Traffic gateway method, system, device and medium based on same-intranet direct connection forwarding

Abstract

This invention provides a traffic gateway method, system, device, and medium based on direct intranet forwarding. The method includes: a client obtaining first proxy information and second proxy information, and sending traffic to be forwarded to the traffic gateway via a public network transmission channel according to the information; the traffic gateway receiving traffic carrying a target public IP address through the public network transmission channel corresponding to the first proxy information; replacing the target public IP address in the traffic with the private IP address of the corresponding business server in the intranet environment according to pre-configured network address translation rules; sending the replaced traffic to the business server via the intranet transmission channel corresponding to the second proxy information; and the business server receiving the traffic and forwarding it to the target website. This invention significantly reduces user traffic costs and greatly reduces enterprise operating costs by converting public network traffic into free intranet traffic.

Description

Technical Field

[0001] This invention relates to the field of network communication technology, and in particular to a traffic gateway method, system, device and medium based on direct forwarding within the same intranet. Background Technology

[0002] With the widespread adoption of cloud computing technology, more and more enterprises are deploying their operations on cloud servers. In application scenarios such as cross-border e-commerce, data collection, and online marketing, it is often necessary to run multiple proxy servers simultaneously to simulate network environments in different regions or to distribute request pressure. For example, in e-commerce browser applications, users need to assign independent proxy IPs to each store to ensure the isolation and security of store operations.

[0003] In existing technologies, a common proxy architecture is a single-layer direct connection mode: the client directly connects to the target business server through a proxy protocol (such as SOCKS5, HTTP proxy, etc.), and the business server then forwards the request to the target website. Under this architecture, all traffic between the client and the business server is transmitted over the public internet, leading to the following technical problems: 1. High Public Network Traffic Costs: Cloud service providers typically charge high fees for outbound traffic over the public network. For example, among mainstream cloud providers, public network traffic costs approximately 0.8 yuan / GB, while internal network traffic is usually free or extremely inexpensive. In a single-layer direct connection model, every request and response between the client and the business server must be transmitted over the public network, resulting in significant public network traffic consumption. When there are a large number of business servers, public network traffic costs become one of the main operating costs.

[0004] 2. Waste of bandwidth resources: In a single-layer direct-connect architecture, each business server independently handles the public network traffic of the clients it connects to, making centralized traffic scheduling and optimization impossible. When some business servers are under high load, their public network bandwidth may become a bottleneck, while the bandwidth of other servers remains idle, resulting in uneven resource utilization.

[0005] 3. Complex IP address management: In scenarios where different proxy IPs need to be assigned to a large number of clients, each business server needs to be bound to an independent public IP address. As the business scales up, the management and cost control of public IP addresses become technical challenges.

[0006] To address the above problems, there are some optimization solutions in the existing technology, such as: Proxy link aggregation: It reduces the number of connections through multiplexing technology, but it cannot change the fact that traffic must pass through the public network.

[0007] Data compression: Compressing transmitted data to reduce bandwidth consumption, but the compression effect is limited and increases CPU overhead.

[0008] Caching technology: Cache frequently used data on the client or proxy layer to reduce duplicate requests, but it cannot be applied to dynamic and real-time request scenarios. Summary of the Invention

[0009] The technical problem to be solved by this invention is to provide a traffic gateway method, system, device and medium based on direct forwarding within the same intranet, which reduces user traffic costs and greatly reduces the operating costs of enterprises.

[0010] In a first aspect, the present invention provides a traffic gateway method based on direct forwarding within the same intranet, applicable to a traffic gateway and at least one service server; wherein the traffic gateway and each of the service servers are located in the same virtual private cloud intranet environment, comprising: The client obtains the first proxy information and the second proxy information, where: The first proxy information is used to establish a public network transmission channel from the client to the traffic gateway; The second proxy information is used to establish an intranet transmission channel from the traffic gateway to the business server; The client sends the traffic to be forwarded to the traffic gateway through the public network transmission channel based on the first proxy information and the second proxy information; The traffic gateway receives traffic from the client through the public network transmission channel corresponding to the first proxy information, and the traffic carries the target public network IP address; The traffic gateway replaces the target public IP address in the traffic with the private IP address of the business server corresponding to the public IP address in the same virtual private cloud intranet environment according to the pre-configured network address translation rules. The private IP address uniquely identifies the business server in the same virtual private cloud intranet environment. The traffic gateway sends the replaced traffic to the business server through the same virtual private cloud intranet environment via the intranet transmission channel corresponding to the second proxy information; The business server receives the traffic through the intranet transmission channel corresponding to the second proxy information and forwards the traffic to the target website.

[0011] Furthermore, the client obtains the first proxy information and the second proxy information specifically as follows: The client retrieves first proxy information and second proxy information from the database; the first proxy information is the SSH proxy information of the traffic gateway, and the second proxy information is the SOCKS5 proxy information of the business server.

[0012] Furthermore, the pre-configured network address translation rule is an iptables DNAT rule, which redirects traffic destined for a specified public IP address to the corresponding internal IP address.

[0013] Furthermore, it also includes: The traffic gateway creates and manages proxy links, including creating primary proxy links and backup proxy links; Switch the currently used proxy link based on the link type; When switching proxy links, update the Domain Name System server configuration and routing rules.

[0014] Secondly, the present invention provides a traffic gateway system based on direct intranet forwarding, comprising: The client is used to obtain first and second proxy information, wherein: The first proxy information is used to establish a public network transmission channel from the client to the traffic gateway; The second proxy information is used to establish an intranet transmission channel from the traffic gateway to the business server; The client sends the traffic to be forwarded to the traffic gateway through the public network transmission channel based on the first proxy information and the second proxy information. A traffic gateway, deployed in the same virtual private cloud intranet environment as at least one business server, is used for: Traffic from the client is received through the public network transmission channel corresponding to the first proxy information; According to the pre-configured network address translation rules, the target public IP address in the traffic is replaced with the private IP address of the business server corresponding to the public IP address in the same virtual private cloud intranet environment. The private IP address uniquely identifies the business server in the same virtual private cloud intranet environment. The replaced traffic is sent to the business server through the same virtual private cloud intranet environment via the intranet transmission channel corresponding to the second proxy information. The business server, deployed in the same virtual private cloud intranet environment as the traffic gateway, is used to receive traffic forwarded by the traffic gateway through the intranet transmission channel corresponding to the second proxy information, and forward the traffic to the target website.

[0015] Furthermore, the traffic gateway includes: The rule configuration module is used to configure iptables DNAT rules, which are used to replace the destination IP address of traffic sent to a specified public IP address with the corresponding internal IP address; The proxy module is used to provide proxy services and receive proxy traffic from clients.

[0016] Furthermore, the first proxy information is the SSH proxy information of the traffic gateway, and the second proxy information is the SOCKS5 proxy information of the service server.

[0017] Furthermore, the traffic gateway also includes a link management module for creating and managing proxy links, the link management module including: The mainline link creation unit is used to create mainline proxy links based on configuration information; The backup link management unit is used to create and manage backup agent links; The link switching unit is used to switch the currently used proxy link according to the link type, and to update the domain name system server configuration and routing rules during the switching process.

[0018] Thirdly, the present invention provides an electronic device including a memory, a processor, and a computer program stored in the memory and executable on the processor, wherein the processor executes the program to implement the method described in the first aspect.

[0019] Fourthly, the present invention provides a computer-readable storage medium having a computer program stored thereon, which, when executed by a processor, implements the method described in the first aspect.

[0020] One or more technical solutions provided by this invention have at least the following technical effects or advantages: I. Significantly reduce public network traffic costs By switching traffic from public network paths to internal network paths, a substantial reduction in public network traffic costs is achieved. In the traditional single-layer direct-connect architecture, each business server independently handles the public network traffic of its connected clients, and all traffic is transmitted through the public network, incurring full public network traffic costs. In the architecture of this invention, the public network traffic of all business servers is centrally aggregated to a traffic gateway. The segment from the client to the traffic gateway still uses public network traffic for billing, but the segment from the traffic gateway to the business server is transmitted free of charge through the internal network. By leveraging the difference in billing rules among cloud service providers—"the more public network traffic is used, the lower the cost; and internal network traffic is free"—traffic that would otherwise need to be transmitted through the public network to the business server is centralized at the traffic gateway (i.e., a cloud server of the cloud service provider), and then forwarded through the internal network to the corresponding business server. This reduces traffic costs, and the cost savings become more significant as the scale of cloud servers increases.

[0021] II. Achieving centralized traffic management and optimized scheduling This approach overcomes the drawbacks of fragmented traffic in traditional single-layer direct-connect architectures, achieving a unified traffic entry point and centralized management. All client traffic passes through the traffic gateway, forming a single entry point, facilitating the implementation of unified traffic monitoring strategies; it supports traffic scheduling based on business priorities, ensuring bandwidth guarantees for critical services; and it facilitates the implementation of access control policies such as IP blacklists and whitelists, traffic rate limiting, and protocol filtering.

[0022] III. Simplify Public IP Address Management Reduce the procurement cost and management complexity of public IP addresses. Business servers can use internal IP addresses for internal communication, eliminating the need to allocate a separate public IP address to each business server; only a small number of public IP addresses need to be configured for the traffic gateway to serve a large number of business servers; the reduced demand for public IP addresses lowers the public IP leasing costs for cloud service providers; it simplifies the management of IP address application, registration, configuration, and maintenance; and it avoids the risk of business interruption due to public IP address blocking.

[0023] IV. Enhancing System Security Network isolation and encrypted transmission enhance the overall security of the system. Business servers are deployed on the intranet, not directly exposed to the public network, reducing the risk of direct attacks. Transmission from the client to the traffic gateway uses the SSH encryption protocol, ensuring data security on the public network transmission segment. The intranet transmission segment leverages the cloud service provider's intranet isolation mechanism, inherently possessing high security. Security measures, such as intrusion detection, DDoS protection, and access control, can be centrally deployed at the gateway layer. Intranet communication between business servers is unaffected by public network threats, reducing the risk of lateral movement attacks. The architecture design of "centralized public network entry, hidden business intranet" places business servers in a secure intranet environment, providing services externally only through encrypted channels, forming a multi-layered protection system.

[0024] V. Improve system scalability Adding or removing business servers does not affect client configuration, making system expansion more flexible and convenient. When adding a new business server, only the corresponding DNAT rules and SOCKS5 proxy configuration need to be added to the traffic gateway; the client does not need any modifications and still connects to the traffic gateway in the original way; when a business server goes offline, only the corresponding rule needs to be removed from the gateway configuration, without affecting other servers; it supports dynamic scaling of business servers to adapt to the needs of business fluctuations; it can seamlessly connect to dynamic infrastructure environments such as containerization and microservices; the client and business server are indirectly connected through the gateway, which maintains the mapping relationship between public IP and internal IP, and changes to the business server are only reflected at the gateway layer, which is transparent to the client.

[0025] VI. Compatible with the existing agent ecosystem No modifications to existing business server proxy protocols and client applications are required, lowering the barrier to technology implementation. Business servers continue to use the standard SOCKS5 proxy protocol, requiring no modification; clients use standard SSH and SOCKS5 clients, ensuring strong compatibility; seamless integration with existing proxy management platforms and databases is possible; gradual migration is supported, eliminating the need for a full, one-time overhaul; the technical solution is transparent to upper-layer applications and does not affect business logic; and the adoption of standardized proxy protocols (SSH, SOCKS5) and network technologies (iptables DNAT) ensures good compatibility with the existing technology ecosystem, reducing the resistance and cost of technology introduction.

[0026] VII. Applicable to a variety of application scenarios The technical solution boasts excellent versatility and can be widely applied to various scenarios requiring multiple proxy servers. Cross-border e-commerce browser: Assigns a dedicated proxy IP to each store, reducing operating costs.

[0027] The above description is merely an overview of the technical solution of the present invention. In order to better understand the technical means of the present invention and to implement it in accordance with the contents of the specification, and in order to make the above and other objects, features and advantages of the present invention more apparent and understandable, specific embodiments of the present invention are described below. Attached Figure Description

[0028] The present invention will be further described below with reference to the accompanying drawings and embodiments.

[0029] Figure 1 This is a flowchart of the method in Embodiment 1 of the present invention. Detailed Implementation

[0030] The overall concept of the technical solution in this application is as follows: A traffic gateway system based on direct connection and forwarding within the same intranet is provided. The system includes a client, a traffic gateway, and at least one business server. The traffic gateway and all business servers are deployed in the same Virtual Private Cloud intranet environment, provided by a cloud service provider, such as Alibaba Cloud's Virtual Private Cloud (VPC).

[0031] The client runs on a user terminal device, such as a personal computer, mobile terminal, or dedicated device. The client has either pre-installed or retrieved from a database first and second proxy information. The first proxy information is used to establish a public network transmission channel from the client to the traffic gateway, specifically the traffic gateway's SSH proxy information, including the traffic gateway's public IP address, port number, username, and password. The second proxy information is used to establish an internal network transmission channel from the traffic gateway to the business server, specifically the business server's SOCKS5 proxy information, including the business server's internal IP address, port number, username, and password.

[0032] The traffic gateway is a cloud server deployed in a virtual private cloud intranet environment, running a proxy service program and a traffic forwarding control program. The traffic gateway receives encrypted traffic from clients through the SSH proxy service corresponding to the first proxy information. This traffic carries the target public IP address, which is the public IP address of the target website that the client actually wants to access.

[0033] The traffic gateway is pre-configured with network address translation rules, specifically iptables DNAT rules. These rules establish a one-to-one mapping between the public IP address and the internal IP address of the business server. For example, for business server A, whose public IP address is 47.100.10.1 and internal IP address is 172.16.0.2, the configured rule is: `iptables -t nat -APREROUTING -d 47.100.10.1 -j DNAT --to-destination 172.16.0.2`. When the traffic gateway receives traffic destined for a public IP address of 47.100.10.1, it automatically replaces the destination IP address of the traffic with 172.16.0.2.

[0034] After the IP replacement is completed, the traffic gateway uses the SOCKS5 proxy service corresponding to the second proxy information to send traffic through the virtual private cloud intranet environment to the target business server's intranet IP address. Since the traffic is only transmitted within the virtual private cloud intranet environment, cloud service providers do not charge for this type of intranet traffic, thus realizing the conversion of public network traffic to intranet traffic and reducing public network traffic costs.

[0035] The business servers consist of multiple cloud servers deployed within the same virtual private cloud intranet environment, each running a SOCKS5 proxy service program. The business servers receive traffic from the traffic gateway through the intranet transmission channel corresponding to the second proxy information. The destination IP address in this traffic has been replaced with the business server's intranet IP address, but the original destination website address information is still retained in the SOCKS5 protocol data. The business servers parse the SOCKS5 protocol, obtain the original destination website address, then forward the request to the destination website and return the response data to the client along the original path.

[0036] With the above system architecture, the traffic cost generated by the public network transmission segment between the client and the traffic gateway is charged by the cloud service provider based on public network traffic, while the traffic generated by the internal network transmission segment between the traffic gateway and the business server is free. The overall public network traffic cost is significantly reduced compared to the traditional single-layer direct connection architecture.

[0037] For example, a cross-border e-commerce company uses 10 cloud servers as business proxy servers. Each server consumes approximately 1000GB of traffic per month, and the cloud service provider's public network traffic price is 0.8 yuan / GB. Using a traditional single-layer direct-connect proxy architecture, the monthly traffic cost per server is 800 yuan, plus a monthly machine cost of 300 yuan per server, resulting in a total monthly cost of 1100 yuan per server and 11000 yuan for 10 servers.

[0038] After adopting the technical solution of this invention, one traffic gateway server is deployed, along with 10 business servers, within the same virtual private cloud intranet. The monthly machine cost of the traffic gateway is 300 yuan, and the monthly traffic cost is 3000 yuan; the monthly machine cost of each business server is 300 yuan, and the monthly traffic cost is reduced to 400 yuan. The total cost of the 10 business servers is 7000 yuan, plus the traffic gateway cost of 3300 yuan, for a total monthly cost of 10300 yuan. Compared to the original solution, this represents a monthly saving of 700 yuan, a cost reduction of approximately 6.4%.

[0039] As business scales up, the cost savings become even more significant. When the number of business servers increases to 20, the original total cost was 22,000 yuan, while the new total cost was 1,000 × 20 + 300 = 20,300 yuan, saving 1,700 yuan, a cost reduction of approximately 7.7%. When the number of business servers increases to 50, the original total cost was 55,000 yuan, while the new total cost was 1,000 × 50 + 300 = 50,300 yuan, saving 4,700 yuan, a cost reduction of approximately 8.5%. Therefore, when the company has millions of clients, the cost reduction becomes very substantial.

[0040] Example 1 like Figure 1 As shown, this embodiment provides a traffic gateway method based on direct forwarding within the same intranet, applied to a traffic gateway and at least one service server; the traffic gateway and each of the service servers are located in the same virtual private cloud intranet environment, including: The client obtains the first proxy information and the second proxy information, where: The first proxy information is used to establish a public network transmission channel from the client to the traffic gateway; The second proxy information is used to establish an intranet transmission channel from the traffic gateway to the business server; The client sends the traffic to be forwarded to the traffic gateway through the public network transmission channel based on the first proxy information and the second proxy information; The traffic gateway receives traffic from the client through the public network transmission channel corresponding to the first proxy information, and the traffic carries the target public network IP address; The traffic gateway replaces the target public IP address in the traffic with the private IP address of the business server corresponding to the public IP address in the same virtual private cloud intranet environment according to the pre-configured network address translation rules. The private IP address uniquely identifies the business server in the same virtual private cloud intranet environment. The traffic gateway sends the replaced traffic to the business server through the same virtual private cloud intranet environment via the intranet transmission channel corresponding to the second proxy information; The business server receives the traffic through the intranet transmission channel corresponding to the second proxy information and forwards the traffic to the target website.

[0041] In this embodiment, preferably, the client obtains the first proxy information and the second proxy information specifically as follows: The client retrieves first proxy information and second proxy information from the database; the first proxy information is the SSH proxy information of the traffic gateway, and the second proxy information is the SOCKS5 proxy information of the business server.

[0042] In this embodiment, preferably, the pre-configured network address translation rule is an iptables DNAT rule, which redirects traffic destined for a specified public IP address to the corresponding internal IP address.

[0043] In this embodiment, preferably, it also includes: The traffic gateway creates and manages proxy links, including creating primary proxy links and backup proxy links; Switch the currently used proxy link based on the link type; When switching proxy links, update the Domain Name System server configuration and routing rules.

[0044] Based on the same inventive concept, this application also provides a system corresponding to the method in Embodiment 1, as detailed in Embodiment 2.

[0045] Example 2 This embodiment provides a traffic gateway system based on direct intranet forwarding, including: The client is used to obtain first and second proxy information, wherein: The first proxy information is used to establish a public network transmission channel from the client to the traffic gateway; The second proxy information is used to establish an intranet transmission channel from the traffic gateway to the business server; The client sends the traffic to be forwarded to the traffic gateway through the public network transmission channel based on the first proxy information and the second proxy information. A traffic gateway, deployed in the same virtual private cloud intranet environment as at least one business server, is used for: Traffic from the client is received through the public network transmission channel corresponding to the first proxy information; According to the pre-configured network address translation rules, the target public IP address in the traffic is replaced with the private IP address of the business server corresponding to the public IP address in the same virtual private cloud intranet environment. The private IP address uniquely identifies the business server in the same virtual private cloud intranet environment. The replaced traffic is sent to the business server through the same virtual private cloud intranet environment via the intranet transmission channel corresponding to the second proxy information. The business server, deployed in the same virtual private cloud intranet environment as the traffic gateway, is used to receive traffic forwarded by the traffic gateway through the intranet transmission channel corresponding to the second proxy information, and forward the traffic to the target website.

[0046] In this embodiment, preferably, the traffic gateway includes: The rule configuration module is used to configure iptables DNAT rules, which are used to replace the destination IP address of traffic sent to a specified public IP address with the corresponding internal IP address; The proxy module is used to provide proxy services and receive proxy traffic from clients.

[0047] In this embodiment, preferably, the first proxy information is the SSH proxy information of the traffic gateway, and the second proxy information is the SOCKS5 proxy information of the service server.

[0048] In this embodiment, preferably, the traffic gateway further includes a link management module for creating and managing proxy links, the link management module including: The mainline link creation unit is used to create mainline proxy links based on configuration information; The backup link management unit is used to create and manage backup agent links; The link switching unit is used to switch the currently used proxy link according to the link type, and to update the domain name system server configuration and routing rules during the switching process.

[0049] Since the system described in Embodiment 2 of this invention is a system used to implement the method of Embodiment 1 of this invention, those skilled in the art can understand the specific structure and variations of this system based on the method described in Embodiment 1 of this invention, and therefore will not be repeated here. All systems used in the method of Embodiment 1 of this invention fall within the scope of protection of this invention.

[0050] Based on the same inventive concept, this application provides an electronic device embodiment corresponding to Embodiment 1, as detailed in Embodiment 3.

[0051] Example 3 This embodiment provides an electronic device, including a memory, a processor, and a computer program stored in the memory and executable on the processor. When the processor executes the computer program, it can implement any of the implementation methods in Embodiment 1.

[0052] Since the electronic device described in this embodiment is the device used to implement the method in Embodiment 1 of this application, those skilled in the art can understand the specific implementation method and various variations of the electronic device in this embodiment based on the method described in Embodiment 1 of this application. Therefore, how the electronic device implements the method in the embodiment of this application will not be described in detail here. Any device used by those skilled in the art to implement the method in the embodiment of this application falls within the scope of protection of this application.

[0053] Based on the same inventive concept, this application provides a storage medium corresponding to Embodiment 1, as detailed in Embodiment 4.

[0054] Example 4 This embodiment provides a computer-readable storage medium storing a computer program thereon. When the computer program is executed by a processor, it can implement any of the implementation methods in Embodiment 1.

[0055] Those skilled in the art will understand that embodiments of the present invention can be provided as methods, systems, or computer program products. Therefore, the present invention can take the form of a completely hardware embodiment, a completely software embodiment, or an embodiment combining software and hardware aspects. Furthermore, the present invention can take the form of a computer program product embodied on one or more computer-usable storage media (including, but not limited to, disk storage, CD-ROM, optical storage, etc.) containing computer-usable program code.

[0056] This invention is described with reference to flowchart illustrations and / or block diagrams of methods, apparatus (systems), and computer program products according to embodiments of the invention. It will be understood that each block of the flowchart illustrations and / or block diagrams, and combinations of blocks in the flowchart illustrations and / or block diagrams, can be implemented by computer program instructions. These computer program instructions can be provided to a processor of a general-purpose computer, special-purpose computer, embedded processor, or other programmable data processing apparatus to produce a machine, such that the instructions, which execute via the processor of the computer or other programmable data processing apparatus, generate instructions for implementing the flowchart illustrations and / or block diagrams. Figure 1 One or more processes and / or boxes Figure 1 A device that provides the functions specified in one or more boxes.

[0057] These computer program instructions may also be stored in a computer-readable storage medium that can direct a computer or other programmable data processing device to function in a particular manner, such that the instructions stored in the computer-readable storage medium produce an article of manufacture including instruction means, which are implemented in a process Figure 1 One or more processes and / or boxes Figure 1 The function specified in one or more boxes.

[0058] These computer program instructions may also be loaded onto a computer or other programmable data processing equipment to cause a series of operational steps to be performed on the computer or other programmable equipment to produce a computer-implemented process, thereby providing instructions that execute on the computer or other programmable equipment for implementing the process. Figure 1 One or more processes and / or boxes Figure 1 The steps of the function specified in one or more boxes.

[0059] While specific embodiments of the present invention have been described above, those skilled in the art should understand that the specific embodiments described are merely illustrative and not intended to limit the scope of the present invention. Equivalent modifications and variations made by those skilled in the art in accordance with the spirit of the present invention should be covered within the scope of protection of the claims of the present invention.

Claims

1. A traffic gateway method based on direct forwarding within the same intranet, applied to a system including a traffic gateway and at least one service server; wherein the traffic gateway and each of the service servers are located in the same virtual private cloud intranet environment, characterized in that, include: The client obtains the first proxy information and the second proxy information, where: The first proxy information is used to establish a public network transmission channel from the client to the traffic gateway; The second proxy information is used to establish an intranet transmission channel from the traffic gateway to the business server; The client sends the traffic to be forwarded to the traffic gateway through the public network transmission channel based on the first proxy information and the second proxy information; The traffic gateway receives traffic from the client through the public network transmission channel corresponding to the first proxy information, and the traffic carries the target public network IP address; The traffic gateway replaces the target public IP address in the traffic with the private IP address of the business server corresponding to the public IP address in the same virtual private cloud intranet environment according to the pre-configured network address translation rules. The private IP address uniquely identifies the business server in the same virtual private cloud intranet environment. The traffic gateway sends the replaced traffic to the business server through the same virtual private cloud intranet environment via the intranet transmission channel corresponding to the second proxy information; The business server receives the traffic through the intranet transmission channel corresponding to the second proxy information and forwards the traffic to the target website.

2. The traffic gateway method based on direct forwarding within the same intranet as described in claim 1, characterized in that, The client obtains the first and second proxy information specifically as follows: The client retrieves first proxy information and second proxy information from the database; the first proxy information is the SSH proxy information of the traffic gateway, and the second proxy information is the SOCKS5 proxy information of the business server.

3. The traffic gateway method based on direct forwarding within the same intranet as described in claim 1, characterized in that, The pre-configured network address translation rule is an iptables DNAT rule, which redirects traffic destined for a specified public IP address to the corresponding internal IP address.

4. The traffic gateway method based on direct forwarding within the same intranet as described in claim 1, characterized in that, Also includes: The traffic gateway creates and manages proxy links, including creating primary proxy links and backup proxy links; Switch the currently used proxy link based on the link type; When switching proxy links, update the Domain Name System server configuration and routing rules.

5. A traffic gateway system based on direct forwarding within the same intranet, characterized in that, include: The client is used to obtain first and second proxy information, wherein: The first proxy information is used to establish a public network transmission channel from the client to the traffic gateway; The second proxy information is used to establish an intranet transmission channel from the traffic gateway to the business server; The client sends the traffic to be forwarded to the traffic gateway through the public network transmission channel based on the first proxy information and the second proxy information. A traffic gateway, deployed in the same virtual private cloud intranet environment as at least one business server, is used for: Traffic from the client is received through the public network transmission channel corresponding to the first proxy information; According to the pre-configured network address translation rules, the target public IP address in the traffic is replaced with the private IP address of the business server corresponding to the public IP address in the same virtual private cloud intranet environment. The private IP address uniquely identifies the business server in the same virtual private cloud intranet environment. The replaced traffic is sent to the business server through the same virtual private cloud intranet environment via the intranet transmission channel corresponding to the second proxy information. The business server, deployed in the same virtual private cloud intranet environment as the traffic gateway, is used to receive traffic forwarded by the traffic gateway through the intranet transmission channel corresponding to the second proxy information, and forward the traffic to the target website.

6. A traffic gateway system based on direct forwarding within the same intranet as described in claim 5, characterized in that, The traffic gateway includes: The rule configuration module is used to configure iptables DNAT rules, which are used to replace the destination IP address of traffic sent to a specified public IP address with the corresponding internal IP address; The proxy module is used to provide proxy services and receive proxy traffic from clients.

7. A traffic gateway system based on direct intranet forwarding according to claim 5, characterized in that, The first proxy information is the SSH proxy information of the traffic gateway, and the second proxy information is the SOCKS5 proxy information of the service server.

8. A traffic gateway system based on direct intranet forwarding according to claim 5, characterized in that, The traffic gateway further includes a link management module for creating and managing proxy links, the link management module including: The mainline link creation unit is used to create mainline proxy links based on configuration information; The backup link management unit is used to create and manage backup agent links; The link switching unit is used to switch the currently used proxy link according to the link type, and to update the domain name system server configuration and routing rules during the switching process.

9. An electronic device comprising a memory, a processor, and a computer program stored in the memory and executable on the processor, characterized in that, When the processor executes the program, it implements the method as described in any one of claims 1 to 4.

10. A computer-readable storage medium having a computer program stored thereon, characterized in that, When the program is executed by the processor, it implements the method as described in any one of claims 1 to 4.

Images