewall rule and security policy to achieve filtering, forwarding and interception of different VLAN data packets. The VLAN corresponding to each virtual interface is shown in Figure 3 . As shown, the VLANs are VLAN10, VLAN20 to VLANn.

[0147] The key of the embodiment of the present application is that the switch VLAN and the Linux server work together to regard the VLAN as a firewall interface of the Linux server, thereby forming a multi-interface firewall system. If different physical ports are classified into different VLANs, a multi-physical-interface firewall system is formed. By effectively utilizing existing network equipment and firewall technology, finer-grained control and management of network traffic is achieved, and the security and manageability of the network are improved.

[0148] The method of the embodiment of the present application also provides a flexible security policy mechanism. The administrator can dynamically adjust the security rules to adapt to the changing network environment and security threats.

[0149] In the embodiment of the present application, as shown in Figure 4 , three VLANs are connected to the switch device for illustrative purposes, and the three VLANs are (VLAN10 / VLAN20 / VLANn).

[0150] VLAN10 / VLAN20 / VLANn are three local area networks on the switch, and are respectively assigned different address segments, i.e. Figure 4 VLAN10 corresponds to IP: 192.168.1, VLAN20 corresponds to IP: 192.168.2, and VLANn corresponds to IP: 192.168.n. The Linux Server is used to process VLAN data.

[0151] Eth0 is a physical interface of the Linux server, and is respectively connected to the three VLANs of the switch.

[0152] Sub-interface (i.e. the abbreviation Sub-int in Figure 4 ) is a VLAN sub-interface on the Linux server, and is used to process data streams of each VLAN. Each sub-interface is bound to a corresponding VLAN data stream and is configured with an IP address corresponding to the VLAN. Among them, VLAN10 corresponds to eth0.10, VLAN20 corresponds to eth0.20, and VLANn corresponds to eth0.n.

[0153] Each VLAN runs iptables to achieve precise control of data flow.

[0154] The configuration process example of this embodiment (two VLANs are used as an example) is as follows:

[0155] Configure the primary network card on the Linux server:

[0156] - Open the configuration file `ifcfg-eth0` to edit the configuration of the primary physical network card.

[0157] TYPE=Ethernet (specifies the interface type as Ethernet)

[0158] BOOTPROTO=none (indicates that DHCP (Dynamic Host Configuration Protocol) is not used to automatically obtain an IP address, and a static address must be manually configured)

[0159] NAME=eth0 (defines the logical interface name)

[0160] DEVICE=eth0 (specify the physical network card device name)

[0161] ONBOOT=yes (set the interface to be automatically activated when the system starts)

[0162] Configure two VLAN network cards:

[0163] - Open the configuration file `ifcfg-eth0.10` to edit the configuration of VLAN 10 network card.

[0164] TYPE=vlan (declares the interface type as a VLAN virtual interface)

[0165] BOOTPROTO=none

[0166] DEVICE=ens0.10 (specify the virtual interface name)

[0167] ONBOOT=yes

[0168] VLAN=yes (explicitly enable VLAN function)

[0169] IPADDR=10.72.69.1 (set IP address)

[0170] PREFIX=23 (defines the subnet range)

[0171] - Open the configuration file `ifcfg-eth0.20` to edit the configuration of VLAN 20 network card.

[0172] TYPE=vlan

[0173] BOOTPROTO=none

[0174] DEVICE=eth0.20

[0175] ONBOOT=yes

[0176] VLAN=yes

[0177] IPADDR=134.32.69.1

[0178] PREFIX=23

[0179] Set up routing forwarding:

[0180] To enable intra-machine routing and forwarding, edit the / etc / sysctl.conf file and uncomment or add the following line:

[0181] net.ipv4.ip_forward=1

[0182] Implementing fine-grained control between VLANs (example):

[0183] iptables -t filter -A INPUT -s 10.72.69.0 / 24 -d 134.32.69.100 -i eth0.10 -jACCEPT (Allows traffic from VLAN10 subnet (10.72.69.0 / 24) to VLAN20 (134.32.69.100)).

[0184] The above iptables rules implement cross-VLAN access control. The specific analysis is as follows:

[0185] -t filter: specifies the filter table (default table), which is mainly used for packet filtering.

[0186] -A INPUT: Append rules to the end of the INPUT chain to process data packets whose destination address is the local machine.

[0187] -s 10.72.69.0 / 24: matches the source IP address of VLAN 10 subnet.

[0188] -d 134.32.69.100: matches a specific host whose target IP address is VLAN 20.

[0189] -i eth0.10: Limits matching to traffic entering from VLAN 10 interface (eth0.10).

[0190] - j ACCEPT: Perform an allow operation on matching traffic.

[0191] Control granularity and port scalability:

[0192] Fine-grained control: Using iptables can achieve fine-grained control of the number of streams, including source address, destination address, port, etc. Due to the rich configuration options of iptables, rules can be easily added, deleted, modified, and searched to meet the changing network needs, ensuring the flexibility and scalability of security policies.

[0193] Port scalability: Since the switch has a large number of ports, it has good port scalability.

[0194] The scheme can realize accurate management and security control of switch VLAN and physical port data flow. This method not only improves network security, but also provides an extended security solution for administrators to adapt to changing network environments.

[0195] The method of the embodiment takes the VLAN and physical port of the switch as a sub-interface of the Linux firewall, and uses the iptables and firewalld firewalls to accurately control the VLAN data. The current switch and Linux server generally support the above configurations.

[0196] The method of the embodiment can associate the VLAN and physical port of the switch to the Linux firewall in the trunk mode, increase the number of firewall ports, and the firewall can realize accurate filtering, forwarding or rejection of data flow by configuring firewall rules on the Linux sub-interface.

[0197] The method of the embodiment provides a flexible security policy mechanism, and administrators can dynamically adjust security rules to adapt to changing network environments and security threats. The security policy mechanism has been tested in the live network for a long time.

[0198] Embodiment 3

[0199] As shown in Figure 5 The firewall-based information processing apparatus 400 provided by the embodiment of the application is located in a server, the server is in communication connection with a switch through a relay trunk link, and the server is provided with a plurality of firewall interfaces, each firewall interface corresponds to each virtual local area network VLAN of the switch one by one, wherein the firewall interface is a logical interface, and the firewall-based information processing apparatus 400 can include:

[0200] The receiving module 401 is configured to receive target information sent by the switch. The target information includes a target identifier of the VLAN and target communication data to be processed.

[0201] The first determining module 402 is configured to determine a corresponding target firewall interface according to the target identifier.

[0202] The second determining module 403 is configured to determine a target firewall policy corresponding to a target firewall interface.

[0203] The processing module 404 is configured to perform corresponding data processing on the target communication data according to the target firewall policy.

[0204] In some embodiments, the server is a Linux server. The Linux server is pre-installed with the IP packet filtering system iptables. The target firewall policy is pre-configured by iptables.

[0205] The processing module 404 is specifically used for:

[0206] If the target firewall policy is to allow only HTTP data, the system determines whether all target communication data complies with HTTP. If it is determined that all target communication data complies with HTTP, the system allows the target communication data to pass. If it is determined that some target communication data complies with HTTP, the system filters the target communication data to allow the portion that complies with HTTP to pass.

[0207] In some embodiments, the firewall-based information processing device 400 further includes:

[0208] The configuration module is used to configure the Linux server's primary network interface card (NIC). It also configures multiple VLAN NICs for the Linux server. It also sets up routing and forwarding functions for the Linux server. It also uses iptables to configure firewall policies for each firewall interface, including the target firewall interface.

[0209] In some implementations, when configuring the primary network card of a Linux server, the configuration module is specifically used to:

[0210] Set the network interface type of the primary NIC to Ethernet. Set the Internet Protocol address configuration method to static. Set the logical interface name and physical NIC device name based on the physical NIC device name in the Linux server. Set the Linux server to automatically activate the primary NIC interface at startup.

[0211] In some implementations, when configuring multiple VLAN network cards of a Linux server, the configuration module is specifically configured to:

[0212] Perform the following steps for each VLAN network card:

[0213] Set the interface type of the current VLAN network card to VLAN interface. Set the Internet Protocol address configuration method to static address configuration. Set the VLAN interface name based on the physical network card device name in the Linux server. Enable the VLAN feature in the Linux server. Set the Internet Protocol address of the current VLAN network card. Set the subnet range corresponding to the interface of the current VLAN network card.

[0214] In some implementations, when the configuration module uses iptables to configure the firewall policy corresponding to each firewall interface, it is specifically used to:

[0215] In response to the user's rule configuration operation on each firewall interface based on iptables, a firewall policy corresponding to each firewall interface is generated.

[0216] In some implementations, the second determining module 403 is further configured to:

[0217] The target identifier is verified for compliance. If the verification result of the target identifier is determined to be compliant, the step of determining a target firewall policy corresponding to the target firewall interface is performed.

[0218] The firewall-based information processing device provided in the embodiment of the present application has the beneficial effects and implementation methods of the firewall-based information processing methods provided in Examples 1 and 2 of the present application. For details, please refer to the specific description of the firewall-based information processing method in the above Examples 1 and 2, which will not be repeated in this embodiment.

[0219] Example 4

[0220] The present application also provides a server, which includes:

[0221] Memory and processor.

[0222] Memory stores computer-executable instructions.

[0223] The processor executes the computer-executable instructions stored in the memory to implement the firewall-based information processing method as described in Example 1 and Example 2.

[0224] The server provided in the embodiment of the present application has the beneficial effects and implementation methods of the firewall-based information processing methods of Examples 1 and 2 of the present application. For details, please refer to the specific description of the firewall-based information processing methods in the above Examples 1 and 2, and this embodiment will not be repeated here.

[0225] Example 5:

[0226] This embodiment further provides a computer-readable storage medium on which a computer program is stored. When the computer program is executed by a processor, the firewall-based information processing method in the above-mentioned embodiment 1 or embodiment 2 is implemented.

[0227] The computer-readable storage medium provided in the embodiment of the present application has the beneficial effects and implementation methods of the firewall-based information processing methods of Embodiments 1 and 2 of the present application. For details, please refer to the specific description of the firewall-based information processing methods in the above-mentioned Embodiments 1 and 2, and this embodiment will not be repeated here.

[0228] Those skilled in the art will readily conceive of other implementations of the embodiments of the present application after considering the specification and practicing the invention disclosed herein. This application is intended to cover any variations, uses, or adaptations of the embodiments of the present application, which follow the general principles of the embodiments of the present application and include common knowledge or customary technical means in the art not disclosed in the embodiments of the present application.

[0229] It is understood that the above embodiments are merely exemplary embodiments for illustrating the principles of the present application, and the present application is not limited thereto. Those skilled in the art may make various modifications and improvements without departing from the spirit and substance of the present application, and such modifications and improvements are also considered to be within the scope of protection of the present application.

Claims

1. A firewall-based information processing method, characterized in that: Applied to a server, the server is communicatively connected to a switch via a trunk link, and the server is provided with multiple firewall interfaces, each of which corresponds to a virtual local area network (VLAN) of the switch, wherein the firewall interface is a logical interface, and the method includes: Receive target information sent by the switch; the target information includes a target identifier of the VLAN and target communication data to be processed; Determine the corresponding target firewall interface according to the target identifier; Determining a target firewall policy corresponding to the target firewall interface; Perform corresponding data processing on the target communication data according to the target firewall policy.

2. The method according to claim 1, characterized in that The server is a Linux server; the Linux server is pre-installed with an IP packet filtering system iptables; the target firewall policy is pre-configured by the iptables; The performing corresponding data processing on the target communication data according to the target firewall policy includes: If the target firewall policy is to allow only Hypertext Transfer Protocol Security data to pass through, then determining whether all the target communication data complies with the Hypertext Transfer Protocol Security; if it is determined that all the target communication data complies with the Hypertext Transfer Protocol Security, then allowing the target communication data to pass through; If it is determined that part of the target communication data complies with the Hypertext Transfer Security Protocol, the target communication data is filtered to allow part of the data that complies with the Hypertext Transfer Security Protocol to pass.

3. The method according to claim 2, characterized in that Before receiving the target information sent by the switch, the method further includes: Configure the primary network card of the Linux server; Configuring multiple VLAN network cards of the Linux server; Setting the routing and forwarding function of the Linux server; The iptables is used to configure the firewall policy corresponding to each of the firewall interfaces; wherein each of the firewall interfaces includes the target firewall interface.

4. The method according to claim 3, characterized in that Configuring the primary network card of the Linux server includes: Set the network interface type of the primary network card to Ethernet; Set the configuration mode of the Internet Protocol address to configure a static address; Set the logical interface name and physical network card device name according to the name of the physical network card device in the Linux server; Set the Linux server to automatically activate the interface of the primary network card when it starts.

5. The method according to claim 3, characterized in that The configuring of multiple VLAN network cards of the Linux server includes: Perform the following steps for each VLAN network card: Set the interface type of the current VLAN network card to VLAN interface; Set the configuration mode of the Internet Protocol address to configure a static address; Set the VLAN interface name according to the name of the physical network card device in the Linux server; Setting the VLAN function in the Linux server to be enabled; Set the Internet Protocol address of the current VLAN network card; Set the subnet range corresponding to the interface of the current VLAN network card.

6. The method according to claim 3, characterized in that The firewall policy corresponding to each firewall interface configured by using the iptables includes: In response to the user's rule configuration operation on each of the firewall interfaces based on the iptables, a firewall policy corresponding to each of the firewall interfaces is generated.

7. The method according to claim 1, characterized in that Before determining the target firewall policy corresponding to the target firewall interface, the method further includes: Performing compliance verification on the target identifier; If it is determined that the verification result of the target identifier is compliant, the step of determining the target firewall policy corresponding to the target firewall interface is performed.

8. An information processing device based on a firewall, characterized in that: Located on a server, the server is communicatively connected to a switch via a trunk link, and the server is provided with multiple firewall interfaces, each of which corresponds to a virtual local area network (VLAN) of the switch, wherein the firewall interface is a logical interface, and the device comprises: A receiving module, configured to receive target information sent by the switch; the target information includes a target identifier of the VLAN and target communication data to be processed; A first determining module, configured to determine a corresponding target firewall interface according to the target identifier; A second determining module is used to determine a target firewall policy corresponding to the target firewall interface; A processing module is used to perform corresponding data processing on the target communication data according to the target firewall policy.

9. A server, characterized in that: include: memory and processor; The memory stores computer-executable instructions; The processor executes the computer-executable instructions stored in the memory to implement the firewall-based information processing method according to any one of claims 1 to 7.

10. A computer-readable storage medium, characterized in that The computer-readable storage medium stores computer-executable instructions, which, when executed by a processor, are used to implement the firewall-based information processing method according to any one of claims 1 to 7.

Images