A method, system, device and medium for accessing intranet services on demand

Abstract

The application belongs to the technical field of computer networks, and particularly relates to a method, system, device and medium for on-demand access to intranet services, which comprises that a client host sends a service access request to a control node; the control node executes cooperative configuration according to the service access request: cooperates with a boundary host to configure a port forwarding running environment; cooperates with a boundary routing device to establish a temporary network address translation (NAT) rule; returns connection information to the client host for the client host to establish a forwarding tunnel to the routing device; and distributes routing configuration information to the host and a target host for the host and the target host to establish a routing reachable path. Finally, the client host accesses intranet services of the target host on demand through the forwarding tunnel and the routing path. The application dynamically coordinates SSH tunnel, temporary NAT and BGP routing leakage through a control plane, realizes on-demand, automatic construction and destruction of an access link, and significantly improves the efficiency of network operation and maintenance.

Description

Technical Field

[0001] This application belongs to the field of computer network technology, and in particular relates to a method, system, device and medium for on-demand access to intranet services. Background Technology

[0002] VxLAN (Virtual Extensible LAN) is a network virtualization technology used to build Layer 2 virtual networks across Layer 3 networks in data centers or large-scale cloud environments. It is a type of overlay network. It enables workloads such as virtual machines or containers to communicate across physical networks by encapsulating Layer 2 frames over existing IP networks.

[0003] Chinese patent application publication number CN114567616A discloses a method, system, and device for VxLAN NAT traversal. In this method, a first VTEP sends a VxLAN packet to a NAT device. The NAT device converts the source address of the first VTEP carried in the VxLAN packet to a public IP address, resulting in a new VxLAN packet. A second VTEP receives the new VxLAN packet and generates a corresponding initial response packet. Based on the MAC address of the first VTEP carried in the initial response packet, the second VTEP searches in a target mapping table to determine the target port number. It then sends a target response packet carrying the target port number and public IP address to the NAT device. The NAT device converts the public IP address in the target response packet to a private IP address and the target port number to a private port number before sending it back to the first VTEP, thus achieving NAT traversal.

[0004] Existing technologies rely on NAT mapping to access hosts in VxLAN, which requires configuring NAT information on the VTEP gateway and gateways at all levels. This requires administrators at each level of the network to grant permissions and perform related configuration operations, making it inconvenient to use. Summary of the Invention

[0005] To address the aforementioned issues, this application provides a method, system, device, and medium for on-demand access to intranet services. It employs a technical architecture that deeply integrates cloud-native control plane and network technology, enabling a secure, automatic, and dynamic intranet service access mechanism that effectively solves the problem of cumbersome network operation and maintenance access configuration.

[0006] Firstly, this application provides a method for on-demand access to intranet services, the method comprising:

[0007] The client host sends a service access request to the control node;

[0008] The control node performs a collaborative configuration operation based on the service access request information. The collaborative configuration operation includes:

[0009] It collaborates with the host machine at the network boundary where the target service is located to configure the runtime environment required for port forwarding;

[0010] Collaborate with routing devices at the network boundary to establish temporary network address translation rules for external access;

[0011] Return connection establishment information to the client host so that the client host can establish a forwarding tunnel to the routing device based on the connection establishment information;

[0012] Distribute routing configuration information to the host machine and the target host carrying the target service, so that the host machine and the target host can establish a route reachable path between them based on the routing configuration information;

[0013] The client host accesses intranet services running on the target host as needed through the forwarding tunnel and the route reachable path.

[0014] Furthermore,

[0015] The runtime environment required to configure port forwarding includes:

[0016] The control node establishes a first cluster with the host machine;

[0017] The control node uses container orchestration technology to deploy and run container instances that provide SSH services on the host machine.

[0018] Furthermore,

[0019] To establish temporary network address translation rules for external access, specifically including:

[0020] The control node establishes a second cluster with the routing device;

[0021] The control node interacts with the first daemon running on the routing device;

[0022] The first daemon process creates and maintains temporary NAT mapping entries on the routing device, mapping the service port of the SSH service container on the host machine to the external IP address and external port number of the routing device.

[0023] Furthermore,

[0024] Returning connection establishment information to the client host, specifically including:

[0025] The control node sends the second quintuple information to the second daemon process on the client host via a remote procedure call.

[0026] The second 5-tuple information includes: external service port, target host IP address, internal service port, external IP address of the routing device, and external SSH service port number of the routing device.

[0027] Furthermore,

[0028] To enable the client host to establish a forwarding tunnel to the routing device based on the connection establishment information, specifically including:

[0029] The second daemon process on the client host automatically constructs an SSH local port forwarding command based on the received second 5-tuple information;

[0030] Execute the SSH command to establish an SSH connection with the external IP address and external SSH service port number of the routing device, thereby creating an encrypted forwarding tunnel from the local port of the client host to the internal service of the target host.

[0031] Furthermore,

[0032] This allows the host machine and the target host to establish a reachable routing path between them based on the routing configuration information, specifically including:

[0033] The control node transmits first routing triplet information to the host machine. The first routing triplet information includes the target host IP, autonomous system number (ASN), and overlay network identifier (VNI).

[0034] The control node transmits a second routing triplet information to the target host. The second routing triplet information includes the host IP, ASN, and underlying network identifier VNI.

[0035] The host machine and the target host construct route identifiers based on the received first route triplet information and second route triplet information, and disclose routes to each other through the BGP protocol to achieve route reachability between the overlay network and the underlying network.

[0036] Furthermore,

[0037] The host machine and the target host construct route identifiers based on the received first route triplet information and second route triplet information, respectively, specifically including:

[0038] Based on the first routing triplet information, the host machine generates a route distinguisher RD and a route target RT for its VRF-Underlay.

[0039] Based on the second routing triplet information, the target host generates a route distinguisher RD and a route target RT for its VRF-Overlay.

[0040] Secondly, based on the same inventive concept, this application provides a system for on-demand access to intranet services, the system comprising:

[0041] The client host is configured to send service access request information to the control node;

[0042] The control node is configured to perform collaborative configuration operations based on the service access request information.

[0043] The control node includes:

[0044] The first collaboration module is used to establish the first cluster with the host machine and to deploy and run container instances that provide SSH services on the host machine through container orchestration technology, in order to configure the runtime environment required for port forwarding;

[0045] The second collaboration module is used to establish a second cluster with the routing device and interact with the first daemon running on the routing device, so that the first daemon creates and maintains temporary NAT mapping entries on the routing device, mapping the service port of the SSH service container on the host machine to the external IP address and external port number of the routing device.

[0046] The information distribution module is used to send a second 5-tuple of information to a second daemon process on the client host via a remote procedure call. The second 5-tuple of information includes: external service port, target host IP address, internal service port, external IP address of the routing device, and external SSH service port number of the routing device.

[0047] The routing configuration module is used to transmit a first routing triplet to the host machine and a second routing triplet to the target host. The first routing triplet includes the target host IP, Autonomous System Number (ASN), and Overlay Network Identifier (VNI). The second routing triplet includes the host IP, ASN, and Underlying Network Identifier (VNI).

[0048] Thirdly, this disclosure also provides an electronic device, including a processor, a communication interface, a memory, and a communication bus, wherein the processor, the communication interface, and the memory communicate with each other through the communication bus;

[0049] Memory, used to store computer programs;

[0050] When a processor executes a program stored in memory, it implements any of the on-demand access methods for intranet services as described above.

[0051] Fourthly, this disclosure also provides a computer storage medium storing a computer program, which, when executed by a processor, implements any of the on-demand access methods for intranet services as described above.

[0052] Compared with the prior art, this application has the following advantages:

[0053] 1. The method and system for on-demand access to intranet services provided in this application do not require configuring complex NAT information on the VTEP gateway and gateways at all levels, thereby avoiding the cumbersome process of relying on network administrators at all levels to grant permissions and perform related configuration operations, and greatly improving the convenience of use in the existing network.

[0054] 2. By constructing a collaborative working mechanism among client hosts, control nodes, host machines, and routing devices, this application enables on-demand access to intranet services, which not only improves the utilization of network resources but also enhances the security and flexibility of network access. Specifically, the control node can intelligently perform collaborative configuration operations, including collaborating with the host machine to configure the port forwarding environment and collaborating with the routing devices to establish temporary network address translation rules, thereby providing client hosts with a stable and efficient access path.

[0055] 3. This application further optimizes the network architecture and routing configuration by introducing container orchestration technology and the BGP protocol. Container orchestration technology makes the deployment and operation of SSH service containers more flexible and efficient, while the BGP protocol enables routing reachability between the overlay network and the underlying network, providing strong support for on-demand access to intranet services.

[0056] Other features and advantages of this application will be set forth in the description which follows, and will be apparent in part from the description, or may be learned by practicing the application. The objectives and other advantages of this application may be realized and obtained by means of the structures pointed out in the description, claims and drawings. Attached Figure Description

[0057] To more clearly illustrate the technical solutions in the embodiments of this application or the prior art, the drawings used in the description of the embodiments or the prior art will be briefly introduced below. Obviously, the drawings described below are some embodiments of this application. For those skilled in the art, other drawings can be obtained based on these drawings without creative effort.

[0058] Figure 1 A flowchart illustrating a method for on-demand access to intranet services according to an embodiment of this application is shown;

[0059] Figure 2A schematic diagram of the architecture of a K35 Master and a host machine according to an embodiment of this application is shown;

[0060] Figure 3 A schematic diagram of a routing device and its components working in conjunction with K3S Master, according to an embodiment of this application, is shown. Detailed Implementation

[0061] To make the objectives, technical solutions, and advantages of the embodiments of this application clearer, the technical solutions of the embodiments of this application will be clearly and completely described below with reference to the accompanying drawings. Obviously, the described embodiments are only some embodiments of this application, not all embodiments. Based on the embodiments of this application, all other embodiments obtained by those skilled in the art without creative effort are within the scope of protection of this application.

[0062] Figure 1 A flowchart illustrating a method for on-demand access to intranet services according to an embodiment of this application is shown, such as... Figure 1 As shown in the figure, an embodiment of this application provides a method for on-demand access to intranet services, the method comprising:

[0063] S1, The client host sends a service access request to the control node;

[0064] In this embodiment, Kubernetes (K8s) is an open-source container orchestration platform designed to simplify the deployment, scaling, and management of containerized applications. K8S / K3S is a lightweight Kubernetes distribution developed by RancherLabs. The K8S / K3S Master Node is the control node in the cluster, responsible for managing the cluster state and worker nodes. Client hosts are reachable from the K8S / K3S Master Node via routing, thus establishing a gRPC channel. The client host transmits the first 5-tuple information to the K8S / K3S Master Node via gRPC. The first 5-tuple information includes: external port number: outer_service_port, internal service number: inner_service_port, target host IP address: dst_ip, external IP address: outer_ip, and host IP address: host_ip. gRPC is a high-performance RPC (Remote Procedure Call) framework developed by Google, based on HTTP / 2 and Protocol Buffers (Protobuf) protocols.

[0065] S2, the control node performs a collaborative configuration operation based on the service access request information, the collaborative configuration operation including:

[0066] S21, collaborate with the host machine at the network boundary where the target service is located to configure the operating environment required for port forwarding;

[0067] In this embodiment of the application, step S21 specifically includes:

[0068] S211, The control node establishes a first cluster with the host machine;

[0069] S212, the control node deploys and runs a container instance providing SSH service on the host machine through container orchestration technology.

[0070] In this embodiment, the administrator needs to add the aforementioned host machine and K8S / K3S Master Node to a cluster (Cluster1). A Pod is the smallest deployment unit in Kubernetes, consisting of one or more closely related containers that share network namespaces and storage resources. The K8S / K3S Master starts a TCP or UDP service corresponding to the specified port number through the pod; for example, port 22 is typically used to represent the TCP-based SSH (Secure Shell) service.

[0071] Figure 2 A schematic diagram of the architecture of a K35 Master and host machine according to an embodiment of this application is shown. See also: Figure 2 As shown, the K8S / K3S Master Node and the host machine are joined to the same cluster (Cluster1). The host machine can be configured via the K8S / K3S YAML configuration file, which includes the information required for BGP route leakage: host machine IP, ASN, and overlay VNI. The Kubernetes API Server (kube-apiserver) is the core component of the Kubernetes cluster. As the control plane "gateway," it handles all API requests for cluster management operations and coordinates data interactions with other components, serving as the communication hub and security barrier for the entire cluster. The host machine constructs RT (Route Target) and RD (Route Distinguisher) based on <virtual machine IP, ASN, overlay VNI>.

[0072] The Kubernetes / K3S Master Node communicates with the virtual machine D1 via gRPC to transmit route leakage information: host IP, ASN, and underlay VNI. The virtual machine constructs the RT and RD based on <host IP, ASN, underlay VNI>. Here, ASN (Autonomous System Number) is assigned to the Autonomous System. VNI (Virtual Network Identifier) ​​is a 24-bit identifier in VXLAN (Virtual Extensible Local Area Network) technology used to identify different virtual networks (VXLAN tunnels).

[0073] In this embodiment, the control node deploys a container instance running the sshd process on the target host machine through the Kubernetes Deployment controller. A Kubernetes Deployment is a controller for managing Pods. Its core function is to automatically adjust the actual state of the application to the user-defined desired state through declarative configuration, supporting full lifecycle management such as deployment, rolling updates, rollback, and pause / resume. The K8S / K3S Master Node deploys the container running the sshd process on the host machine via K8S / K3S deployment based on the host_ip. This sshd process is responsible for subsequent port forwarding. The sshd (Secure Shell Daemon) is a server-side daemon based on the SSH (Secure Shell) protocol, used to provide secure remote login and file transfer services.

[0074] The information required for routing leaks between virtual machines and host machines, along with their usage rules, are shown in the table below:

[0075]

[0076] In this embodiment of the application, the administrator authorizes the customer to use the username and password: user_name / password.

[0077] S22, in coordination with routing devices at the network boundary, establishes temporary network address translation rules for external access;

[0078] In this embodiment of the application, step S22 specifically includes:

[0079] S221, the control node establishes a second cluster with the routing device;

[0080] S222, the control node interacts with the first daemon running on the routing device;

[0081] S223, the first daemon process creates and maintains a temporary NAT mapping table entry on the routing device, mapping the service port of the SSH service container on the host machine to the external IP address and external port number of the routing device.

[0082] In this embodiment, to complete the automatic configuration of the aforementioned NAT rules, the administrator sets up a daemon process P1 on the routing device. NAT (Network Address Translation) is a network address translation technology used by routers or firewalls to convert private IP addresses into public IP addresses, enabling internal network devices to access the Internet. Figure 3 A schematic diagram of a routing device and its components working in conjunction with K3S Master according to an embodiment of this application is shown. See also: Figure 3 As shown, the administrator adds the routing device and the K8S / K3S Master Node to a cluster (Cluster2). P1 is responsible for configuring NAT rules on the routing device. P1 needs to store the NAT rules in non-volatile storage space (such as SQLite (Structured Query Language Lite, a lightweight, embedded relational database management system) or etcd (an abbreviation of the Latin "et cetera" meaning "etc." and "distributed") on the routing device to store the NAT rule list. This list is different from the ordinary NAT rule list configured by the administrator; it is a temporary list. P1 deletes this list after the operation and maintenance is completed, thus supporting on-demand operation and maintenance.

[0083] The method described in this application can also be used for on-demand operation and maintenance in the following two extended scenarios:

[0084] Optionally, D1 is located in a VLAN rather than a VxLAN, meaning D1 and the host machine are not on the same physical host. Route reachability between the host machine and D1 can be achieved via BGP, static routing, or other methods. As long as the host machine and D1 are routable, the client host can access D1's services.

[0085] Optionally, the host machine mentioned above can also be a network device, as long as the network device can run an SSH daemon. Typically, network devices based on OpenWRT (a highly customizable embedded Linux distribution primarily used in routers and embedded devices, known for its open-source nature, flexibility, and powerful networking capabilities) use Dropbear to provide the SSH daemon.

[0086] S23, Return connection establishment information to the client host so that the client host can establish a forwarding tunnel to the routing device based on the connection establishment information;

[0087] In this embodiment of the application, step S23 specifically includes:

[0088] S231, the control node sends the second 5-tuple information to the second daemon process on the client host via a remote procedure call;

[0089] The second 5-tuple information includes: external service port, target host IP address, internal service port, external IP address of the routing device, and external SSH service port number of the routing device.

[0090] In this embodiment of the application, the control node sends a second 5-tuple of information to the second daemon process (the service process running in the background on the client side) of the client host through the remote procedure call (RPC) gRPC protocol. This 5-tuple is based on the first 5-tuple information, supplemented by the external SSH service port number of the routing device (outter_ssh_port, from the NAT mapping result), specifically including: external service port, target host IP, internal service port, external IP of the routing device, and external SSH port of the routing device.

[0091] In this embodiment of the application, step S23 further includes:

[0092] S232, the second daemon process on the client host automatically constructs an SSH local port forwarding command based on the received second 5-tuple information;

[0093] S233, Execute the SSH command to establish an SSH connection with the external IP address and external SSH service port number of the routing device, thereby creating an encrypted forwarding tunnel from the local port of the client host to the internal service of the target host.

[0094] In this embodiment, after receiving the above combined information, the daemon on the client host needs to follow the port forwarding syntax.

[0095] ssh -L inner_service_port:dst_ip:outter_service_port user_name@outter_ip -p outter_ssh_port

[0096] Automatically generate port forwarding commands to establish communication with the target host. Example:

[0097] The command `ssh -L 80:10.10.1.40:30442 admin@171.16.235.1 -p 10022` executes the command. The `-L` option indicates "local port forwarding," enabling the logical mapping of "client accessing a local port = accessing an intranet service."

[0098] S24, Distribute routing configuration information to the host machine and the target host carrying the target service, so that the host machine and the target host can establish a route reachable path between them based on the routing configuration information;

[0099] In this embodiment of the application, step S24 specifically includes:

[0100] S241, the control node transmits first routing triplet information to the host machine. The first routing triplet information includes the target host IP, autonomous system number (ASN), and overlay network identifier (VNI).

[0101] S242, the control node transmits second routing triplet information to the target host, the second routing triplet information including the host IP, ASN and underlying network VNI;

[0102] S243, the host machine and the target host construct route identifiers based on the received first route triplet information and second route triplet information, and disclose routes to each other through the BGP protocol to achieve route reachability between the overlay network and the underlying network.

[0103] ASN is the "Autonomous System Identity" in the BGP protocol, and the overlay network identifier VNI is the "Virtual Network Identifier" (24 bits, distinguishing different virtual networks) in VxLAN networks.

[0104] In this embodiment, the underlay VNI is the identifier of the underlying physical network, used to associate the physical network domain where the host machine is located.

[0105] In this embodiment of the application, step S243 specifically includes:

[0106] Based on the first routing triplet information, the host machine generates a route distinguisher RD and a route target RT for its VRF-Underlay.

[0107] Based on the second routing triplet information, the target host generates a route distinguisher RD and a route target RT for its VRF-Overlay.

[0108] In this embodiment of the application, the RD format on the host side is "ASN:overlay VNI" (e.g., when ASN=65000 and overlayVNI=100, RD=65000:100), and RT is used to control the "import / export" of routes (e.g., RT=65000:100 export means "export the route to the matching network domain").

[0109] In this embodiment of the application, the target host side RD format is "ASN:underlay VNI" (e.g., when underlay VNI=200, RD=65000:200), and the RT rules are complementary to those on the host side (e.g., RT=65000:200 import means "import matching routes").

[0110] S3, the client host accesses intranet services running on the target host as needed through the forwarding tunnel and the route reachable path.

[0111] Based on the above method, this application embodiment also provides a system for on-demand access to intranet services corresponding to the above method, the system comprising:

[0112] The client host is configured to send service access request information to the control node;

[0113] The control node is configured to perform collaborative configuration operations based on the service access request information.

[0114] The control node includes:

[0115] The first collaboration module is used to establish a first cluster with the host machine and deploy and run container instances that provide SSH services on the host machine through container orchestration technology to configure the runtime environment required for port forwarding;

[0116] The second collaboration module is used to establish a second cluster with the routing device and interact with the first daemon running on the routing device, so that the first daemon creates and maintains temporary NAT mapping entries on the routing device, mapping the service port of the SSH service container on the host machine to the external IP address and external port number of the routing device.

[0117] The information distribution module is used to send a second 5-tuple of information to a second daemon process on the client host via a remote procedure call. The second 5-tuple of information includes: external service port, target host IP address, internal service port, external IP address of the routing device, and external SSH service port number of the routing device.

[0118] The routing configuration module is used to transmit a first routing triplet to the host machine and a second routing triplet to the target host. The first routing triplet includes the target host IP, Autonomous System Number (ASN), and Overlay Network Identifier (VNI). The second routing triplet includes the host IP, ASN, and underlying network VNI.

[0119] Based on the same inventive concept as the aforementioned applications, this application also provides an electronic device. The electronic device of this application includes at least one processor and at least one memory electrically connected to the processor. The memory is electrically connected to the processor, and the memory stores instructions executable by the at least one processor. These instructions are executed by the at least one processor to enable the at least one processor to perform the method described above.

[0120] It should be noted that the electrical connections between the above-mentioned units do not necessarily represent the connections between lines. Indirect connections are applicable to the embodiments of this application as long as they achieve the purpose of this application.

[0121] Based on the same inventive concept, this application also provides a computer storage medium storing a computer program, which, when executed by a processor, implements the steps of the above method.

[0122] Although this application has been described in detail with reference to the foregoing embodiments, those skilled in the art should understand that modifications can still be made to the technical solutions described in the foregoing embodiments, or equivalent substitutions can be made to some of the technical features; and these modifications or substitutions do not cause the essence of the corresponding technical solutions to deviate from the spirit and scope of the technical solutions of the embodiments of this application.

Claims

1. A method for on-demand access to intranet services, characterized in that, The method includes: The client host sends a service access request to the control node; The control node performs a collaborative configuration operation based on the service access request information. The collaborative configuration operation includes: It collaborates with the host machine at the network boundary where the target service is located to configure the runtime environment required for port forwarding; The runtime environment required to configure port forwarding includes: The control node establishes a first cluster with the host machine; The control node deploys and runs container instances that provide SSH services on the host machine using container orchestration technology. Collaborate with routing devices at the network boundary to establish temporary network address translation rules for external access; To establish temporary network address translation rules for external access, specifically including: The control node establishes a second cluster with the routing device; The control node interacts with the first daemon running on the routing device; The first daemon process creates and maintains temporary NAT mapping entries on the routing device, mapping the service port of the SSH service container on the host machine to the external IP address and external port number of the routing device. Return connection establishment information to the client host so that the client host can establish a forwarding tunnel to the routing device based on the connection establishment information; Returning connection establishment information to the client host, specifically including: The control node sends the second quintuple information to the second daemon process on the client host via a remote procedure call. The second 5-tuple information includes: external service port, target host IP address, internal service port, external IP address of the routing device, and external SSH service port number of the routing device; To enable the client host to establish a forwarding tunnel to the routing device based on the connection establishment information, specifically including: The second daemon process on the client host automatically constructs an SSH local port forwarding command based on the received second 5-tuple information; Execute the SSH command to establish an SSH connection with the external IP address and external SSH service port number of the routing device, thereby creating an encrypted forwarding tunnel from the local port of the client host to the internal service of the target host; Distribute routing configuration information to the host machine and the target host carrying the target service, so that the host machine and the target host can establish a route reachable path between them based on the routing configuration information; This allows the host machine and the target host to establish a reachable routing path between them based on the routing configuration information, specifically including: The control node transmits first routing triplet information to the host machine. The first routing triplet information includes the target host IP, autonomous system number (ASN), and overlay network identifier (VNI). The control node transmits a second routing triplet information to the target host. The second routing triplet information includes the host IP, ASN, and underlying network identifier VNI. The host and the target host construct route identifiers based on the received first and second route triplet information, and leak routes to each other through the BGP protocol to achieve route reachability between the overlay network and the underlying network. The client host accesses intranet services running on the target host as needed through the forwarding tunnel and the route reachable path.

2. The method according to claim 1, characterized in that, The host machine and the target host construct route identifiers based on the received first route triplet information and second route triplet information, respectively, specifically including: Based on the first routing triplet information, the host machine generates a route distinguisher RD and a route target RT for its VRF-Underlay. Based on the second routing triplet information, the target host generates a route distinguisher RD and a route target RT for its VRF-Overlay.

3. A system for on-demand access to intranet services, employing the method for on-demand access to intranet services as described in any one of claims 1-2, characterized in that, The system includes: The client host is configured to send service access request information to the control node; The control node is configured to perform collaborative configuration operations based on the service access request information. The control node includes: The first collaboration module is used to establish the first cluster with the host machine and to deploy and run container instances that provide SSH services on the host machine through container orchestration technology, in order to configure the runtime environment required for port forwarding; The second collaboration module is used to establish a second cluster with the routing device and interact with the first daemon running on the routing device, so that the first daemon creates and maintains temporary NAT mapping entries on the routing device, mapping the service port of the SSH service container on the host machine to the external IP address and external port number of the routing device. The information distribution module is used to send a second 5-tuple of information to a second daemon process on the client host via a remote procedure call. The second 5-tuple of information includes: external service port, target host IP address, internal service port, external IP address of the routing device, and external SSH service port number of the routing device. The routing configuration module is used to transmit a first routing triplet to the host machine and a second routing triplet to the target host. The first routing triplet includes the target host IP, Autonomous System Number (ASN), and Overlay Network Identifier (VNI). The second routing triplet includes the host IP, ASN, and Underlying Network Identifier (VNI).

4. An electronic device, characterized in that, It includes a processor, a communication interface, a memory, and a communication bus, wherein the processor, the communication interface, and the memory communicate with each other through the communication bus; Memory, used to store computer programs; A processor, when executing a program stored in memory, implements the method for on-demand access to intranet services as described in any one of claims 1-2.

5. A computer storage medium, characterized in that, The computer storage medium stores a computer program, which, when executed by a processor, implements the method for on-demand access to intranet services as described in any one of claims 1-2.

Images