A method for automatic IP allocation of service packets in an OpenVPN environment

Abstract

This invention discloses a method for automatically allocating service packets IP addresses based on an OpenVPN environment in the field of Virtual Private Network (VPN) technology. The method includes configuring multiple first IP address pools for first ID groups based on the OpenVPN server's management interface, associating each first IP address pool with a corresponding filter ID, setting the IP range for each first IP address pool, authenticating a second ID using server authentication, and obtaining the attributes of the filter ID corresponding to the second ID after successful authentication. Based on these attributes, the method matches the corresponding IP address pool within the first IP address pools to obtain the second IP address pool. This invention achieves non-overlapping IP address allocation by developing automated CCD files as configuration scripts and combining this with matching IP addresses to the attributes of the filter IDs used for authenticated user access. This avoids conflicts and allows for the allocation of different IP segments based on the user's service packet status, effectively improving the efficiency of IP address allocation management.

Description

Technical Field

[0001] This invention relates to the field of virtual private network technology, specifically a method for automatic IP allocation of service packets based on an OpenVPN environment. Background Technology

[0002] OpenVPN is an open-source Virtual Private Network (VPN) solution widely used for enterprise remote access and secure connections between sites. In traditional OpenVPN implementations, client IP addresses are typically allocated in the following ways: dynamically allocated IP address pools configured on the server side, or statically assigned IP addresses to each user via a CCD (Client Config Directory) file. Existing technologies have the following shortcomings:

[0003] 1) The method of dynamically allocating IP addresses from a pool cannot achieve the allocation of different IP segments based on user service groups;

[0004] 2) The method of statically assigning IP addresses to CCD files requires manual configuration, which is difficult to effectively improve the efficiency of IP address allocation and management.

[0005] 3) The lack of an IP conflict detection mechanism can easily lead to duplicate allocation of IP addresses, affecting the rational allocation of information resources;

[0006] 4) It cannot be deeply integrated with the existing RADIUS authentication system to achieve intelligent IP allocation based on user attributes, which is not conducive to improving the compatibility between IP addresses and user attributes. Summary of the Invention

[0007] The purpose of this invention is to provide an automatic IP allocation method for service packets in an OpenVPN environment. By developing an automated CCD file as a configuration script, and combining the attribute of the filter ID of the authentication server to authenticate the accessing user and matching unoccupied IP addresses, it can achieve non-overlapping IP address allocation. By real-time detection of the IP allocation status of online users to avoid conflicts, it solves the problem that traditional OpenVPN can only manually and statically bind IPs through CCD. It also solves the limitation of current external authentication schemes where Radius authentication servers can only bind a single fixed IP when issuing IPs through the Framed-IP attribute. Thus, it realizes the automatic and grouped allocation of user IP addresses in OpenVPN, and can also automatically detect IP conflicts when users with the same name dial into the server in parallel, thereby allocating independent and non-conflicting IP addresses to them, which greatly improves the efficiency and flexibility of VPN management.

[0008] To achieve the above objectives, the present invention provides the following technical solution:

[0009] Firstly, a method for automatic IP allocation of service packets based on an OpenVPN environment is provided, including:

[0010] Based on the management interface of the OpenVPN server, configure multiple first IP address pools for first ID groups, associate each first IP address pool with a corresponding filter ID (filter-id), and set the IP range for each first IP address pool. Here, the first ID group is the business user group.

[0011] Input the second ID into the management interface and authenticate the second ID using the server authentication method. After the second ID is authenticated, obtain the attribute of the filter ID corresponding to the second ID. Based on the attribute, match the IP address pool corresponding to the second ID in the first IP address pool to obtain the second IP address pool. Here, the second ID is the accessing user.

[0012] Search for available IP addresses for the second ID in the second IP address pool in a certain order, and the IP allocation records in the second IP address pool. Allocate an unused IP address to the second ID to obtain the allocated IP address.

[0013] Create a CCD file with the username of the second ID as the filename. The server-response authentication method includes authenticating the accessing user using RADIUS authentication, and by looking up the online IP allocation record of the second ID, it can be ensured that the allocated IP address does not conflict.

[0014] As a further aspect of the present invention: the server authentication method is to use a RADIUS server to authenticate the second ID.

[0015] As a further aspect of the present invention: the configuration of a first IP address pool with multiple first ID groups includes:

[0016] For each business user group in the first ID group, define non-overlapping IP address prefixes, start IP addresses, and end IP address pools to form the first IP address pool. The second ID is authenticated using a server-response authentication method. Once the second ID is authenticated, obtain the attributes of the first filter ID corresponding to the second ID, and match the second ID's IP address pool from the first IP address pool based on these attributes. This includes:

[0017] If the attribute of the first filter ID corresponding to the second ID is not obtained, then the default address pool is matched for the second ID.

[0018] As a further aspect of the present invention: the step of searching for available IP addresses for the second ID from the second IP address pool in a certain order includes:

[0019] Search for available IP addresses for the second ID from the second IP address pool in ascending order (e.g., values ​​in the range of 10 to 100 from smallest to largest).

[0020] As a further aspect of the present invention: the step of searching for available IP addresses for the second ID in a certain order from the second IP address pool, and the IP allocation records of the second IP address pool, and allocating an unoccupied IP address to the second ID to obtain the allocated IP address includes:

[0021] Query the management interface and search for available IP addresses for the second ID and the IP allocation records of the second IP address pool in ascending order;

[0022] Starting from the initial IP address in the second IP address pool, search sequentially for the first unoccupied IP address and assign it to the second ID. If no unoccupied IP address is found, return an allocation failure message to the management interface.

[0023] As a further aspect of the present invention: the creation of a CCD file with the username of the second ID as the filename includes:

[0024] Write the assigned IP address and its routing information into the CCD file that matches the second ID, and write the first instruction into the CCD file to assign the specified IP address;

[0025] Write the second instruction to the CCD file to configure the routing gateway;

[0026] A file locking mechanism is used to prevent concurrent write conflicts.

[0027] As a further aspect of the present invention: the first instruction is the ifconfig-push instruction (instruction to assign a specified IP address), and the second instruction is the route-gateway instruction (instruction to assign a specified route gateway).

[0028] As a further aspect of the present invention: the file locking mechanism method includes:

[0029] Regularly update the IP allocation records of the second IP address pool through the management interface;

[0030] While assigning unused IP addresses to the second ID, check the IP allocation status of online users in the second IP address pool;

[0031] Add a time interval check step to CCD file modification operations to prevent concurrent conflicts.

[0032] Secondly, a service packet IP automatic allocation system based on an OpenVPN environment is disclosed, the system comprising:

[0033] The IP address pool configuration module is configured as a management interface based on the OpenVPN server, which configures multiple first IP address pools with first ID groups, associates each first IP address pool with a corresponding filter ID (filter-id), and sets the IP range of each first IP address pool. The first ID group is the business user group.

[0034] The authentication interface module is configured to input a second ID into the management interface, authenticate the second ID using a server authentication method, and obtain the attribute of the filter ID corresponding to the second ID after the second ID is authenticated. Based on the attribute, the module matches the IP address pool corresponding to the second ID in the first IP address pool to obtain the second IP address pool. Here, the second ID is the accessing user.

[0035] The IP allocation management module is configured to search for available IP addresses for the second ID in a certain order from the second IP address pool, as well as the IP allocation records of the second IP address pool, and allocate an unoccupied IP address to the second ID to obtain the allocated IP address.

[0036] A configuration file generation module is configured to create a CCD file with the username of the second ID as the filename.

[0037] As a further aspect of the present invention: the authentication interface module is a RADIUS interface module.

[0038] Compared with the prior art, the beneficial effects of the present invention are:

[0039] 1. This invention develops automated CCD files as configuration scripts, combines the attributes of the filter ID of the authentication server to authenticate the access user, and matches unoccupied IP addresses to achieve non-overlapping IP address allocation. By real-time detection of the IP allocation status of online users to avoid conflicts, it can allocate different IP segments according to the user's business group status, effectively improving the operational and management efficiency of IP address allocation, which is conducive to the rational allocation of information resources, and at the same time improves the adaptability of IP address user attributes.

[0040] 2. This invention can improve the management of IP address pools and the efficiency of IP allocation by automatically allocating unoccupied IP addresses based on user ID attributes. By configuring the IP address pool of service user groups, it can support the non-overlapping allocation of IPs for multiple service groups. By setting a file lock mechanism to avoid IP conflicts, it can ensure the reliability of IP allocation. Attached Figure Description

[0041] Figure 1 This is a flowchart illustrating the method steps of the present invention;

[0042] Figure 2 This is a flowchart illustrating the use of a file locking mechanism to prevent concurrent write conflicts in this invention.

[0043] Figure 3 This is a flowchart illustrating the automatic IP address allocation process according to an embodiment of the present invention.

[0044] Figure 4 This is a system module diagram of the present invention;

[0045] Figure 5 This is a timing diagram for IP address allocation in this invention;

[0046] Figure 6 This is a diagram showing the relationship between the IP address pools of the multi-service user groups in this invention.

[0047] In the diagram: 1. IP address pool configuration module; 2. Authentication interface module; 3. IP allocation management module; 4. Configuration file generation module. Detailed Implementation

[0048] The technical solutions of the embodiments of the present invention will be clearly and completely described below with reference to the accompanying drawings. Obviously, the described embodiments are only some embodiments of the present invention, and not all embodiments. Based on the embodiments of the present invention, all other embodiments obtained by those skilled in the art without creative effort are within the scope of protection of the present invention.

[0049] Example:

[0050] like Figure 1 The diagram shows the method flowchart of the present invention. In this embodiment, a method for automatic allocation of service packet IPs based on an OpenVPN environment is provided, including the following steps:

[0051] S1: Based on the management interface of the OpenVPN server, configure multiple first IP address pools of first ID groups, associate each first IP address pool with a corresponding filter-id, and set the IP range of each first IP address pool. Here, the first ID group is the business user group.

[0052] S2: Input the second ID into the management interface and authenticate the second ID using the server authentication method. After the second ID is authenticated, obtain the attribute of the filter ID corresponding to the second ID. Based on the attribute, match the IP address pool corresponding to the second ID in the first IP address pool to obtain the second IP address pool. Here, the second ID is the accessing user.

[0053] S3: Search for available IP addresses for the second ID in the second IP address pool in a certain order, and the IP allocation records in the second IP address pool, and allocate an unoccupied IP address to the second ID to obtain the allocated IP address;

[0054] S4: Create a CCD file with the username of the second ID as the filename.

[0055] Preferably, the server-response authentication method includes authenticating the accessing user using RADIUS authentication. By checking the online IP allocation record for the second ID, it can be ensured that the allocated IP addresses do not conflict.

[0056] Preferably, in step S1, an independent first IP address pool is configured for different business user groups in the OpenVPN server. Each address pool is associated with the filter-id attribute of a specific RADIUS server, and the IP address prefix, start IP, and end IP address pool of each address pool are defined.

[0057] Preferably, in step S1, the configured multiple IP address pools do not overlap, and business users who do not match any filter-id use the default IP address pool.

[0058] In this embodiment, the procedure for configuring the first IP address pool of multiple first ID groups is as follows:

[0059] # Group 1 (gr-001)

[0060] gr_001_index="192.168.1"

[0061] pools_gr_001_start=10

[0062] pools_gr_001_end=50

[0063] # Group 2 (gr-002)

[0064] gr_002_index="192.168.2"

[0065] pools_gr_002_start=10

[0066] pools_gr_002_end=100

[0067] Each address pool is associated with a specific filter-id, and the IP ranges do not overlap.

[0068] In this embodiment, the procedure for periodically updating the IP allocation records of the second IP address pool through the management interface is as follows:

[0069] {

[0070] echo "log off"

[0071] echo "status"

[0072] sleep 0.5

[0073] echo "quit".

[0074] } | telnet $sock_path > "$temp_file"

[0075] In this embodiment, available IP addresses with the second ID are searched from the second IP address pool in a specific order. The procedure for checking whether an IP address has already been assigned is as follows:

[0076] allocated_ips=$(awk -F',' ' / ^[0-9]+\.[0-9]+\.[0-9]+\.[0-9]+ / {print $1}' "$allocation_file")

[0077] for ((ip_suffix=start; ip_suffix<=end; ip_suffix++)); do

[0078] ip="$server_index.$ip_suffix"

[0079] if ! echo "$allocated_ips" | grep -q "$ip"; then

[0080] echo "$ip"

[0081] return

[0082] fi

[0083] Done.

[0084] In this embodiment, the procedure for writing the assigned IP address and routing information into the accessing user's CCD configuration file is as follows:

[0085] echo "ifconfig-push $allocated_ip $server_mask" > "$ccd_file"

[0086] echo "push \"route-gateway $allocated_ip\"" >> "$ccd_file".

[0087] Preferably, in step S2, after the user is authenticated by RADIUS, the OpenVPN server obtains the user's filter-id attribute and matches the corresponding IP address pool based on the obtained filter-id attribute.

[0088] Preferably, in step S3, available IP addresses are searched sequentially from the corresponding IP address pool in ascending order, while the allocation records of online user IPs are queried, and IP addresses are assigned to the accessing users to ensure that the IP addresses assigned to the accessing users are not occupied.

[0089] Preferably, in step S3, the current online user IP allocation is obtained by querying the management interface of the OpenVPN server, and the first available IP is allocated starting from the initial IP of the address pool using a sequential search algorithm.

[0090] Preferably, in step S4, the allocated IP address and routing information are written into the access user's CCD configuration file to complete the automatic IP allocation.

[0091] Preferably, in step S4, the CCD configuration file is generated by including the ifconfig-push and route-gateway directives, and a file locking mechanism is used to prevent concurrent write conflicts.

[0092] like Figure 2 The flowchart shown is a process for preventing concurrent write conflicts using a file lock mechanism according to the present invention. The OpenVPN server receives user connection requests through the management interface and synchronously checks the modification time of the CCD file to determine if the last modification is less than 2 seconds. If the determination is yes, it waits for 1 second and obtains the list of online user IPs. If the determination is no, it directly obtains the list of online user IPs and sequentially checks whether the IPs are occupied, starting from the first IP. If the determination is yes, it indicates that the currently detected IP is not occupied, so the IP is locked, written to the CCD file, and the file lock is released. If the determination is no, it indicates that the currently detected IP has been occupied, and the next IP is detected.

[0093] like Figure 3 The diagram shown is a flowchart of the automatic IP address allocation in this embodiment. This embodiment also provides a flowchart of using a file lock mechanism to prevent concurrent write conflicts. When an access user connects, the system first checks the last modification time of the CCD file. If there is a modification within the last 2 seconds, it waits for 1 second to prevent concurrent conflicts. Then, it obtains the list of IP addresses of online users and searches for the first available IP address in sequence from the starting IP address in the address pool to ensure the uniqueness of the allocated IP address.

[0094] like Figure 4The diagram shown is a system block diagram of the present invention. This embodiment also provides a service packet IP automatic allocation system based on an OpenVPN environment. The system includes an IP address pool configuration module 1, an authentication interface module 2, an IP allocation management module 3, and a configuration file generation module 4. The IP address pool configuration module 1 is configured as a management interface based on an OpenVPN server, configuring multiple first IP address pools with first ID groups, associating each first IP address pool with a corresponding appropriate filter-id, and setting the IP range for each first IP address pool. The first ID group represents a service user group. The authentication interface module 2 is configured to input a second ID to the management interface. The second ID is authenticated using server authentication. Once the second ID is authenticated, the attributes of the filter ID corresponding to the second ID are obtained. Based on the attributes, the IP address pool corresponding to the second ID is obtained from the first IP address pool, thus obtaining the second IP address pool. Here, the second ID is the accessing user. The IP allocation management module 3 is configured to search for available IP addresses for the second ID in the second IP address pool in a certain order, as well as the IP allocation records of the second IP address pool, and allocate an unused IP address to the second ID, thus obtaining the allocated IP address. The configuration file generation module 4 is configured to create a CCD file with the username of the second ID as the filename.

[0095] Preferably, the authentication interface module 2 is a RADIUS interface module.

[0096] like Figure 5 The diagram shown is a sequence diagram of IP address allocation according to the present invention. The user initiates a connection request to the OpenVPN server. The OpenVPN server calls the RADIUS authentication interface module to initiate an authentication request. The RADIUS authentication interface module returns the appropriate filter-id to the OpenVPN server. The OpenVPN server requests IP allocation from the Allocation_Service. The Allocation_Service queries online IPs and allocates IPs from the address pool, returning the allocation result to the OpenVPN server. The OpenVPN server then allocates the IP to the user.

[0097] like Figure 6 The diagram shown illustrates the relationship between the IP address pool and the multi-service user group IP address pool of this invention. The IP address pool (IP_Pool) allocates IP addresses to online users.

[0098] The above are merely preferred embodiments of the present invention, but the scope of protection of the present invention is not limited thereto. Any equivalent substitutions or modifications made by those skilled in the art within the scope of the technology disclosed in the present invention, based on the technical solution and inventive concept of the present invention, should be covered within the scope of protection of the present invention.

Claims

1. A method for automatic IP allocation of service packets based on an OpenVPN environment, characterized in that, include: Based on the management interface of the OpenVPN server, configure multiple first IP address pools for first ID groups, associate each first IP address pool with a corresponding filter ID, and set the IP range for each first IP address pool. Here, the first ID group is the business user group. Input the second ID into the management interface and authenticate the second ID using the server authentication method. After the second ID is authenticated, obtain the attribute of the filter ID corresponding to the second ID. Based on the attribute, match the IP address pool corresponding to the second ID in the first IP address pool to obtain the second IP address pool. Here, the second ID is the accessing user. Search for available IP addresses for the second ID in the second IP address pool in a certain order, and the IP allocation records in the second IP address pool. Allocate an unused IP address to the second ID to obtain the allocated IP address. Create a CCD file with the username of the second ID as the filename.

2. The method for automatic IP allocation of service packets based on an OpenVPN environment according to claim 1, characterized in that: The first IP address pool configured with multiple first ID groups includes: Define non-overlapping IP address prefixes, start IP addresses, and end IP address pools for each business user group in the first ID group, forming the first IP address pool.

3. The method for automatic allocation of service packet IPs based on an OpenVPN environment according to claim 1, characterized in that: The step of searching for available IP addresses for the second ID from the second IP address pool in a certain order includes: Search for available IP addresses for the second ID in the second IP address pool in ascending order.

4. The method for automatic IP allocation of service packets based on an OpenVPN environment according to claim 2, characterized in that: The step of searching for available IP addresses for the second ID in a certain order from the second IP address pool, and allocating unused IP addresses to the second ID to obtain the allocated IP address, includes: Query the management interface and search for available IP addresses for the second ID and the IP allocation records of the second IP address pool in ascending order; Starting from the initial IP address in the second IP address pool, search sequentially for the first unoccupied IP address and assign it to the second ID. If no unoccupied IP address is found, return an allocation failure message to the management interface.

5. The method for automatic IP allocation of service packets based on an OpenVPN environment according to claim 1, characterized in that: The creation of a CCD file named after the username of the second ID includes: Write the assigned IP address and its routing information into the CCD file that matches the second ID, and write the first instruction into the CCD file to assign the specified IP address; Write the second instruction to the CCD file to configure the routing gateway; A file locking mechanism is used to prevent concurrent write conflicts.

6. The method for automatic IP allocation of service packets based on an OpenVPN environment according to claim 5, characterized in that: The first command is the ifconfig-push command, and the second command is the route-gateway command.

7. The method for automatic allocation of service packet IPs based on an OpenVPN environment according to claim 6, characterized in that: The file locking mechanism method includes: Regularly update the IP allocation records of the second IP address pool through the management interface; While assigning unused IP addresses to the second ID, check the IP allocation status of online users in the second IP address pool; Add a time interval check step to the modification operation of CCD files.

8. A service packet IP automatic allocation system based on an OpenVPN environment, characterized in that, The system includes: IP address pool configuration module (1), the IP address pool configuration module (1) is configured as a management interface based on the OpenVPN server, configures multiple first IP address pools of first ID groups, associates each first IP address pool with a corresponding and adapted filter ID (filter-id), and sets the IP range of each first IP address pool, wherein the first ID group is a business user group; The authentication interface module (2) is configured to input a second ID into the management interface and authenticate the second ID using the server authentication method. When the second ID is authenticated, the attribute of the filter ID corresponding to the second ID is obtained. The IP address pool corresponding to the second ID is obtained by matching the attribute in the first IP address pool to obtain the second IP address pool. The second ID is the access user. IP allocation management module (3), the IP allocation management module (3) is configured to search for available IP addresses of the second ID in a certain order from the second IP address pool, as well as the IP allocation records of the second IP address pool, and allocate unoccupied IP addresses to the second ID to obtain the allocated IP addresses; Configuration file generation module (4) is configured to create a CCD file with the username of the second ID as the file name.

Images