Symmetrical firewall penetration method and system

Abstract

The invention discloses a symmetric firewall penetrating method and system, in the system, a client collects key information required for penetrating a firewall in a TCP SYN message and notifies a server by means of a controller, and the server sends the required TCP message to penetrate the firewall and then can directly provide service for the client. And the service cost is greatly reduced while the security is ensured.

Description

Technical Field

[0001] This invention relates to the field of communications, and in particular to a method and system for symmetrical firewall penetration. Background Technology

[0002] A symmetric firewall is a common firewall mechanism in networks. Its core characteristic is that only external hosts that have been actively accessed by internal hosts and whose IP addresses and ports are specified can send data packets to that internal host. Its behavior is similar to port-restricted NAT in traditional NAT (Network Address Translation), but it does not modify IP addresses or ports; instead, it restricts incoming connections through strict access control policies.

[0003] In traditional NAT networks, the most common traversal technique is UDP hole punching, which requires both parties to send packets to each other simultaneously. This is difficult to coordinate and is not suitable for TCP connection scenarios. Therefore, it is difficult to ensure that devices behind the firewall can provide TCP services to the outside world using this method.

[0004] The aforementioned limitations make it difficult for servers behind symmetric firewalls to directly provide TCP services to clients in existing technologies, generally requiring the use of relay devices; this results in a significant waste of bandwidth and increases service costs. Summary of the Invention

[0005] To enable a server located behind a symmetric firewall to directly provide services to a client, this invention provides a method and system for symmetric firewall traversal. The technical solution is as follows: One method for traversing a symmetrical firewall is characterized in that the method includes: The server reports its IP address to the controller; The client collects TCP SYN packet information and sends a message to notify the controller; The controller forwards the message to the server based on the destination IP address in the message; The server constructs a TCP packet based on the message.

[0006] This invention also provides a system for symmetric firewall traversal, the system comprising: a server, a client, and a controller; The server is used to report the IP address to the controller and construct and send TCP packets based on the controller's messages; The client is used to collect TCP SYN packet information and send messages to the controller; The controller is used to assist the client in notifying the server of information about firewall penetration.

[0007] Compared with the prior art, the beneficial effects of the present invention are that the server can penetrate the symmetric firewall to directly provide network services to the client, which is low-cost, simple to operate, and can ensure the security of the server. Attached Figure Description

[0008] Figure 1 These are network diagrams illustrating firewall penetration provided in Embodiments 1 and 2 of the present invention;

[0009] Figure 2 This is a schematic diagram of the firewall penetration system provided in Embodiment 3 of the present invention. Detailed Implementation

[0010] To make the objectives, technical solutions, and advantages of the present invention clearer, the embodiments of the present invention will be described in further detail below with reference to the accompanying drawings.

[0011] Example 1 See Figure 1 This is a network topology diagram of firewall penetration provided in an embodiment of the present invention. Figure 1 In this example, a client uses application A to access a TCP service running on a dedicated port P on the server. For ease of implementation, a controller is pre-defined between the client and server. The controller needs to ensure unimpeded communication with both the client and server, such as a server with a fixed public IP address. The specific steps for client application A to access server port P are as follows: Step 101: The server reports its own IP address to the controller.

[0012] Step 102: After receiving the IP address reported by the server, the controller saves it.

[0013] Step 103: Application A sends a TCP SYN packet with the destination address being the server's IP address.

[0014] Step 104: The client collects the five-tuple information (source port, source IP address, destination port, destination IP address, protocol type) of the TCP SYN packet from Step 103, and sends a message to the controller containing the collected five-tuple information; Clients can collect 5-tuple information by listening to TCP SYN packets or by using operating system commands (such as netstat) to view the TCP state table.

[0015] Step 105: After receiving the message from the client, the controller finds the target device as the server based on the destination IP address in the message and forwards the message to the server.

[0016] Step 106: After receiving the message from the controller, the server constructs and sends a TCP packet to the client based on the five-tuple information carried in the message. The source IP address / port of the packet is the destination IP address / port in the message, and the destination IP address / port of the packet is the source IP address / port in the message. The TCP packet constructed by the server may be one or more different combinations of TCP SYN+ACK, TCP RESET, TCP SYN, TCP FIN, and TCP datagrams. In some scenarios, it may be necessary to send a TCP RESET packet first, followed by a TCP SYN+ACK packet.

[0017] After completing steps 101 to 106 above, the firewall has been penetrated, and the client and server can then establish a TCP connection.

[0018] Example 2 See Figure 1 This is a network topology diagram of firewall penetration provided in an embodiment of the present invention. Figure 1 In this example, a client uses application A to access a TCP service running on a dedicated port P on the server. For ease of implementation, a controller is pre-defined between the client and server. The controller needs to ensure unimpeded communication with both the client and server, such as a server with a fixed public IP address. The specific steps for client application A to access server port P are as follows: Step 201: The server reports its own IP address to the controller.

[0019] Step 202: After receiving the IP address reported by the server, the controller saves it.

[0020] Step 203: Application A sends a TCP SYN packet with the destination address being the server's IP address.

[0021] Step 204: The client listens for TCP SYN packets and sends a message to the controller. The message contains key information about the TCP SYN packet, including the five-tuple information, sequence number, options, etc.

[0022] Step 205: After receiving the message from the client, the controller finds the target device as the server based on the destination IP address in the message and forwards the message to the server.

[0023] Step 206: After receiving the message from the controller, the server constructs a TCP packet based on the information carried in the message and sends it to the local machine. The constructed TCP packet and the key information of the packet detected in step 204 must be consistent.

[0024] Step 207: After receiving the TCP SYN packet constructed in step 206, port P normally sends TCP SYN+ACK in response.

[0025] After completing steps 201 to 207 above, the firewall has been penetrated, and the client and server can then establish a TCP connection.

[0026] In this embodiment of the invention, neither the client nor the server application is aware of firewall penetration, and no additional operation is required.

[0027] Example 3 See Figure 2 The firewall traversal system provided in this embodiment of the invention includes: a server, used to report IP addresses to a controller and construct and send TCP packets according to messages from the controller; a client, used to collect TCP SYN packet information and send messages to the controller; and a controller, used to assist the client in notifying the server of firewall traversal information.

[0028] The server side includes: The control module is used by the server to report the IP address of the service provider to the controller, and at the same time to receive messages from the controller; The message sending module is used to construct and send TCP messages.

[0029] The client includes: The information collection module is used to collect TCP SYN packet information; The message sending module is used to send penetration information to the controller, including five-tuple information, and may also include other key information of the TCPSYN packet.

[0030] The controller includes: The address storage module is used to store the mapping relationship between IP addresses and servers and supports lookup. The message forwarding module receives messages from the client and forwards them to the target server.

[0031] In the system provided by this invention, the client collects key information required to penetrate the firewall from the TCP SYN packet and notifies the server with the help of the controller. After the server sends the required TCP packet to penetrate the firewall, it can directly provide services to the client, ensuring security while greatly reducing service costs.

[0032] All or part of the technical solutions provided in the embodiments of the present invention can be implemented by software programming, and the software program is stored in a readable storage medium, such as a hard disk, optical disk or floppy disk in a computer.

[0033] The above description is only a preferred embodiment of the present invention and is not intended to limit the present invention. Any modifications, equivalent substitutions, improvements, etc., made within the spirit and principles of the present invention should be included within the protection scope of the present invention.

Claims

1. A method for traversing a symmetrical firewall, characterized in that, The method includes: The server reports its IP address to the controller; The client collects TCP SYN packet information and sends a message to notify the controller; The controller forwards the message to the server based on the destination IP address in the message; The server constructs a TCP packet based on the message.

2. The method for traversing a symmetrical firewall according to claim 1, characterized in that, The methods for the client to collect TCP SYN packet information include listening to TCP SYN packets or viewing the TCP state table through system commands.

3. The method for traversing a symmetrical firewall according to claim 1, characterized in that, The message sent by the client to the controller needs to include the five-tuple information of the TCP SYN packet, and may also include other key information.

4. The method for traversing a symmetrical firewall according to claim 1, characterized in that, The TCP packets constructed by the server include one or more different combinations of TCP SYN+ACK, TCP RESET, TCP SYN, TCP FIN, and TCP data packets.

5. The method for traversing a symmetrical firewall according to claim 1, characterized in that, The TCP packets constructed by the server and the TCP SYN key information sent by the client are consistent.

6. A system for symmetrical firewall penetration, characterized in that, The system includes: a server, a client, and a controller; The server is used to report the IP address to the controller and construct and send TCP packets based on the controller's messages; The client is used to collect TCP SYN packet information and send messages to the controller; The controller is used to assist the client in notifying the server of information about firewall penetration.

7. The system for symmetrical firewall penetration as described in claim 6, characterized in that, The server includes: The control module is used by the server to report the IP address of the service provider to the controller, and at the same time to receive messages from the controller; The message sending module is used to construct and send TCP messages; The client includes: The information collection module is used to collect TCP SYN packet information; The message sending module is used to send penetration information to the controller, including five-tuple information, and may also include other key information of the TCP SYN packet; The controller includes: The address storage module is used to store the correspondence between IP addresses and the server and supports lookup; The message forwarding module receives messages from the client and forwards them to the correct target server.

Images